Written by: Michał Sobieraj, Operations Manager, Digital Colliers

You can export your training data. You can move your embeddings. But you can't export the fact that your support team now routes every edge case to the vendor's AI instead of documenting a decision tree. That's the new lock-in.

When your process wraps around their feature

The pattern shows up quietly. Your team starts using a vendor's AI search to triage customer complaints. Three months later, nobody remembers how the old severity matrix worked. The vendor's confidence scores are now the decision boundary. You've outsourced the judgment layer.

Or your product team uses a vendor's embedding similarity to recommend content. The algorithm becomes part of how you think about what belongs together. When you need to change the logic, you realize you don't own the similarity function. You own a config file.

The workflow has rewired around the vendor's abstraction. That's harder to reverse than a data migration.

Why this sticks harder than data portability

Data moves. People don't retrain as easily. When your operations team has spent six months learning to trust a vendor's anomaly detection, switching means relearning what normal looks like. That's not a technical cost. That's an organizational one.

The numbers make the pattern visible. More than 80% of AI projects fail, roughly twice the failure rate of conventional IT projects. 88% of AI proof-of-concepts never reach widescale deployment. For every 33 AI POCs a company launches, only four graduate to production.

42% of companies abandoned most of their AI initiatives in 2025, up from 17% in 2024. Most of those failures weren't technical. They were operational mismatches. The vendor's feature set becomes your team's mental model. You stop asking whether the feature solves the problem correctly. You start asking how to shape the problem to fit the feature.

The test for when to own it outright

Three signals tell you a workflow is too load-bearing to wrap around vendor primitives.

First, if the workflow differentiates how you compete. Your underwriting logic, your fraud model, your content moderation rules. If customers choose you because of how this works, you need to own how it works.

Second, if the vendor's roadmap doesn't serve your use case. Enterprise AI vendors optimize for the median customer. If your requirements are two standard deviations out, their feature updates will drift away from you. You'll end up fighting their defaults.

Third, if the feature becomes load-bearing for compliance or audit. 95% of enterprise GenAI pilots deliver zero measurable P&L impact. The ones that do matter are usually in regulated domains where you need to explain every decision. You can't explain a vendor's black box in a regulatory filing.

What the survivors build instead

The operators who ship AI that survives build on primitives, not features. They use vendor APIs for inference, fine-tuning, embeddings. They don't use vendor workflows for decision-making.

They keep the control plane. The vendor's model scores a transaction as risky. Their code decides what happens next. The vendor's embeddings cluster documents. Their logic decides which clusters matter.

They write the connective tissue themselves. It's more code to maintain, but it's code they can reason about. When the vendor deprecates a feature or changes how scores are calculated, the impact is contained. The core workflow still belongs to them.

This doesn't mean building everything from scratch. It means knowing where the boundary is. Use managed services for undifferentiated heavy lifting. Own the parts that encode how your business works.

The lock-in that matters isn't technical. It's the moment your team forgets how to solve the problem without the vendor's help. Spot that dependency early, and you can choose whether to accept it or route around it.

When your process wraps around their feature

Why this sticks harder than data portability

The test for when to own it outright

What the survivors build instead

Sources

AI moved the work, it didn't remove it

Count connections, not licences

Key-person risk is an AI use case