Most of the conversation about AI in business has focused on productivity. Companies are looking at how much work can be automated, how quickly employees can complete tasks with AI assistance and whether some activities can be performed with fewer people. Those are reasonable questions because the economics are becoming difficult to ignore. As AI becomes capable of performing more meaningful work, however, the decisions organizations make about efficiency are beginning to change how their businesses actually operate. That introduces a risk that receives considerably less attention than the benefits of automation.

A recent Canadian Underwriter article captured the issue particularly well. Daniel Woods, head of emerging risk at Coalition, raised the question of what happens when a company replaces part of its workforce with AI and the AI provider experiences an outage. Coalition chief underwriting officer Tiago Henriques expanded on the concern, explaining that the company is paying attention to the uptime of major AI providers as businesses become increasingly dependent on them.

I think there is a much larger business issue underneath that question. Once an organization removes human capacity because AI can perform the work, the AI is no longer simply another technology employees use. It has become part of the operating model. The availability of the AI provider can then determine whether the business is capable of performing the work at all.

AI Changes the Business Before It Changes the Risk

There is a meaningful difference between using AI to help an employee perform a job and designing the operation around AI performing the job. An employee who uses AI to summarize documents or help analyze information may become less productive when the service is unavailable, but the employee probably still understands how to perform the work. The consequence changes when the organization automates most of that process and eventually reduces the people who previously performed it.

The business case for making that change can be compelling. Automation reduces labor requirements and allows the organization to handle more work without adding people. Those benefits are visible and relatively easy to measure. The dependency created by the decision is much less visible because it does not become a problem while the technology is available.

The Canadian Underwriter article cites Statistics Canada data showing how quickly AI is becoming part of business operations. In the second quarter of 2026, 19.2% of Canadian businesses reported using AI to produce goods or deliver services during the previous twelve months, approximately three times the level reported two years earlier. Adoption was particularly significant in information industries, financial services and professional services.

AI adoption is moving beyond employees experimenting with new tools. Organizations are beginning to incorporate AI into the processes through which work actually gets done. Once that happens, the availability of the technology becomes connected to the ability of the business to operate.

Recovery Plans May Be Based on a Business That No Longer Exists

Most business continuity and disaster recovery plans contain assumptions about how employees will respond when technology becomes unavailable. People may switch to manual processes or perform work differently until systems are restored. Those assumptions can remain embedded in recovery plans long after the operating environment that originally supported them has changed.

AI can accelerate that problem because the organization may gradually remove the human capacity on which the recovery plan depends. Imagine a company that automates a significant portion of customer support. AI begins handling routine interactions while employees focus on more complicated cases. As the technology proves effective, the company reduces staffing because fewer people are required to support the same volume of customers.

If the AI provider becomes unavailable, the organization cannot necessarily return to the process that existed before automation. Some of the employees who performed the work may no longer be there, while the remaining workforce may not have enough capacity to absorb the volume. Procedures may also have changed around the AI system, leaving the organization without a practical way to return to the previous operating model.

The company may still have a documented business continuity plan and technically remain capable of recovering its systems. What has changed is the amount of work the business can perform while recovery is taking place. The organization has altered its operating model without necessarily reconsidering whether the assumptions in its recovery plan remain valid.

This is where Business Survivability becomes different from traditional technology recovery. An AI provider may restore service after several hours, but work continues accumulating during the outage. Customer requests remain unresolved and automated processes stop moving through the organization. Once service returns, the business still has to work through whatever accumulated while the technology was unavailable. The duration of the technology outage and the duration of the business disruption may therefore be very different.

AI Is Becoming an Operational Dependency

Businesses already depend heavily on outside technology providers. Cloud infrastructure and software platforms support important parts of modern operations, and cyber insurers increasingly evaluate these relationships because a disruption involving a widely used provider can affect many insured organizations simultaneously.

AI introduces a different dimension to that dependency because the provider may increasingly be performing work rather than simply hosting the technology employees use to perform it. That distinction changes the consequence of an outage.

Two companies might use the same AI provider and experience completely different business impacts when the service becomes unavailable. One may lose an employee productivity tool and continue operating at a slower pace. Another may lose the mechanism through which an important business process is performed. Knowing that both companies use the same AI platform tells us very little about the actual risk.

This is why inventories of approved AI tools are not enough to understand AI exposure. Management needs to know where those tools have become part of essential business processes and how much operating capacity remains when the technology is unavailable. The answer will depend on how the organization has changed the process around the technology, which makes this much more than a traditional third-party technology assessment.

Decision Debt Can Accumulate Quietly

AI automation also provides a useful example of decision debt because the dependency can emerge through a series of decisions that each appear reasonable when they are made. A company introduces an AI capability to improve productivity and eventually expands its use because the initial results are good. Staffing requirements change as more work is automated, and the organization captures the financial benefits of those changes.

Nobody necessarily makes a deliberate decision that the company should become incapable of performing an important process without a particular AI provider. That condition develops gradually as the organization takes advantage of the efficiency created by automation while allowing the previous operating capability to disappear.

The decision debt appears later when circumstances force the organization to reconsider assumptions it never explicitly revisited. An outage could create that moment, but there are other possibilities. The provider could change the service or discontinue a capability the company relies upon. A regulatory requirement could restrict how the technology is used, or a security incident could force the organization to disconnect the service temporarily.

The underlying problem is not that the company adopted AI. The problem is that the business changed without management fully reconsidering what those changes meant for its ability to continue operating when a dependency became unavailable.

Cyber Insurance Is Starting to See the Same Problem

Coalition's interest in AI-provider availability is important because cyber insurers already deal with technology dependencies through business interruption coverage. Coalition's explanation of Direct and Contingent Business Interruption coverage describes circumstances where coverage may respond when a policyholder's systems or those of certain technology providers experience covered failures. The actual response depends on the terms and conditions of the individual policy.

Coalition has also been expanding how it approaches the financial consequences of interruption. Its Enhanced Business Recovery endorsements are designed to address some of the practical problems organizations experience while recovering from cyber incidents, including the need for access to cash and protection around important revenue dependencies.

AI makes the dependency question more complicated because the unavailable provider may be responsible for work the company no longer has sufficient people to perform. A covered business interruption loss may provide financial resources that help the organization get through the disruption, but those resources do not recreate the operational capacity that was removed when the process was automated.

This is why organizations adopting AI should be discussing these dependencies with their insurance brokers before they become critical. Management needs to understand how the policy treats an outage involving an AI provider and whether the coverage reflects the way the company now operates. That conversation becomes more important as automation changes the potential financial consequences of losing access to a particular provider.

Integrated Assurance Needs to Follow the Business

Most AI governance programs understandably begin with the technology. Organizations establish acceptable-use policies and determine which AI platforms employees can access. They evaluate data handling and security concerns because those risks are immediate and relatively familiar.

That approach becomes incomplete when AI moves deeper into the operating model. Management needs evidence that it understands which business capabilities depend on AI and what happens when those capabilities become unavailable. This is where Integrated Assurance becomes particularly relevant because the objective is not simply to determine whether a technology has been approved. The organization needs to understand whether the operating assumptions surrounding that technology remain reliable.

That requires examining whether practical alternatives exist if the AI provider becomes unavailable and how quickly the organization could use them. It also means understanding whether employees can still perform the work and whether enough capacity remains for that alternative to be meaningful. The answers may change as automation becomes more extensive, which means the assessment cannot be something the organization performs once when the technology is initially approved.

The objective is not to eliminate AI dependency. Modern businesses depend on technology and outside providers every day. The important issue is whether management understands the dependency well enough to make an informed decision about the exposure being accepted in exchange for the efficiency being gained.

Being Insured Does Not Recreate Operating Capacity

Cyber insurance can play an important role when an interruption involving a technology provider produces a covered loss. The financial protection can help an organization absorb expenses and lost income while normal operations are being restored. That protection becomes increasingly important as businesses become more dependent on technology providers.

Insurance does not recreate the operating capability the organization removed. A policy cannot restore employees who no longer work for the company or rebuild institutional knowledge that disappeared when a process became automated. It also cannot create a manual alternative that management never maintained because the AI system was expected to remain available.

This is why being insured and being able to recover remain different questions. Insurance can help determine how much of the financial consequence the organization is able to transfer. Business Survivability requires management to understand whether the company can continue delivering the capabilities its customers depend upon while the disruption is occurring.

AI makes that more important because organizations are increasingly making operating decisions based on the assumption that these services will remain available. As those decisions accumulate, an outage can expose dependencies that were difficult to see while everything was working normally.

The Question Should Come Before the Workforce Changes

The business case for AI will continue improving, and organizations will continue finding work that can be automated. There is nothing inherently wrong with making those changes when they improve the business. The risk appears when the operating model changes without management reconsidering the assumptions that support continuity and recovery.

Before removing significant human capacity from a process, management should understand what happens if the technology replacing that capacity becomes unavailable. That assessment needs to reflect the actual workload and the remaining people who would be expected to absorb it. Management also needs to understand how long the organization can tolerate the disruption before customers, revenue or other important business obligations are affected.

The Canadian Underwriter article raises the issue through the example of a company eliminating 10% of its workforce because AI can perform the work and then losing access to the AI provider. It is a useful scenario because it forces the conversation beyond whether the AI itself is secure.

The more important decision happens before the outage. When management decides that AI allows the company to remove people from an operating process, it is also deciding how much future operating capacity will depend on that technology remaining available. That dependency should be understood with the same discipline applied to the financial benefit used to justify the automation.

If we are going to calculate how many people AI allows us to remove from a business, we should also calculate how much of that business remains capable of operating when the AI is no longer available. That is ultimately a Business Survivability decision, and it needs to be made before the efficiency gains make the underlying dependency difficult to reverse.