Written by: Karol Sobieraj, Founder & CEO, Digital Colliers
Anthropic published a report Thursday alleging that three China-based AI companies have been systematically copying Claude. The technique is called distillation. An attacker queries your model millions of times, logs the outputs, then trains a cheaper replica on that data. Your £2M model becomes their £200K model. Your vendor loses its moat. Your contract position weakens.
This is not a hypothetical. The report names Alibaba, Moonshot, and DeepSeek. If you are running Claude in production for credit decisioning, AML screening, or customer service workflows, you need an audit trail that shows how Anthropic defends its IP and what happens to your service agreement if the moat collapses.
Why distillation is a vendor-risk problem for banks
Most teams think about AI vendor risk through the lens of uptime and data sovereignty. Those matter. But distillation introduces a different failure mode. If your vendor's model gets copied, the vendor's competitive position deteriorates. Pricing power shrinks. Support budgets shrink. Contract renewals get harder. You end up renegotiating from a weaker position or migrating mid-year to a replacement vendor.
The regulatory exposure is worse. DORA has been in force since 17 January 2025. Your AI vendor is a critical third-party ICT service provider. You owe your regulator evidence that the vendor has resilience controls in place. If the vendor's model gets cloned and the vendor's business model wobbles, your operational resilience case falls apart. Automated credit scoring already carries GDPR exposure under the SCHUFA ECJ ruling from December 2023. If you cannot show that your vendor protected its training data and query infrastructure, you own the compliance gap.
The vendor audit questions you need answers to
Your procurement and risk teams need three categories of evidence from any AI vendor running inference at scale.
First, distillation defenses. Does the vendor monitor query patterns for bulk extraction? Do they rate-limit API calls per customer? Do they fingerprint outputs to detect synthetic training sets downstream? If the answer is no or the vendor cannot produce documentation, you have a vendor-risk gap.
Second, IP-protection policies. Does the vendor assert copyright or trade-secret protection over model weights? Do they have a legal response plan if a competitor publishes a clone? What happens to your SLA if the vendor's market position erodes? Most vendor contracts are silent on this. You need an addendum.
Third, incident disclosure. If the vendor detects a distillation attack, do they notify customers within 48 hours? Do they quantify the risk to your production workloads? The pattern I keep seeing is that vendors wait until the attack is public before they brief customers. That leaves you explaining to the board why you learned about a critical vendor incident from the Financial Times.
What the compliance timeline looks like
EU AI Act high-risk obligations apply from 2 December 2027. If you are using AI for credit scoring, fraud detection, or employment decisions, you will owe your regulator a conformity assessment. That assessment includes third-party vendor controls. If your AI vendor cannot document its defenses against IP theft, your conformity case is incomplete.
EU AI Act fines for high-risk violations reach up to €15M or 3% of global turnover. GDPR fines reach up to €20M or 4% of global turnover. The cumulative exposure is material. Most mid-market banks are not staffed to run dual regulatory defenses. You need the vendor to carry part of that burden. If the vendor's model gets cloned and the vendor's compliance posture deteriorates, you own the shortfall.
The operators who are shipping AI in production at banks right now are treating vendor IP-protection as a procurement requirement, not a nice-to-have. They are asking for distillation-defense documentation in RFPs. They are writing contract clauses that give the bank an exit if the vendor's model gets widely replicated. They are running quarterly audits of query logs to verify that rate limits are enforced. That is the shape of the solution. If your team is not doing this, you are carrying left-behind risk.