9
There is a pattern worth watching closely. The companies building the AI stack are getting dramatically larger and fewer — through runaway rounds and multi-billion-dollar mergers that leave a shrinking number of giants owning the chips, the compute, and the platforms everything else runs on.
For most consumers this is background noise. For a professional firm handling confidential data, it is a quiet red flag.
Consolidation changes the risk arithmetic
Concentration does not change whether AI works. It changes who is holding your data when it runs. When the entire stack aboard a handful of enormous vendors, your organization’s most sensitive material — client records, returns, contracts, protected health information — rides on systems you neither operate nor control.
That is not inherently disqualifying. It is, however, a decision you should make with open eyes rather than inherit by default. The fewer and bigger the providers grow, the less room there is to shop for a perimeter that suits your obligations.
Your data, their terms
Every time staff run confidential material through a public or hosted AI tool, the firm hands two things to a third party: the data itself, and the ability to define what happens to it. Audit trails, retention, who inside that giant provider can access what — these become matters you must trust rather than inspect.
For a firm under privilege, statutory, or regulatory duties, that is a disproportionate risk to carry. It does not fail because providers are malicious. It fails because the margin for error on confidential data is zero, and a system you cannot audit leaves you accepting exactly that risk.
Control moves back inside the walls
The counterweight to consolidation is sovereignty. A private deployment — your own hardware, your own corpus, your own access logs — inverts the relationship. Instead of your data living inside someone else’s growing system, the AI comes to where your files already live, and stays there.
That is not Luddism. It is alignment with the same logic driving the giants: whoever controls the physical layer controls the outcome. For a firm, the physical layer that matters is the one already holding the confidential material. Run AI there, and the infrastructure billionaires are betting on is the infrastructure you already own.
The buying decision inverts
When providers consolidate, the smart purchasing question stops being “who has the best model?” and becomes “whose system do I trust with my records?” For regulated professionals, that pushes steadily toward systems that can operate inside their own boundary.
It is not about rejecting the giants. It is about not letting your most sensitive data become a passive tenant in someone else’s consolidated empire.
Know your exposure before the stack decides for you
The window to shape how your firm uses AI is wider than you think — but only if you map the risk now, while you still control the decision. A few minutes with a structured checklist will surface where data already leaves your walls and what you cannot currently prove.
Start with the Confidential AI Exposure Checklist at 9tailsadvisory.com/checklist/. Nine lives. Zero leaks.