What being locked in to an AI supplier looks like

The four kinds #

• Account

  The subscriptions and logins are in the supplier’s name, not yours. The early warning is that you were never asked for a company card, and nobody discussed who owns the account.

• Ownership

  What was built for you is not yours, or exists only where you cannot reach it. The early warning is that nothing in the proposal says who owns the work at the end.

• Data

  Your records are inside something you cannot export in a usable form. The early warning is that nobody can tell you what an export looks like, because nobody has done one.

• Knowledge

  Only the supplier knows how the work happens now. The early warning is that there is no written description of the process, and the old one was deleted.

Account lock in, the one that costs nothing to prevent #

This is the most common and the most easily avoided. During a project somebody has to sign up for things, and it is quicker if the supplier does it. A year later, every service the business depends on is in someone else's name, billed to someone else's card, recoverable only with their cooperation.

The prevention is one sentence at the start: accounts in the business name, business card, business email, supplier invited in as a user who can be removed. It is an afternoon of administration at the beginning and close to impossible to reverse cleanly once the accounts have history attached to them.

Ownership lock in #

Under UK law the default position for commissioned work is not what most businesses assume, and the assumption is the whole problem. This has its own page, because it deserves the detail: who owns what gets built.

The practical face of it is narrower than the legal one. Even where ownership is agreed in writing, owning something you have never been given a copy of is not much use. Ask where the work lives, and ask to be sent it, once, early, while everybody is still friendly.

Data lock in, and why the law will not save you #

Businesses reach for data protection law here and find it does not do what they hoped. The right to data portability belongs to individuals, not to organisations.

So a business trying to get its own operational records out of a supplier is not exercising a right. It is relying on whatever the contract says, and on whether an export function exists.

There is one place the law does bite in your favour. Where a supplier is processing personal data on your behalf, the ICO lists deletion or return of that data at the end of the contract among the minimum terms the contract has to contain.

That is worth knowing and it is narrower than it sounds: it covers the personal data, not the working of the thing that was built, and not the accumulated outputs. The detail is in what a data processing agreement is for.

The question that settles it is practical rather than legal: ask for an export now. Not a description of one, an actual file. A supplier who produces it in a day has answered the question permanently. One who explains why it is complicated has also answered it.

Knowledge lock in, the quiet one #

This is the kind nobody puts in a contract and the kind that most often traps a business. Eighteen months after a project, nobody inside the company can explain how the work now happens. The person who used to do it by hand has left or has forgotten. There is no written process, because the process is the automation.

At that point the supplier does not need to hold your accounts or your data to be difficult to replace. They hold the understanding.

Two habits prevent it.

• Keep a plain English description of what the automation does

  In terms a new member of staff could follow, and update it when the work changes.

• Do not delete the manual process the week it stops being used

  Knowing how the job was done by hand is what lets you carry on when something underneath changes, which it will, for the reasons in when the tools change underneath you.

The commercial version of all four #

Worth naming, because it is where lock in usually gets noticed. Prices change, and a supplier who knows you cannot realistically leave is in a different negotiation from one who knows you can. Nothing improper has to happen for this to bite; it is simply what dependence does to a conversation.

Which is why the right time to sort all of this out is while the supplier is still selling to you. Every one of these is a cheap conversation before a contract and an expensive one afterwards.

The five minute version #

Take those five into any supplier conversation, including ours. The wider list is in questions to ask an AI supplier, and how they fit into judging a whole proposal is in how much AI automation costs.