How we measure concentration

For each tracked institution, we document its public relationships with foundation model vendors (OpenAI, Anthropic, Google, Microsoft, others), then group these relationships by model family rather than by the vendor's commercial name.

The reason: Microsoft very often resells and hosts OpenAI models via Azure OpenAI Service. Counting "Microsoft" as a vendor distinct from "OpenAI" would understate the true concentration. Each row of the data explorer therefore notes whether the cited vendor is simply hosting a model from another family.

We submit the same financial risk-decision scenarios (credit, trading, underwriting, fraud, counterparty), multiple times each, to several foundation models via their official APIs. We then compare the observed unanimous agreement rate between models to the rate expected under the hypothesis of statistical independence.

The logic mirrors the one used by the Stanford study on systemic rejection in algorithmic hiring (Bommasani et al., ACM FAccT '26): a gap between observed agreement and agreement expected by chance is the quantitative signal of cognitive monoculture. Per-scenario detail is on the Correlation Test page.

Each documented vendor relationship is classified by the quality of its source:

• ConfirmedPrimary source — official vendor or institution announcement, published case study, public statement from an executive, or regulatory filing.
• ProbableReliable secondary source — specialized press citing internal sources, a job posting explicitly naming the tool.
• UnverifiedMention found but not corroborated by a second source — excluded from aggregate statistics until confirmed.

Before any finding earns a tier, it has to clear a lower bar: is this a vendor relationship at all? Three patterns get excluded outright, regardless of how good the source is: an institution merely investing in a model lab (capital exposure, not usage); an official case study about cloud infrastructure that never names a specific AI product; and language that's exploratory or non-committal ("exploring," "considering") rather than a deployed product, a signed partnership, or an executive on record about something already running.

An institution citing several vendors (Raymond James Financial, for instance, confirmed on three distinct families) isn't necessarily protected: the index measures concentration at the sector level, not just the individual institution. The number that matters isn't "how many vendors does a bank use", but "how many distinct model families exist across the whole sample, and what share of institutions depends on at least one of the top two or three".

The index also does not measure a model's quality, security, or performance — only the concentration of dependency.

Public, lawful sources only: press releases, vendor "customer" pages (OpenAI, Anthropic, Google Cloud, Microsoft, Mistral AI), specialized press (American Banker, Fortune, Bank Info Security, CB Insights…), regulatory filings (10-K, 10-Q on SEC EDGAR), public job postings, public statements from executives. No internal data, no scraping of private systems, no information obtained through an unauthorized third party. See the full bibliography on Sources.

Pilot sample. This pilot keeps growing with each research pass — see the current institution count on the data page — but it remains a sourced sample assembled through targeted searches, not an exhaustive census of every institution's AI vendor relationships worldwide. The empirical correlation test, separately, currently runs across ten decision scenarios: a methodological pilot, not definitive statistical proof. It will take several dozen scenarios per domain for a rigorously publishable result.

Raw models, not real systems. The correlation test queries foundation models via public API, not banks' real production systems — which often add fine-tuning, RAG on their own data, and additional guardrails. The result is a lower-bound estimate of the true correlation: production systems could converge even more, or somewhat less depending on the guardrails added.

Models change. Every result documents the date and exact name of the model tested — a 2026 result will be worthless to compare as-is once models are updated.

As the sample grows: weight by institution size (total assets) so the index reflects the share of the real economy exposed, not just the number of logos; consider a sub-score per line of business (payments, credit, trading, compliance) rather than a single score per institution, since some dependencies are more critical than others.