Whose AI Is Inside the Software You Buy?

Here is a question most business owners have never asked about software they use every day: when you click the AI button, whose AI is actually answering? Very few vendors build their own models. They wrap someone else's. A data-protection company just launched an AI product built around Anthropic's tools, and the same pattern runs quietly through countless business applications. Which means buying software with AI features usually means entering a relationship with at least two companies: the one that invoices you, and the one whose model is doing the thinking.

The chain you did not know you joined

This arrangement makes complete sense from every direction. A company that specializes in accounting software or backup and recovery should not be trying to build frontier AI models, and you are better off with them using a strong external model than a weak homemade one. Nobody is doing anything shady. But the effect is that a dependency exists which you never evaluated and probably cannot name. If someone asked you today which AI provider powers the assistant inside your CRM, could you answer? Most owners cannot, and that gap is the whole issue.

Three reasons it actually matters

This is not an abstract governance concern. Each link in the chain creates a practical question you may need to answer.

That middle row catches people off guard. The AI feature you built a process around can behave differently next quarter because your vendor changed what is underneath it, and nobody sent an announcement.

One question does most of the work

You do not need a vendor-risk programme. Ask this: which AI providers do you use for these features, and does our data go to them? That surfaces nearly everything that matters. Good vendors answer immediately, often by pointing you at a published list, because larger customers have been asking for years. A vague or reluctant answer tells you something useful too. If you want one follow-up, ask whether they will notify you when they change providers, since that is the change most likely to affect you quietly. Both questions fit in a single short email.

Where this leaves you

Make this a standard question at purchase and renewal rather than a special project. For the handful of AI-enabled tools that touch customer or confidential information, find out which providers sit behind them and whether your data reaches those providers, then write the answers down beside your other AI notes. It is precisely the detail a larger client, or eventually a privacy question, will ask you for, and it pairs naturally with being able to prove you govern AI well. One email per vendor turns an invisible dependency into something you can explain in a sentence.

Frequently Asked Questions