Weigh up how AI could affect financial stability, concentrating on third-party reliance and provider concentration, market correlations, cyber risk, model risk with data and governance, and others like fraud, disinformation and misalignment.
The idea
AI could affect financial stability through several channels. Third-party dependence and provider concentration arise when many firms rely on a few suppliers of cloud, specialised chips and foundation models, so one outage or failure spreads widely. Market correlations rise if firms use similar models and data, producing herding, procyclical selling and sharper price moves. Cyber risk grows because attackers can use AI for convincing phishing and deepfakes, and models themselves can be attacked through data poisoning. Model risk covers opacity, poor data quality, bias, hallucination and weak governance and validation. Other channels include AI-enabled fraud, disinformation that can trigger runs or market moves, and misalignment. Misalignment is where an AI system pursues objectives its designers did not intend. Concentration and correlation are the two most systemic channels, because they turn firm-level failures into system-wide ones.
A practice question
Which statement best describes the financial stability risk from provider concentration in AI?
- Many competing providers push down service quality and make every firm's models worseWhy not: Competition is not the concern; the vulnerability is a small number of providers, not many.
- Each firm builds its own models in-house, which removes oversight of the whole systemWhy not: Reverses the issue: in-house development reduces provider dependence; the worry is shared external suppliers.
- Many firms depend on a few cloud, chip or model providers, so one failure hits many - correct
- Providers charge higher fees, which reduces firms' profitability and capitalWhy not: Pricing is a business matter; the stability concern is a common-point-of-failure from dependence.
Reliance on a handful of providers of cloud, specialised chips or pretrained models creates a common point of failure. An outage or flaw at one provider can hit many institutions simultaneously.
A harder one
A bank's critical customer service and credit systems use the API of a foundation model provider that most of its peers also use. Which control best addresses the third-party and concentration risk?
- Retraining the model on a much larger set of the bank's own internal dataWhy not: Improves model performance but does nothing about dependence on a single supplier.
- Requiring the provider to hold more regulatory capitalWhy not: Providers are generally outside the bank capital framework, so capital is not a control the bank can apply.
- Relying on the standard service level agreement aloneWhy not: A contract gives remedies after failure but does not provide operational continuity or a way to switch.
- An exit plan with substitutable providers - correct
The vulnerability is dependence, so the control is substitutability, contingency and exit planning together with ongoing oversight of the provider. Model retraining and capital do not reduce dependence.
The hardest tier
A lender relies on a vendor's pretrained model for credit decisions. Its outputs cannot be explained, the lender has little knowledge of the training data, and validation is limited to back-testing on a benign period. Which weakness most directly prevents errors and bias from being found before they affect customers?
- Provider concentration in the cloud market, which raises systemic riskWhy not: A real vulnerability, but it concerns supplier dependence, not the ability to detect model errors or bias.
- Correlated trading behaviour among peers using similar modelsWhy not: A market channel unrelated to detecting errors in a credit model.
- Exposure to AI-enabled phishing attacks against employeesWhy not: A cyber risk that does not affect the lender's ability to validate or explain the model.
- Weak data lineage, explainability and independent validation - correct
The scenario describes missing explainability, data traceability and meaningful validation. Without them, errors and bias go undetected. Concentration, correlation and phishing are other channels.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →