Foresight · Hidden AI Infrastructure Risk

Executive summary

• Regulators are moving beyond AI models and ethics to treat cloud, SaaS and digital infrastructure as regulated strategic infrastructure, with the AI Act, DORA and an emerging cloud‑and‑AI framework converging around the vendor stack.
  

• Since early 2025, DORA has pushed supervisors toward direct oversight of critical ICT and cloud providers, increasing pressure on firms to understand concentration risk, embedded dependencies and exit options across their digital estate.
  

• From August 2026, the AI Act will apply more fully to AI embedded in third‑party platforms and services, shifting responsibility from internal AI governance alone to shared compliance across suppliers, contracts and operating models.
  

Considered board‑level actions

• Reframe cloud, SaaS and AI‑enabled platforms as regulated infrastructure dependencies, not simply IT procurement or outsourcing decisions.
  

• Map critical business processes to key cloud, ICT and embedded‑AI providers, with particular focus on concentration risk, fourth‑party exposure and exit feasibility.

1. From climate targets to material dependencies

Most boards now recognise that AI systems will be regulated and many have workstreams to classify use cases and update policies, but regulatory pressure is no longer limited to algorithms and data; it is expanding to the digital plumbing that supports them.

Recent developments around DORA and AI‑governance regimes signal a shift from seeing cloud purely as an outsourcing choice to treating major ICT and cloud providers as systemic infrastructure nodes subject to direct supervisory attention and resilience expectations.

Confidence assessment: High confidence that supervisors now treat major cloud and ICT providers as systemic nodes within digital infrastructure, and medium confidence on how quickly this will translate into concrete changes to services, contracts or pricing for mid‑market customers.

Board implications this quarter

Reframe cloud and SaaS not only as IT procurement decisions but as regulated infrastructure, especially where EU‑exposed financial lines of business or critical functions rely on a small number of providers, and ask which crown‑jewel processes depend on providers likely to be captured by infrastructure‑focused regimes and how concentration risk is monitored today.

2. Where the risk is moving: three shifts since early 2025

2.1 Critical minerals as foundational in UK security thinking

The AI Act’s obligations extend materially into the vendor stack, applying not only to in‑house AI systems but also to AI functions embedded in purchased software, cloud services and third‑party platforms.

Recent guidance emphasises that companies must systematically identify their AI applications, including those delivered via SaaS and platforms, classify them under the Act and ensure that embedded AI meets regulatory requirements, creating shared accountability between internal risk teams and external providers and incentivising vendors to standardise, restrict or withdraw higher‑risk features.

Confidence assessment: High confidence that AI Act obligations now reach AI embedded in third‑party and cloud services, and medium confidence that this exposure is consistently mapped in vendor‑risk and procurement processes outside the largest firms.

Board implications this quarter

Treat AI compliance as a shared responsibility with vendors rather than a purely internal issue, ask for an inventory of AI functionality delivered via cloud, SaaS and key platforms and how obligations will be met in those relationships, and expect that some providers may change features, terms or data‑handling practices at pace as they respond to the Act.

2.2 Mapping and stress‑testing global supply chains

DORA moves EU financial supervision from generic outsourcing guidance to an explicit regime for ICT risk, including formal oversight of critical third‑party providers and expectations for granular mapping of digital dependencies, concentration and exit strategies.

Supervisory commentary highlights growing focus on third‑, fourth‑ and fifth‑party dependencies and cloud concentration risk, with financial entities expected to maintain registers of ICT providers, identify contracts supporting critical functions and design exit strategies and contractual controls that assume providers may be disrupted or constrained under supervisory pressure.

Confidence assessment: High confidence that DORA will drive more detailed mapping of cloud and ICT dependencies in financial services, and medium confidence that similar expectations will be extended, formally or informally, to non‑financial sectors via counterparties and market practices over time.

Board implications this quarter

For EU‑exposed financial entities, treat DORA as a board‑level change in how ICT and cloud risk are supervised rather than a checklist exercise; for corporates, anticipate that banks, insurers and critical partners subject to DORA will push DORA‑style third‑party risk expectations down supply chains and ask whether current frameworks can satisfy expectations around concentration and exit strategies even if the firm is not directly regulated.

2.3 International coordination and emerging standards

An emerging cloud‑and‑AI framework indicates that regulators now see digital infrastructure as a strategic lever in AI governance and economic resilience, with future measures likely to touch data location, interoperability, performance capacity and access terms for large providers.

Even while details and timelines remain fluid, the direction of travel is towards more structured oversight of high‑performance computing and cloud infrastructure, reducing the likelihood that today’s highly concentrated infrastructure landscape will remain lightly regulated and implying new constraints or obligations for firms that rely heavily on a small number of global providers and regions.

Confidence assessment: Medium‑to‑high confidence that regulatory direction points towards more structured oversight of cloud and AI infrastructure, medium confidence on specific mechanisms and timelines, and low confidence in business‑as‑usual assumptions for highly concentrated digital‑infrastructure dependencies.

Board implications this quarter

Recognise that large‑scale AI and cloud infrastructure is moving into the same conceptual category as critical market infrastructure in regulators’ thinking, ask whether strategic plans assume frictionless access to specific global providers or regions and what happens if that assumption fails, and monitor cloud‑and‑AI policy roadmaps as early warning of future structural constraints or obligations.

3. The cascade across your risk landscape

Most internal teams file AI governance under Regulatory & Policy or Technology Risk and treat cloud and SaaS under IT or procurement, but the convergence of AI Act, DORA and cloud‑specific frameworks creates a multi‑domain cascade.

The risk originates in Regulatory & Policy through AI governance, digital‑markets and new‑legislation change, moves into Operational Resilience & Supply Chain via third‑party outsourcing, cloud concentration and infrastructure dependencies, then spills into Economic & Financial through higher compliance costs, vendor repricing and transition spend, and finally into Physical & Cyber Disruption as regulatory‑driven migrations, control changes or provider restructuring create outages, degraded performance or new cyber‑operational vulnerabilities.

4. Why the next 6–18 months are the critical window

Two developments make the coming 6–18 months especially important: DORA is now in force with regulators moving from framework set‑up to active oversight, and the AI Act’s main obligations become fully applicable by August 2026, while cloud‑and‑AI policy work signals that the structure of the infrastructure market itself is now a live issue.

Together, these trends create a plausible 12–18 month scenario in which a combination of AI Act enforcement, DORA‑driven scrutiny of a critical provider or early moves under a cloud‑and‑AI framework force rapid changes in how firms consume and govern cloud and AI services, with limited time to adapt if dependencies are poorly understood.

5. Why this matters for business

Two practical points stand out.

The active risk phase begins before visible enforcement or outages: once providers and regulators act on these frameworks, contractual, architectural and localisation changes can arrive quickly, leaving little room to manoeuvre if concentration and exit options have not been analysed. The supply chain is the hidden exposure: many organisations lack a full view of third‑, fourth‑ and fifth‑party ICT and AI providers supporting critical functions, and expectations under regimes like DORA are likely to shape what financial partners, investors and key customers require of corporates around concentration, resilience and exit planning.

6. Where the HORIZON Futures Engine adds value

Most organisations already have teams monitoring AI regulation, cyber risk and supplier contracts, but often in separate silos; the gap is understanding how converging AI, cloud and operational‑resilience regimes interact across domains and what that means for specific businesses over a 2–18 month horizon.

Cross‑domain cascade mapping Linking AI Act, DORA and cloud‑policy developments to Regulatory & Policy, Economic & Financial, Climate & Environmental, and Operational Resilience & Supply Chain domains, so boards see how infrastructure‑centric shocks connect and compound rather than treating them as isolated compliance or IT topics.

Emerging‑issue clustering and early warning Clustering weak signals from supervisors, policy roadmaps and vendor communications into defined emerging issues, and tagging them to Watchlist and Early Warning Indicators with clear 2–6, 6–12 and 12–18 month horizons aligned to board planning and review cycles.

Alternative futures analysis Building structured scenarios around regulatory pace, infrastructure concentration and vendor behaviour, and stress‑testing current strategies and architectures against faster‑ or slower‑moving futures to inform sequencing of major decisions and the design of real options in cloud, AI and vendor‑governance roadmaps.

7. One signal to watch over the next 6 months

Supervisory communications, inspection findings or enforcement actions that explicitly address AI embedded in cloud or SaaS platforms, or designate particular ICT providers as critical under resilience regimes, especially where they trigger changes to service scope, regions, data‑location options or exit terms.