One methodological choice structures the entire index: we don't classify vendor relationships by commercial name, but by underlying foundation model family.
The problem this solves
Microsoft very often resells and hosts OpenAI models via Azure OpenAI Service. An institution that "uses Microsoft" may therefore, in reality, depend on the same GPT model as an institution that "uses OpenAI" directly. If we counted these two relationships as distinct vendors, we would understate the true concentration of the market — precisely the phenomenon this index is meant to measure.
A concrete example in our data
Danske Bank illustrates the nuance well. Its internal assistant, DanskeGPT, gives employees access to a version of OpenAI's GPT-4 — but delivered through a private, Azure-hosted deployment built to the bank's own security requirements. Read the vendor's name on the product and you'd call it an OpenAI relationship. We classify it under Microsoft (Azure OpenAI) instead, because it's Microsoft's infrastructure — not a direct OpenAI account — sitting behind the model a Danske employee actually talks to.
That's the kind of nuance that disappears if you stop at the name on the invoice, and reappears the moment you ask: which model, from which family, actually runs behind the API?
What this changes about how to read the numbers
An institution citing several vendors isn't necessarily protected against correlation risk — the index measures concentration at the sector level, not just the individual institution. The number that matters isn't "how many vendors does a bank use", but "how many distinct model families exist across the sample".
See the methodology for the full detail on the dependency-mapping mechanism.