Enterprise AI Implementation: Portability and Decision Frameworks

This is Part 3 of a three-part series on Enterprise AI Strategy. Part 1 covers strategy, economics, and where competitive advantage emerges. Part 2 examines risk, security, and regulatory considerations.

---

Introduction

Part 1 established that competitive advantage comes from workflow transformation rather than model ownership. Part 2 examined the risk landscape across providers, supply chains, and regulations. This final article addresses implementation: how to manage vendor dependency, design for portability, and make structured decisions about AI investments.

---

Managing Vendor Dependency: Portability Over Complexity

For UK and EU enterprises, dependency on any single AI provider presents strategic risks that require active management—not avoidance. Full technological independence is neither realistic nor economically rational for most organisations. The objective is resilience through portability, not multi-vendor complexity.

A common recommendation is to adopt multi-cloud, multi-model architectures. Whilst technically sound, this approach introduces significant overhead: multiple vendor relationships, divergent APIs, duplicated governance frameworks, larger attack surface and increased operational costs. For most enterprises, the complexity costs outweigh theoretical resilience benefits.

A more pragmatic approach: Design for portability, not simultaneous multi-vendor deployment.

1. Architectural Portability

Design AI systems with abstraction layers that enable switching providers when economically justified or risk conditions change—rather than running multiple providers simultaneously. Implement RAG and fine-tuning workflows that isolate proprietary data from any single vendor’s specific APIs or formats. Use standardised interfaces (OpenAI-compatible APIs, for example) that multiple providers support, reducing switching costs without incurring multi-vendor operational overhead.

2. Contractual Protections

Negotiate explicit terms on data residency, prohibitions on training models using enterprise data, breach notification requirements, and independent audit rights. Blanket terms and conditions from major vendors are negotiable at enterprise scale. Legal teams should secure contractual rights aligned to EU AI Act expectations—including transparency and documentation obligations—regardless of where workloads are hosted.

3. Trigger-Based Migration Planning

Rather than maintaining parallel deployments, establish clear criteria for when migration becomes justified: material price increases exceeding defined thresholds, regulatory changes affecting data sovereignty, security incidents affecting the incumbent provider, or emergence of demonstrably superior alternatives. Pre-define the migration pathway and maintain sufficient technical documentation to execute within acceptable timeframes.

4. Selective Sovereign Infrastructure

Host genuinely sensitive workloads on UK/EU cloud or sovereign infrastructure whilst using established providers for scale and commodity workloads. Initiatives such as the HPE/Nvidia EU AI Factory Lab (Grenoble) and UK-based private AI facilities provide compliant options for regulated inference. This targeted approach avoids the cost of comprehensive multi-cloud deployment whilst protecting critical assets.

5. Governance as the Constant

Regardless of provider selection, establish governance frameworks that satisfy EU AI Act obligations and internal risk appetite. UK and EU governance specialists—including PwC UK’s Assurance for AI practice, KPMG’s Trusted AI Services, and independent advisors—can provide frameworks that remain applicable across provider changes. The governance layer should be vendor-agnostic even if the infrastructure layer is not.

6. Interface Portability: Beyond Model-Level Switching

Model portability alone is insufficient if organisational workflows become dependent on specific AI interfaces. Microsoft 365 Copilot, ChatGPT Enterprise, and similar platforms create lock-in through mechanisms distinct from underlying model dependency:

Data integration depth: Copilot’s access to Microsoft Graph—emails, calendars, documents, and user relationships—creates integration that cannot be replicated by switching models alone. The interface becomes the control point for AI-enhanced data access across the enterprise. SharePoint agents, Teams integrations, and OneDrive connections create ecosystem dependencies that extend far beyond the AI model itself.

Workflow and configuration assets: Organisations accumulate Custom GPTs, prompt libraries, SharePoint agents, and AI-enhanced workflows that represent institutional knowledge. OpenAI’s 2025 Enterprise AI Report indicates Custom GPT and Projects usage increased 19x year-to-date, with some enterprises deploying thousands of custom configurations. These assets require substantial effort to recreate on alternative platforms and represent non-portable intellectual property.

User training and habit formation: Investment in change management and user training creates organisational inertia. Employees develop interface-specific habits—prompt patterns, feature expectations, workflow integration—that persist even when superior alternatives emerge. Research indicates the “human element” and change management often exceed technical implementation complexity.

Shadow AI dynamics: Industry research suggests 69% of organisations suspect or have evidence of employees using prohibited generative AI tools. Interface choice shapes shadow AI patterns—restrictive or poorly integrated official tools drive employees to consumer alternatives. The interface that employees adopt first often becomes their organisational default.

Mitigation strategies:

• Document AI workflows independently: Maintain platform-agnostic documentation of AI-enhanced processes, prompt strategies, and configuration logic—not just the configurations themselves. This preserves institutional knowledge in portable form.

• Avoid deep single-vendor integration prematurely: Whilst early-stage adoption remains fluid (industry research indicates only 5% of organisations have scaled Copilot beyond pilots), resist pressure to embed AI interfaces deeply into core workflows before evaluating alternatives and establishing portability practices.

• Evaluate interface-agnostic orchestration layers: Emerging platforms enable workflow orchestration across multiple AI interfaces, reducing dependency on any single vendor’s client software whilst preserving productivity benefits.

• Separate data access from AI interface: Where possible, maintain data integration through APIs and connectors that can support multiple AI interfaces, rather than relying solely on vendor-specific data access mechanisms.

• Include interface portability in vendor negotiations: Contractual terms should address not only data portability and model switching but also the ability to export workflow configurations, Custom GPT definitions, prompt libraries, and institutional knowledge assets.

• Calculate total switching costs: Include interface migration costs—user retraining, workflow reconstruction, configuration rebuilding—in total cost of ownership assessments, not just infrastructure and API costs.

The objective is not to avoid these interfaces—they deliver genuine productivity value. OpenAI reports enterprise users save 40–60 minutes daily, and frontier firms demonstrate 2x higher message volume per seat than median enterprises. The objective is to adopt them with deliberate attention to exit costs and switching optionality, ensuring that interface choice remains a strategic decision rather than an irreversible commitment.

Concentration Risk and Portability Strategy

Over 50% of organisations use open source AI technologies, rising to 72% among technology companies, in part to reduce dependency on single providers. McKinsey’s April 2025 research found that three-quarters of respondents expect to increase their use of open source AI technologies over the next several years, with most preferring to use partially open models (open weights but not meeting full OSI standards).

“AI sovereignty” should be interpreted pragmatically. Full independence is unrealistic for most enterprises. However, resilience through portability—rather than simultaneous multi-vendor deployment—is achievable and economically sensible.

The strategic value of open source lies not in running multiple providers concurrently, but in reducing switching costs. Organisations that design systems around open standards and abstraction layers can migrate between providers when conditions warrant—whether due to pricing changes, regulatory shifts, or superior alternatives emerging—without the ongoing operational burden of maintaining parallel deployments. Open source models serve as a credible fallback option that keeps incumbent vendors commercially accountable, even when not actively deployed.

---

Strategic Implications

Control vs. Ownership: The organisations capturing the most value from AI treat it as a catalyst to transform their organisations, redesigning workflows and accelerating innovation. They focus on control over outcomes rather than ownership of infrastructure. As BCG research indicates, 70% of AI’s potential value is concentrated in core business functions—sales, marketing, supply chain, manufacturing, and pricing—not in model ownership but through strategic application.

Open Source as Strategic Lever: Open source models have matured from experimental alternatives to enterprise-viable options. Self-hosting enables data sovereignty, cost optimisation, and reduced vendor dependency—but requires investment in infrastructure, MLOps capability, and governance frameworks. The trade-off between API convenience and self-hosted control should be evaluated based on inference volumes, data sensitivity, and internal capability.

Regional Provider Evaluation: Emerging market AI providers offer compelling economics but present varying compliance, reputational, and regulatory considerations depending on jurisdiction. Enterprise evaluation should apply consistent due diligence criteria across all providers, weighing cost savings against data sovereignty requirements, regulatory alignment, and stakeholder expectations. Self-hosted deployment of open-weight models captures cost benefits whilst mitigating data transfer concerns—but requires enhanced safety guardrails.

Governance as Competitive Advantage: Governance maturity stands out as the strongest indicator of AI readiness. Organisations with established governance show tighter alignment between boards, executives, and security teams, and report greater confidence in their ability to protect AI deployments. This suggests that investing in governance capabilities may deliver greater returns than investing in infrastructure ownership.

Portability Over Complexity: Rather than pursuing multi-cloud, multi-model architectures that introduce operational and security overhead, enterprises should design for portability—the ability to switch providers when conditions warrant rather than maintaining parallel deployments. This approach delivers resilience benefits without the cost burden of simultaneous multi-vendor operations.

Interface Portability: Model-level portability is necessary but insufficient. Organisations must also manage interface-level lock-in created by platforms such as Microsoft 365 Copilot and ChatGPT Enterprise. Workflow configurations, Custom GPTs, and institutional knowledge embedded in these interfaces represent switching costs that persist regardless of underlying model portability. Evaluate interface adoption with the same strategic rigour applied to infrastructure decisions.

Supply Chain Diligence: As open source AI adoption increases, enterprises must apply supply chain security practices historically reserved for critical software infrastructure. Model provenance verification, third-party evaluation, and continuous monitoring should be standard practice—not afterthoughts.

Speed to Value: Among leaders, 49% say the hardest part of scaling AI is demonstrating clear business value. The conversation has shifted from technology sophistication to measurable improvements in cycle-time reductions, EBIT impact, cost-to-serve, and revenue per employee. Organisations that prioritise time-to-value over architectural purity will outperform those pursuing comprehensive model ownership.

---

A Decision Framework for CTOs and CISOs

Build / Buy / Shape / Host / Partner

Strategy	When It Makes Sense	Primary Risks
Build	Platform vendors with customer scale to amortise costs; unique IP requiring protection	Capital intensity, regulatory exposure, talent concentration, supply chain complexity
Buy (API)	Commodity use cases where differentiation is not required; low-to-moderate volumes	Vendor lock-in, interface dependency, limited customisation, third-party dependency, data sovereignty concerns
Shape	High-value differentiation through fine-tuning or RAG	Data engineering burden, ongoing maintenance, governance requirements
Host (Open Source)	High-volume inference; data sovereignty requirements; cost optimisation priority	Infrastructure complexity, MLOps capability requirements, security responsibility
Partner	Speed-critical deployment or niche expertise requirements	Dependency management, contract complexity, integration challenges

Key Discipline: Treat AI decisions as portfolio investments, not monolithic bets. BCG’s playbook for AI value creation emphasises leading from the top with an aggressive multi-year strategic AI ambition, reshaping the business with value-based prioritisation of AI initiatives, unlocking an AI-first operating model rooted in human-machine augmentation, securing necessary talent by upskilling people, and building a fit-for-purpose technology architecture and data foundation.

---

Conclusion: Control the Outcomes, Not the Models

For most global enterprises, the strategic objective should be control, resilience, and selective differentiation, not ownership for its own sake.

The evidence across this series is clear:

• Building a foundation LLM is rarely justified outside platform economics
• Security and compliance require governance maturity more than infrastructure ownership
• Open source models now offer enterprise-viable alternatives with compelling economics for high-volume workloads
• Regional AI providers present varying considerations that warrant consistent due diligence across all vendors
• Portability-focused architectures deliver resilience without multi-vendor complexity
• Interface lock-in creates switching costs distinct from model dependency
• The organisations achieving meaningful returns focus on workflow transformation rather than model ownership

Key requirements for success:

Strategic Clarity: Define where AI can transform core business processes—not just support functions. BCG research shows 70% of AI’s potential value is concentrated in core operations including sales, marketing, supply chain, and manufacturing.

Governance Maturity: Establish comprehensive technology and security governance before scaling. Organisations with robust governance report greater confidence and tighter executive alignment.

Portfolio Approach: Treat AI decisions as portfolio investments with diversified risk exposure across build, buy, shape, host, and partner strategies. Include open source options in evaluation frameworks.

Portability by Design: Design AI systems for provider portability rather than multi-vendor complexity. Establish clear migration triggers and maintain switching capability without incurring the overhead of simultaneous multi-cloud operations.

Interface Portability: Evaluate AI interface adoption with the same rigour applied to infrastructure decisions. Document workflows independently of platform, avoid premature deep integration before establishing portability practices, and include interface switching costs—user retraining, workflow reconstruction, configuration rebuilding—in total cost of ownership calculations. The strategic window to establish interface portability practices exists now, before enterprise adoption scales beyond current pilot stages.

Supply Chain Security: Implement robust provenance verification for open source models. The documented risks of backdoors and data poisoning require the same rigour applied to critical software infrastructure.

Value-Based Prioritisation: Focus on use cases with measurable business impact within 12–18 months. The hardest part of scaling AI is demonstrating clear business value.

Regulatory Readiness: Prepare for EU AI Act obligations regardless of proposed postponements. High-risk system rules are now anticipated for December 2027, but political uncertainty means original August 2026 dates could still apply. Build compliance capability now.

Consistent Provider Evaluation: Apply consistent due diligence criteria across all AI providers—established and emerging—evaluating data sovereignty, regulatory alignment, security posture, and stakeholder expectations. Geography alone should not determine evaluation rigour.

The organisations that succeed will be those that ask the right question, invest where advantage is provable, and resist the temptation to confuse technical capability with strategic value.

For CTOs and CISOs alike, the mandate is clear: design for resilience first, differentiation second, and ownership only where it is unequivocally justified.

---

Series Summary

This three-part series has provided a comprehensive framework for enterprise AI strategy:

• Part 1: Strategy and Economics — Reframing the ownership question, understanding where competitive advantage emerges, and the economic realities of build vs. buy decisions

• Part 2: Risk and Security — Evaluating AI providers, managing supply chain security, and navigating regulatory requirements

• Part 3: Implementation and Portability — Managing vendor dependency, designing for portability, and practical decision frameworks

The consistent theme: control outcomes, not infrastructure. The organisations capturing real value from AI are those transforming workflows and accelerating innovation—not those building models for their own sake.

---

References

[1] BCG, “The Widening AI Value Gap: Build for the Future 2025” (September 2025).

[2] McKinsey, “The State of AI: How Organizations are Rewiring to Capture Value” (March 2025).

[3] McKinsey, “The State of AI in 2025: Agents, Innovation, and Transformation” (November 2025).

[4] McKinsey, Mozilla Foundation, and Patrick J. McGovern Foundation, “Open Source Technology in the Age of AI” (April 2025).

[5] McKinsey, “Triple the Return: How Companies Can Get More from Enterprise Tech” (October 2025).

[6] Deloitte, “State of Generative AI in the Enterprise” (2024).

[7] Deloitte, “AI Trends: Adoption Barriers and Updated Predictions” (September 2025).

[8] OpenAI, “The State of Enterprise AI 2025” (December 2025).

[9] PwC, “AI Agent Survey” (May 2025).

Image generated by Night Cafe Studio AI