OpenAI Sits in 90% of Carrier AI Stacks: The Vendor Concentration Risk Nobody Is Pricing

From tracking carrier AI vendor disclosures across earnings calls, NAIC filings, and technology conference presentations for the past 18 months, the pattern of single-vendor dependence has been building quarter by quarter. It was often buried in supplemental risk-factor language rather than headline announcements. An IA Capital Group survey published May 6, 2026, strips away that ambiguity: OpenAI appears in nine of every ten carrier AI technology stacks, while Google Gemini has zero presence in production deployments. For an industry that builds its entire business model around diversification, pricing tail risk, and hedging concentration exposure, the irony is sharp and the operational implications are real.

The survey, drawn from responses by 36 senior carrier technology leaders at national and regional insurers, arrives at a moment when carrier AI adoption has crossed the production threshold. AI in production grew from 37% to 61% of carriers in a single year, according to the same dataset. The pilot phase is largely over. Yet the infrastructure supporting that production shift rests on a remarkably narrow vendor base, creating a set of risks that actuaries, enterprise risk managers, and regulators are only beginning to quantify.

This article examines the survey findings in detail, quantifies the switching costs and model drift exposure that vendor lock-in creates, maps the regulatory implications under the NAIC's 12-state AI Evaluation Tool pilot, and outlines the actuarial case for multi-model architectures.

The IA Capital Group Survey: What the Numbers Actually Show

IA Capital Group's 2026 carrier AI survey, reported by The Insurer on May 6, surveyed 36 senior technology leaders at national and regional carriers. While 36 respondents is not a census, the seniority of the participants and the consistency of the findings with what we observe in carrier technology presentations give the results substantial weight.

The headline finding is straightforward: approximately 90% of carrier technology stacks include OpenAI. That means OpenAI models, whether accessed directly through the API or embedded in vendor tools built on top of GPT-series models, are present in nearly every carrier's AI operations. Google Gemini, by contrast, appears in zero production deployments across the surveyed carriers.

This concentration did not emerge overnight. OpenAI's first-mover advantage with GPT-3.5 and GPT-4 in 2023 and 2024, combined with aggressive enterprise sales into insurance and financial services, created early adoption momentum that proved self-reinforcing. Carriers that built their initial AI proofs of concept on OpenAI models had little incentive to switch once those POCs moved toward production. The API interfaces, prompt engineering investments, output calibration, and integration middleware all created friction that favored staying with the incumbent vendor.

Several other findings from the survey illuminate the broader context:

70% of carriers spent under $500,000 on AI in the past year. This spending level suggests most carriers are still deploying point solutions rather than enterprise-scale AI platforms. At sub-$500K budgets, carriers typically cannot afford to run parallel vendor evaluations, reinforcing single-vendor path dependence.
Only 8% of carriers believe they are currently ahead of peers in AI. This self-assessment gap, where nearly everyone plans to use AI aggressively but almost nobody believes they are leading, creates conditions for vendor-driven decision-making. When carriers lack internal confidence, they defer to the vendor with the most recognizable brand and the widest adoption base.
70% expect at least moderate competitive advantage from AI within three years. The aspiration-execution gap between 8% current leadership confidence and 70% competitive advantage expectation means carriers are betting on AI outcomes without investing at the scale needed to build vendor-independent capabilities.
Four of the top five production use cases involve document processing. Reading, extracting, summarizing, and classifying documents represent the dominant production workload. These tasks have become commoditized across AI providers, which means the lock-in is not about capability differentiation but about integration inertia.

Why Document Processing Creates Stickier Lock-In Than It Should

The concentration of carrier AI use cases in document processing deserves closer examination because it runs counter to the assumption that commodity tasks should be easy to switch between vendors.

Document processing in insurance is not generic document processing. Carrier AI systems ingest ACORD forms, loss runs, policy endorsements, claims files, medical records, and regulatory filings, each with domain-specific formatting, terminology, and extraction requirements. The prompt engineering, fine-tuning, and output validation built around these document types constitutes a significant body of carrier-specific intellectual property, even when the underlying model is a general-purpose LLM.

When a carrier builds a document extraction pipeline on OpenAI's API, the investment includes not just the API calls but the prompt templates calibrated for specific document types, the output parsing logic tuned to OpenAI's response formatting, the error handling built around OpenAI-specific failure modes, and the quality assurance workflows validated against OpenAI output distributions. Switching to a different model requires rebuilding and revalidating all of these layers.

Deployment in underwriting (56% of surveyed carriers) and claims (50%) was reported as more limited in scope and scale, but these are precisely the functions where model risk matters most. When AI outputs feed into pricing decisions, reserve estimates, or claims adjudication, the model's behavior under edge cases, its calibration on tail-risk scenarios, and its consistency over time become actuarially significant. Changing the underlying model in these contexts is not a deployment task; it is a model validation exercise that triggers ASOP No. 56 obligations and, increasingly, regulatory scrutiny.

Quantifying the Switching Cost Problem

The insurance industry's vendor concentration problem is compounded by a systematic underestimation of switching costs. A Zapier survey of 542 U.S. executives found that nearly 90% believed they could transition AI vendors within four weeks, with 41% claiming they could complete a switch in under one week. In practice, realistic migration costs tell a different story.

For a single AI workload, switching costs break down into several categories that are often invisible until migration begins:

Cost Category	Estimated Range	Driver
Engineering rewrite	$216,000	~1,200 hours at $180/hr for API integration, prompt re-engineering, output parsing
Dual-run infrastructure	$60,000	Running old and new models in parallel during validation period
Data movement and transformation	$25,000	Reformatting training data, evaluation datasets, and test suites
Revalidation and testing	$40,000	Model performance benchmarking, edge case testing, regression suites
Risk buffer (20%)	$68,200	Unforeseen integration issues, extended timeline overruns
Total per workload	~$409,200

At approximately $409,000 per workload, vendor switching becomes a six-figure cost event even for a single use case. For carriers with multiple AI workloads across document processing, underwriting support, and claims triage, the aggregate switching cost reaches seven figures. When 70% of carriers are spending less than $500,000 per year on AI in total, a $400,000+ switching cost per workload makes migration economically prohibitive, regardless of whether a better alternative exists.

This cost dynamic creates what industry analysts call "pricing power through switching costs." During vendor renewal negotiations, carriers that lack a credible exit alternative have limited leverage. OpenAI's current pricing may reflect competitive market conditions, but the absence of viable fallback options means carriers are price-takers at renewal rather than price-setters.

Model Drift and the Actuarial Risk of Single-Vendor Dependence

Beyond switching costs, single-vendor concentration creates a category of actuarial risk that most carriers have not yet addressed in their enterprise risk management frameworks: correlated model drift.

When OpenAI updates its models, the updates propagate simultaneously to every carrier that uses the API. If a model update changes the way the system classifies ambiguous claims documents, adjusts the probability calibration on risk scoring, or shifts the extraction accuracy on a particular document type, every carrier using that model experiences the same change at the same time. This is the AI equivalent of correlated catastrophe exposure, except the trigger is a vendor's model update rather than a natural disaster.

Cyberwrite CEO Nir Perry highlighted this dynamic in February 2026, warning that "a failure at any one of the three or four dominant AI vendors could cascade across hundreds of millions of businesses simultaneously, creating an accumulation exposure the insurance market has no historical framework to price or contain." The insurance industry, which exists to price and manage concentrated risk, is building operational dependency on a concentration that it has no mechanism to hedge.

The actuarial implications are concrete. When AI outputs feed into reserving models, a correlated shift in AI behavior creates correlated reserve movements across carriers. If multiple carriers use the same OpenAI model for claims triage and that model's classification behavior shifts after an update, the resulting claims adjudication changes would be directionally correlated across the entire market segment. This type of systematic risk is precisely what actuaries are trained to identify and mitigate in other contexts, yet it remains largely unaddressed in the vendor AI domain.

A related concern is what researchers term "behavioral lock-in" for AI agents. As carriers deploy agentic AI systems that learn organizational workflows, communication patterns, and decision-making processes, those learned behaviors become embedded in the vendor's model context. That organizational knowledge is not portable. Switching vendors means not just switching models but losing the accumulated operational learning that the current system has developed. For carriers deploying AIG-style 30-hour autonomous agent cycles, the behavioral lock-in compounds with each operating period.

The NAIC Disclosure Trigger: 12-State Pilot Creates Vendor Transparency

The regulatory dimension of carrier AI vendor concentration is evolving rapidly. The NAIC's AI Systems Evaluation Tool pilot, launched March 2, 2026, is running through September 2026 across 12 participating states: California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia, and Wisconsin.

The pilot's four-exhibit structure creates specific disclosure obligations that intersect directly with vendor concentration risk:

Exhibit A requires carriers to quantify AI usage across functional areas, including system counts, decision impacts, and, critically, vendor-embedded models. This exhibit creates the first regulatory dataset on AI vendor concentration across the industry. When regulators aggregate Exhibit A responses and see the same vendor appearing in 90% of filings, vendor concentration will become a regulatory agenda item rather than an industry talking point.
Exhibit B assesses governance and risk management frameworks. Carriers that rely on a single AI vendor must demonstrate that their governance structures account for vendor dependency risk, including continuity planning for vendor failure, model update management, and contractual protections around model changes.
Exhibit C focuses on high-risk AI systems in claims, underwriting, pricing, and fraud detection. For these applications, regulators will want to see model validation documentation that addresses vendor-specific risks, including how the carrier monitors for model drift after vendor updates and what fallback procedures exist if the vendor's service is interrupted.
Exhibit D examines data sources, quality controls, and discrimination risks. When multiple carriers use the same underlying model, the potential for correlated bias outcomes increases; a bias embedded in the vendor's training data would propagate across all carriers using that model.

The regulatory principle underlying the pilot is clear: carriers bear full responsibility for third-party AI systems. Vendors cannot shield carriers from regulatory examination. This means that OpenAI's model governance practices, training data provenance, and update procedures are effectively subject to insurance regulatory review through the carriers that use them, even though OpenAI itself is not a regulated insurance entity.

Beyond the NAIC pilot, 24 states plus the District of Columbia have now implemented the NAIC Model Bulletin on AI use, first adopted in December 2023. The Spring 2026 NAIC meeting in San Diego introduced an AI risk taxonomy with four levels (unacceptable, high, medium, low) and advanced a vendor registry proposal from the Third-Party Data and Models Working Group. While the registry is initially scoped to pricing and underwriting functions and the industry is debating whether participation should be voluntary or mandatory, the direction is toward greater vendor transparency.

Colorado's AI Act, taking effect June 30, 2026, adds a state-level mandate that will require carriers to document algorithmic impact assessments for AI systems used in consequential decisions, including the identification of third-party AI vendors and their role in the decision pipeline.

The Aspiration-Execution Gap and Its Vendor Implications

The IA Capital survey's finding that only 8% of carriers believe they lead in AI, while 70% expect competitive advantage within three years, maps directly onto a Capgemini study of 344 senior executives that found only 10% of P&C insurers have successfully scaled AI. The consistent pattern across multiple surveys is clear: the industry is broadly adopted but narrowly mature.

This maturity gap has direct implications for vendor concentration. Carriers at the exploration and proof-of-concept stage (60% of the industry, per Capgemini) typically lack the internal AI engineering talent to evaluate, integrate, and maintain multiple vendor relationships. They default to whichever vendor their initial POC was built on, which in 90% of cases is OpenAI.

The spending data reinforces this dynamic. With 70% of carriers spending under $500,000 annually on AI, most organizations cannot afford dedicated model evaluation teams, multi-vendor integration architectures, or parallel testing environments. Accenture's Pulse of Change Survey found that 90% of insurance executives intend to increase AI spending in 2026, but spending intentions have not yet translated into the infrastructure needed for vendor-independent AI operations.

Grant Thornton's 2026 AI Impact Survey adds another dimension: while 62% of insurance companies rate their AI maturity as "scaling across functions," only 24% are fully confident in their AI controls, and 68% say AI controls exist but are fragmented across teams and tools. Fragmented governance makes vendor diversification harder because there is no centralized function responsible for evaluating vendor alternatives or managing multi-vendor complexity.

Meanwhile, 42% of insurers track no AI metrics at all (Capgemini), and 55% report unclear ROI on AI investments. Without clear performance benchmarking, carriers cannot objectively compare their current vendor's performance against alternatives, further entrenching the incumbency advantage.

The Strategic Case for Multi-Model Architectures

The actuarial argument for multi-model AI architectures mirrors the logic that actuaries apply to every other form of concentrated risk: diversification reduces tail exposure, even when the diversified portfolio has slightly higher expected costs.

A multi-model architecture, where a carrier maintains integration capability with at least two AI providers and routes workloads based on performance, cost, and availability, addresses several of the risks described above:

Availability risk. If OpenAI experiences an outage or service degradation, carriers with fallback routing to a secondary provider can maintain operations. For time-sensitive functions like claims triage and underwriting support, even a few hours of downtime creates measurable operational impact.
Pricing leverage. A credible alternative provider gives carriers negotiating leverage during contract renewals. The switching cost analysis above shows that without an integrated fallback, carriers lack a realistic exit option, which weakens their negotiating position.
Model drift decorrelation. Different providers update their models on different schedules and with different training methodologies. Using multiple providers reduces the correlation of model drift across the carrier's AI operations, limiting the impact of any single vendor's update.
Regulatory compliance positioning. Demonstrating multi-vendor capability in NAIC Exhibit B and Exhibit C filings signals robust AI governance. Regulators reviewing a carrier's AI risk management framework will view single-vendor dependence as a governance gap, particularly for high-risk applications.

The practical challenge is that multi-model architecture requires engineering investment that most carriers have not yet made. It demands an abstraction layer between the carrier's application logic and the AI vendor's API, standardized prompt templates that can be adapted across providers, model-agnostic evaluation frameworks, and routing logic that accounts for performance differences across providers. This infrastructure investment is beyond the current budget envelope for the 70% of carriers spending under $500,000 per year on AI.

Kurt Diederich, CEO of core platform provider Finys, argued in Carrier Management that carriers should "treat AI as a modular capability" within a plug-and-play operating model, drawing parallels to the early 2000s internet boom where "only a small percentage of vendors ultimately proved durable." The modular approach would position carriers to swap providers without rebuilding their entire AI stack, but it requires upfront architectural investment that the current spending trajectory does not support.

What Carriers Should Be Doing Now

For actuaries, enterprise risk managers, and technology leaders evaluating their carrier's AI vendor exposure, several concrete steps can reduce concentration risk without requiring immediate multi-vendor migration:

1. Inventory and classify vendor dependencies. Map every AI workload to its underlying vendor, distinguishing between direct API usage and vendor-embedded models (where a third-party tool uses OpenAI under the hood). Many carriers will discover that their actual OpenAI exposure is broader than their direct procurement suggests, because vendor tools that appear to be independent often share the same underlying model.

2. Establish model update monitoring. Create processes to detect and evaluate the impact of vendor model updates on AI-driven outputs. This includes establishing baseline performance metrics, running regression tests after known updates, and maintaining audit trails that connect output changes to vendor update timelines. This monitoring is already an implicit requirement under ASOP No. 56 for actuaries relying on AI model outputs.

3. Build vendor-agnostic evaluation datasets. Develop internal test suites that can benchmark any provider's model against carrier-specific use cases. These datasets serve dual purposes: they provide objective comparison data for vendor evaluations and they satisfy the model validation documentation requirements emerging from the NAIC pilot.

4. Negotiate contractual protections. Ensure vendor agreements include advance notice of model updates, guaranteed API stability periods, data portability provisions, and service-level agreements that account for the carrier's regulatory obligations. Many current AI vendor contracts were negotiated during the POC phase and lack the protections appropriate for production-critical infrastructure.

5. Prepare for NAIC Exhibit A disclosures. Even carriers outside the 12 pilot states should begin compiling the vendor dependency information that Exhibit A requires. The NAIC expects to adopt the evaluation tool at its Fall 2026 meeting, with nationwide deployment following. Carriers that prepare early will avoid the last-minute scramble that typically accompanies new regulatory requirements.

Why This Matters for Actuaries

The vendor concentration revealed by the IA Capital survey intersects with actuarial practice in several direct ways. Pricing actuaries whose models incorporate AI-derived risk scores need to understand whether those scores are subject to correlated model drift risk. Reserving actuaries whose processes use AI for claims classification need to account for the possibility that a vendor update changes classification distributions mid-evaluation period. Enterprise risk actuaries need to include AI vendor concentration in their own risk management frameworks, treating it with the same rigor applied to reinsurance counterparty concentration or investment portfolio exposure.

The Datos Insights ILTF 2026 forum, held in Boston in late April, identified underwriting as the emerging primary opportunity for AI-driven differentiation, with the forum framing the "Intelligent Insurer Operating Model" as the competitive target. But differentiation built on a shared vendor base is not differentiation at all. When 90% of carriers run on the same underlying models, the competitive advantage comes from proprietary data, domain-specific fine-tuning, and operational execution, not from the choice of AI vendor. Carriers that recognize this distinction will invest in their unique data assets and workflow integration rather than assuming that their AI vendor selection alone constitutes a strategy.

The NAIC's evaluation tool pilot creates a six-month window before nationwide adoption becomes likely. Carriers that use this window to assess their vendor concentration, build multi-model evaluation capability, and document their AI governance frameworks will be better positioned for both regulatory compliance and competitive differentiation. The 90% figure is a snapshot of where the industry stands today. It does not have to be where the industry remains.