AI governance defaults to legacy committee structures.
We define a Governance Centrality Index for each institution: the ratio of the largest internal governance hub to the largest external vendor hub, by in-degree. Mean GCI is 10.15. The maximum is 87, an institution whose largest oversight committee receives governance edges from 87 times more agents than its largest vendor. In 540 of 543 institutions, internal hubs dominate vendor hubs. DORA Article 28 looks outward at vendor concentration. The greater single-point-of-failure exposure sits inside.
Each bar groups institutions by their Governance Centrality Index. The vertical gold dashed line marks the GCI = 1 boundary; institutions to the left have a vendor hub larger than their largest governance hub, while institutions to the right do not. Only 3 of 543 sit to the left. The peak bucket holds 114 institutions at GCI between 5 and 7.5. The navy dashed line marks the population mean of 10.15. The right tail extends to 87. DORA Article 28 mandates concentration assessment for ICT third-party services. The substrate finds that internal governance concentration exposes the institution to a structurally similar single-point-of-failure risk that no current regulation systematically observes.