Alt text: Horizontal bar chart showing Anthropic at 40%, OpenAI at 27% and Google at 21% of estimated enterprise LLM spending in Menlo Ventures’ 2025 study, with all other providers combined at 12%. Source: Menlo Ventures, 2025 State of Generative AI Report, 9 December 2025.
An upstream supplier can withdraw a capability embedded in a product you use. On 28 August 2026, OpenAI announced its intention to wind down its model supply agreement with Cursor, proposing 12 November 2026 as the shutoff date 76 days later. The final date remained unconfirmed in guidance reviewed on 7 September 2026.
The supply base is concentrated. Menlo Ventures’ 2025 study estimated that three providers accounted for 88% of enterprise LLM spending: Anthropic 40%, OpenAI 27% and Google 21%.
Confidence in switching is not the same as capability. 89% of enterprise leaders believe they could change AI vendor within four weeks; of those who have actually attempted a migration, 58% say it failed or took far more effort than expected.
APRA:regulated entities already have relevant obligations. CPS 230 requires them to identify material service providers and manage relevant fourth party risks. The transition for pre existing contracts ended by 1 July 2026, and the amended standard includes exemptions from specified requirements.
1. A supplier dispute created a proposed transition deadline
2. Three suppliers account for 88% of estimated enterprise LLM spending
3. Nine in ten expect to switch within a month, but migration can require more effort than expected.
4. Australia already has a regulatory name for this problem
5. Four types of AI model dependency and how they can affect continuity
6. Where we would start: a 90 day model portability review
Most procurement conversations about artificial intelligence still treat the model as an input, like electricity or bandwidth something you buy, meter and largely forget. OpenAI’s announcement on 28 August 2026 highlights the risks of that framing. A commercial decision involving an upstream model supplier has created a proposed transition deadline for teams relying on affected OpenAI powered features in Cursor, even though those teams are not parties to the upstream agreement.
That is the shape of the risk that has been building quietly underneath enterprise AI adoption. It is not that models fail, or that vendors go out of business, though both happen. It is that the supply of a capability you now depend on can be withdrawn for reasons that have nothing to do with you, your contract, or your payment history and that organizations may not have tested how long it would take them to replace it
On 28 August 2026, OpenAI announced that it had notified SpaceX of its intention to wind down its model supply agreement with Cursor, proposing 12 November 2026 as the shutoff date. The final termination date remained unconfirmed in the guidance reviewed on 7 September 2026. The trigger was corporate rather than technical: SpaceX had acquired Cursor's maker, Anysphere, and OpenAI's custom agreement contained "a limited time window to cancel it after a change of control". OpenAI's stated reason was that it "cannot be confident that SpaceX will use our technology within our terms of service", citing prior conduct by Elon Musk's companies.
Alt text: Timeline showing four milestones: SpaceX agrees to acquire Anysphere for US$60 billion on 16 June 2026, the acquisition completing on 14 August 2026, OpenAI invoking its change of control clause on 28 August 2026, and the proposed end of Cursor supplied OpenAI model access on 12 November 2026, subject to confirmation 2026, a 76 day window. Source: OpenAI and CNBC, 2026.
DATE
EVENT
16 June 2026
SpaceX agrees to acquire Anysphere, Cursor's maker, in a deal valued at US$60 billion
14 August 2026
The acquisition completes, constituting a change of control under OpenAI's agreement with Cursor
28 August 2026
OpenAI announces that it has notified SpaceX of its intention to wind down its model supply agreement with Cursor
12 November 2026 proposed
Proposed end of Cursor supplied OpenAI model access; final date subject to confirmation
Read as gossip, this is a story about two well known founders. Read as an operating risk, it is something more useful: a worked example of a dependency that sits one layer below the vendor you actually contracted with, governed by terms you have never seen, and terminable on a timetable you do not control. The proposed dates allow 76 days between the announcement and the potential shutoff. Whether that is enough depends on the affected features, team size and validation requirements. Teams should assess their transition options without assuming that the proposed date is guaranteed or that the entire development environment must be replaced.
The reason a single supplier decision propagates so widely is that there are very few suppliers. Menlo Ventures' 2025 State of Generative AI Report, published on 9 December 2025 and based on a survey of nearly 500 US enterprise decision makers, put Anthropic at 40% of estimated enterprise LLM spending, OpenAI at 27% and Google at 21%. Together, these three providers accounted for 88% of estimated enterprise LLM spending in Menlo’s 2025 study.. Menlo estimated that open source models’ share of enterprise LLM spending fell from 19% in 2024 to 11% in 2025.
Concentration on its own is not a fault; most infrastructure markets consolidate, and the alternative a long tail of undercapitalised model providers carries its own risks. As spending grows, organisations have more reason to assess the supplier dependencies attached to that investment. Gartner forecast on 20 July 2026 that the worldwide AI platforms and models market would reach US$64.3 billion in 2026, up 63.4% on 2025, with spending on foundation generative AI models more than doubling from US$11.4 billion to US$23.4 billion in a single year.
Alt text: Grouped horizontal bar chart comparing 2025 actual against 2026 forecast spending across four segments of the worldwide AI platforms and models market, with foundation and frontier generative models rising from 11.4 to 23.4 billion US dollars. Source: Gartner, 20 July 2026.
Emily Mabie, Senior AI Automation Engineer, Zapier
The gap that should concern a CTO is not between adoption and concentration. It is between how portable organisations believe their AI stack is and how portable it turns out to be when they move it.
A survey of 542 US enterprise decision makers with active paid AI vendor contracts, fielded by Centiment for Zapier between 30 January and 6 February 2026 and published on 2 April, found that 89% believed they could switch AI vendor within four weeks, with 41% putting it at two to five business days. Among the 66% who had actually attempted a migration between AI platforms, 58% reported that it failed or required significantly more effort than expected. Seventy four per cent said that losing their primary AI vendor would disrupt day today operations or leave them unable to function; 6% said they could stop using it with no interruption at all.
Alt text: Horizontal bar chart contrasting 89% who believe they could switch AI vendor within four weeks against 74% who would be disrupted without their primary vendor, 58% whose attempted migration failed or required significantly more effort than expected, and 6% who could stop with no interruption. Source: Zapier and Centiment, published 2 April 2026.
Separate survey data shows that respondents largely stayed with their existing providers, but does not establish that switching was difficult. Menlo Ventures’ mid year update of 31 July 2025, based on a survey of 150 technical decisionmakers at enterprises and startups, found that over the preceding twelve months, 66% had upgraded to a newer model from their existing provider, 23% had not changed models, and 11% had switched providers.
Alt text: Horizontal bar chart showing that 66% of surveyed technical decisionmakers at enterprises and startups upgraded within their existing provider, 23% did not change model, and only 11% switched to a different model provider over twelve months. Source: Menlo Ventures, 31 July 2025.
Switching models can involve more than changing an API call. Prompts and evaluation suites may need to be revised for the replacement model. Fine tuned artefacts may not transfer directly, and differences in latency and context window limits may require application changes. The effort depends on the workload and the models involved.
Australian financial institutions have been working through a version of this since APRA's Prudential Standard CPS 230 commenced on 1 July 2025. The standard requires APRA regulated entities to identify and maintain a register of their material service providers. A provider is material if the entity relies on it to undertake a critical operation or if it exposes the entity to material operational risk. Requirements for service provider agreements and exit provisions are subject to specified exemptions under the standard. The service provider management policy must also address risks associated with fourth parties that material service providers rely on to deliver a critical operation to the entity. Pre existing contracts were given until the earlier of their next renewal or 1 July 2026 a transition that has now closed, alongside amendments to the standard and its guidance that also took effect on 1 July 2026.
If you are APRA regulated, the questions in this article are already compliance questions, and a model provider reached through a SaaS tool may well meet the materiality test. If you are not regulated, you are still likely to inherit the expectation through your customers: enterprises that must evidence substitutability and exit planning for their own material providers increasingly push the same requirement down their supply chain. Being able to answer it is becoming a condition of the contract rather than a differentiator within it.
New Zealand has its own outsourcing requirements for large banks covered by the Reserve Bank of New Zealand’s BS11 policy. These requirements aim to preserve essential banking services when a parent company or major outsourcing provider experiences disruption. New Zealand businesses should assess their applicable domestic requirements alongside any obligations in contracts with Australian customers or group companies.
Treating "our AI vendor" as one relationship is what makes this hard to plan for. The table below outlines four ways an organization may depend on AI models, each with potentially different contractual terms, notice periods and responsibilities.
LAYER
WHAT YOU DEPEND ON
WHAT A WITHDRAWAL LOOKS LIKE
WHERE THE CONTROL SITS
Direct model API
A provider's models, called from your own code
Contract terms, notice period and price changes are visible to you
Your contract and your architecture
Tool built on a model
A third party product that resells or embeds someone else's model
The tool remains, the model behind it changes or disappears
The tool vendor's upstream contract
Model inside a SaaS platform
A capability bundled into software you already license
A feature may become unavailable, lose functionality, change behavior or be repriced
The platform vendor; notification obligations depend on the applicable terms
Model in a product you ship
A provider's models embedded in what your customers buy
Your product's behavior and your customer commitments are exposed
Your contract, but your customers' risk
The Cursor case illustrates the dependency described in the second row: a tool can remain available while an upstream model capability is withdrawn. Vendor risk assessments may overlook this dependency unless they explicitly examine upstream providers, continuity arrangements and replacement options.
The impact of an upstream model withdrawal depends on which features an organisation uses and what replacement options are available. The Zapier survey is a single vendor published study of US respondents, with self reported migration experience. These findings describe the surveyed respondents’ experiences and expectations; they should not be treated as representative of all enterprises or as a prediction of any individual organisation’s migration outcome.
The following three steps can help assess model portability alongside ongoing AI adoption, with timing and scope adapted to the organisation’s risks and resources.
1.
Map the dependency, including the layer below your vendor. Record, for every AI capability in production, which model sits underneath it, who holds that contract, and what notice you would receive. For bought in tools, ask the vendor directly and record any information gaps that limit your ability to assess continuity risk.
2.
Write the exit test before you need it. Pick one meaningful workload and actually move it to a second provider in a non production environment. A controlled migration test can help estimate the effort, cost and technical changes involved in switching providers for the selected workload. A full migration may involve additional requirements that the test does not capture.
3.
Put the clause in the contract at renewal. At procurement or renewal, seek clear terms covering model withdrawal notice, upstream supplier changes, data and artefact portability, and continuity for embedded models. Whether these terms can be negotiated depends on the provider and the agreement; later changes may require renegotiation.
WEEKS
FOCUS
WHAT "DONE" LOOKS LIKE
1 to 4
Dependency map
Every production AI capability listed with its underlying model, contract holder, notice period and business criticality
5 to 8
Exit test
One material workload moved to an alternate provider in a test environment, with the evaluation delta and effort recorded
9 to 12
Contract and architecture
Portability clauses queued for the next renewal; an abstraction layer or gateway in place for the workloads where the test showed it pays for itself
None of this is an argument for multi model architecture everywhere. Abstraction has a real cost, and building for portability you never exercise is its own form of waste. The argument is narrower: you should know what your switching cost is, and at the moment most organizations are estimating it rather than measuring it.
Directly, no. Structurally, it is worth reading as a template. The mechanism a supplier terminating on a change of control clause in an agreement you are not party to applies to any tool in your estate that resells or embeds a third party's models, which is most of them.
Not on its own. Self hosting removes one dependency and adds several, including capability lag and the operational burden of serving infrastructure. Enterprise adoption of open source models actually fell from 19% to 11% over 2025, which suggests most organisations have weighed that trade off and declined it. The realistic protection is portability, not independence.
No. Consolidation buys real things: negotiating leverage, a smaller security surface, less operational sprawl. The problem is not choosing one provider; it is choosing one provider without knowing what the second one would cost you or how long it would take.
Two ways. The dependency often sits a layer below the vendor you contracted with, so it does not appear in a standard third party assessment. And the switching cost is carried in prompts, evaluations and tuned behaviour rather than in data migration, which means the usual portability questions about data export do not measure it.
APRA's standard is technology neutral: it turns on whether a service is material to a critical operation, not on what kind of service it is. Whether a particular model provider or AI tool meets that test is a judgement for the entity and its advisers, and it is a judgement worth documenting either way. Amendments to CPS 230 and its guidance took effect on 1 July 2026 and should be read directly.
Run the exit test on one workload. It takes days rather than months, it produces a number you can put in front of a board, and it converts a theoretical risk into a measured one.
Ahasna Rathnakoon
Software Engineer Intern
Blog
