AI strategy — Vendor selection

Choose an AI provider that uses open source selectively—and proves you can leave

The safest provider is not the one that promises “open source everywhere,” but the one that combines appropriate open technologies with portable data, documented interfaces and enforceable exit rights.

Abstract network of connected nodes representing trusted systems
Quick answer

Ask providers to identify which parts of their solution are open source, proprietary or supplied by third parties. Then test what truly matters: whether you can export your data in usable formats, move models or prompts where practical, integrate through documented interfaces and continue operating if the relationship ends. Favor open standards and replaceable components, but judge the complete architecture and contract—not the open-source label alone.

Key takeaways

  • Open source reduces some dependencies, but data formats, hosting, integrations and contracts can still create lock-in.
  • Require a component-level explanation of what is open, proprietary and controlled by third parties.
  • Test portability before signing by requesting sample exports, interface documentation and a realistic migration plan.
  • Keep control of business data, approved answers, prompts, evaluation materials and other assets that would be expensive to reconstruct.
  • Choose a provider that can explain when open-source technology is appropriate—and when a proprietary component offers a justified advantage.
01

Start with the real risk: losing control of your options

Fear of proprietary AI is usually fear of dependency. A system can become difficult to leave when your data is stored in obscure formats, essential workflows depend on undocumented behavior, integrations are tightly coupled to one platform, or the contract gives you weak export and transition rights. The model’s license is only one part of that problem.

AI vendor lock-in

AI vendor lock-in is a situation in which the financial, technical or operational cost of changing providers becomes unreasonably high because important data, workflows, interfaces, knowledge assets or infrastructure cannot be moved or replaced cleanly.

Open-source software can reduce dependence by making code inspectable and deployable in more than one environment. It can also broaden the pool of developers able to work with the technology. But an open model inside a closed service does not automatically give you portability. The provider might still control deployment, data preparation, monitoring, connectors or the application layer around the model.

That is why your first conversation should focus on architecture and ownership rather than slogans. If your primary concern is whether the system can evolve without tying you permanently to one vendor, use a broader framework for open standards and migration paths. You are looking for evidence that the important parts of your operation remain understandable, accessible and replaceable.

02

Evaluate the system component by component

Do not ask only, “Is your platform open source?” That question invites a yes-or-no answer that reveals very little. Ask the provider to map the solution into components: models, application code, data stores, vector databases, orchestration, hosting, interfaces, integrations, monitoring and security controls. For each component, identify who controls it, what license or commercial terms apply and what would need to change if you moved.

A practical evaluation sequence
  1. List the business capabilities you need before discussing products. Separate essential requirements from conveniences so you know where flexibility matters most.
  2. Ask the provider to classify each major component as open source, proprietary or third-party managed technology.
  3. Identify where your source data, generated material, prompts, approved answers, evaluations and operational records will reside.
  4. Request the available export formats and determine whether another competent team could use those exports without extensive reconstruction.
  5. Review the interfaces between components. Documented, widely used interfaces generally provide more replacement options than hidden or provider-specific connections.
  6. Ask for a migration outline covering data extraction, replacement components, transition support, likely downtime and continuing access after termination.
  7. Verify the claims through a small proof of concept that includes an export or replacement exercise, not just a successful demonstration.

The provider’s willingness to answer these questions matters as much as the specific technology. Clear diagrams, direct answers and usable documentation show that portability has been considered as an engineering requirement. Vague assurances such as “you own your data” are inadequate unless the provider explains how you retrieve it, in what form and on what timeline. A more detailed transparency and data-portability checklist can help turn those assurances into verifiable requirements.

03

Know where open source helps—and where it does not

What different approaches mean
Open-source components
These can improve inspectability, deployment choice and access to a broader technical community, provided the relevant licenses and operational requirements suit your organization.
Open standards and documented interfaces
These make it easier to connect, replace or rebuild components even when some software remains proprietary.
Managed proprietary services
These can reduce operational burden and provide a cohesive service, but you should understand switching costs, export options and critical dependencies before committing.
Hybrid architecture
This combines open and proprietary components according to the job each performs. It is often the most practical approach when boundaries, ownership and replacement paths are explicit.

The right goal is optionality, not ideological purity. Running an open-source model yourself can require infrastructure, security controls, monitoring and specialized staff. A managed service may be the more responsible choice when your team cannot operate those elements reliably. Conversely, keeping a strategic data layer or knowledge repository portable can be worthwhile even when the user-facing application is managed.

A better question

Ask, “Which parts of this solution would be hardest to replace, and what are you doing to reduce that dependency?” A credible provider should be able to discuss trade-offs rather than treating every proprietary component as harmless or every open-source component as automatically superior.

Use the same scrutiny when estimating flexibility across several years. Models, infrastructure and regulations will change. Your architecture should allow important components to be upgraded or replaced without rebuilding the entire business process. The questions in this long-term AI vendor flexibility guide are useful when comparing otherwise similar proposals.

Let’s talk about your business goals.

Privacy
04

Protect the assets that are hardest to recreate

The most valuable assets in an AI system are often not the model weights. They are the business-specific materials accumulated around the system: source documents, information your business has reviewed and approved, structured records, prompts, workflows, evaluation sets, customer inquiry patterns and feedback. Losing practical access to those assets can make migration expensive even when an alternative model is readily available.

Controls to require
Usable exportsData should be available in documented, commonly usable formats rather than screenshots, reports or unreadable database dumps.
Clear ownershipThe agreement should state who owns source data, generated outputs, custom materials and improvements derived from your information.
Separation of dataConfirm how your information is isolated, retained and removed, including copies held in backups or supporting systems.
Interface documentationPreserve the specifications needed to reconnect applications, data sources and downstream workflows elsewhere.
Transition obligationsDefine what assistance is available when the relationship ends, along with access periods, responsibilities and any associated terms.

Put these requirements in the contract and its technical schedules. Sales presentations and email assurances are not substitutes for binding language. Pay particular attention to termination, deletion, export, continued access, subcontractors and transition assistance. For a focused review, use this guide to contract clauses that protect your AI data and involve qualified legal counsel for the agreement itself.

Test before depending on it

An export feature is valuable only if the exported material is complete and usable. Ask for a representative export during evaluation, inspect its structure and confirm that a different technical team could work with it.

05

Demand evidence through a small, reversible engagement

A proof of concept should test reversibility as well as performance. Many evaluations measure whether an AI system can produce an impressive response. Far fewer determine whether the organization can retrieve its information, change a component or understand how the result was produced. That omission allows lock-in to emerge before procurement teams see it.

A practical pilot

Suppose a business wants an AI assistant to answer customer inquiries from information the business has confirmed. A useful pilot would test response quality, but it would also document the source material, show where approved answers are stored, export the relevant records and demonstrate how another interface or model could access that material. The business would finish the pilot with evidence about both usefulness and portability, without assuming that the initial provider must remain permanent.

Keep the first engagement narrow enough to reverse. Define success measures, ownership and exit steps before work begins. Avoid loading every repository, rebuilding every workflow or signing a broad multiyear dependency merely to prove one use case. If your team has already spent months testing tools without reaching production, shift the conversation from technology selection to turning open-source AI experiments into business value.

Ethics also matters. A provider should distinguish its original work, third-party services and open-source components, while observing the licenses attached to those components. Ask what you are paying for: configuration, engineering, hosting, support, application design, domain knowledge or original software. When evaluating a developer after a poor experience, use a structured process for finding an ethical AI development partner rather than judging credibility from branding alone.

Before signing, ask the provider’s technical lead to walk through a hypothetical departure. Which assets would you receive? Which services would stop? What would another team need to rebuild? Where would the greatest cost arise? Straight answers reveal more than a general promise that migration is “possible.” A comprehensive set of questions to prevent long-term technology dependence can structure that conversation.

06

How Rohan Hall and OceSha Ventures fit

Rohan Hall brings experience across AI, blockchain systems, blockchain interoperability, decentralized identity, W3C Self-Sovereign Identity concepts, operating systems, databases, software and hardware. His work has also included open-source robots for laboratory automation and an open-source operating system for microcontrollers. That range supports a practical view of architecture: choose technologies according to the business objective, understand their dependencies and preserve room to evolve.

Rohan is the founder and CEO of OceSha Ventures and its AI-first work. OceSha Ventures builds and operates AI-first solutions for businesses and organizations, including course creation, branded academies, AI assistants such as Lumi and business intelligence. Lumi supports conversational websites, customer inquiry handling, customer intelligence and responses grounded in business information that has been reviewed and approved.

The relevant principle is straightforward: an AI initiative should create a useful business capability rather than a fashionable technology dependency. That requires candid choices about open-source and proprietary components, clear control over business knowledge and an architecture designed around the organization’s actual goals. Organizations considering knowledge distribution may also want to explore how to help AI chatbots cite a business as a source.

For more on Rohan’s ventures, global work, podcast and published writing, visit Rohan Hall’s official home page. He covers artificial intelligence alongside blockchain, cryptocurrencies, neuromorphic technologies, cognitive intelligence and other emerging fields in The Convergence of AI and the Top 10 Emerging Technologies. The book is the natural next step for readers who want a broader view of how these technologies intersect.

Review Rohan’s ventures, writing and work across AI and emerging technologies.

Explore Rohan Hall’s work

Frequently asked questions

Should every part of an AI solution be open source?

No. The right mix depends on your requirements, operating capacity, security obligations and desired level of control. Focus on whether strategic components are replaceable and whether proprietary elements deliver benefits that justify their switching costs.

Is access to source code enough to prevent vendor lock-in?

No. Source code may be difficult to operate without documentation, infrastructure, deployment processes and skilled people. You also need usable data exports, documented interfaces, ownership clarity and a viable transition plan.

When should I ask for a data export?

Ask during evaluation and test it during the pilot. Waiting until termination leaves no time to correct incomplete exports, undocumented fields or formats that another team cannot readily use.

How can a nontechnical buyer evaluate an AI architecture?

Ask for a plain-language component diagram showing where data enters, where it is stored, which services process it and what happens if each provider is replaced. Have an independent technical adviser review high-impact or unclear dependencies.

What is the clearest warning sign during vendor selection?

Be cautious when a provider cannot distinguish open-source, proprietary and third-party components, or answers portability questions only with “you own your data.” Ownership needs to be backed by specific export formats, access rights and transition procedures.

Does self-hosting eliminate lock-in?

Not necessarily. Self-hosted software can still depend on specialized configurations, undocumented workflows or scarce expertise. It improves control only when your organization can operate the system and preserve the knowledge needed to maintain or replace it.

The bottom line

Do not choose an AI provider because it says “open source,” and do not reject a provider merely because part of its service is proprietary. Choose the team that can show you the architecture, identify every important dependency and demonstrate a workable exit. Keep your business data and knowledge assets portable, insist on documented interfaces, test an export during the pilot and put transition rights in the contract. Open technology is valuable; proven freedom to change is the stronger protection.

Rohan Hall

Rohan Hall

Founder of OceSha Ventures · AI architect and author

Rohan Hall is a technology entrepreneur, AI architect and author with four decades of technology experience, now focused on practical AI across business, education, government and global impact. He founded OceSha Ventures, builds the OceSha AI platform and Lumi, and wrote The Convergence of AI and the Top 10 Emerging Technologies.

Who stands behind this

OceSha Ventures

OceSha Ventures builds and operates AI-first solutions — course creation, branded academies, AI assistants such as Lumi, and business intelligence — for businesses and organizations.

Sources

  1. Rohan Hall — rohanhall.com
  2. The Convergence of AI and the Top 10 Emerging Technologies (book)
  3. Rohan Hall on LinkedIn
  4. OceSha Ventures — ocesha.com

About this page. Last reviewed .

It is based on his verified public professional record.