(Editor's Note: In this series of articles, we answer the pressing Questions That Matter on the uncertainties that will shape 2025—collected through our interactions with investors and other market participants. The series is aligned with the key themes we're watching in the coming year and is part of our Global Credit Outlook 2025.)
The rapid expansion of generative AI exacerbates existing dependencies on big technology firms. Advancements in decentralization, such as crypto and edge AI, could offset some of the associated centralization risks if they are adopted rapidly.
How This Will Shape 2025
Accelerating AI implementation will introduce new operational challenges. Much of the past two years was spent assessing the potential of generative AI (genAI)--until the first quarter of 2024, only 18% of companies had adopted and fully integrated genAI tools within their operations, according to the S&P Market Intelligence "Voice of the Enterprise" survey. Companies are now starting to shift from experimentation to broader use. Key challenges ahead include the management of large volumes of unstructured data, oversight of large complex models, and the significant energy consumption inherent to large generative AI models. Meanwhile, the storage of data at third-party, cloud-based data centers will give rise to issues of latency, privacy, and data sovereignty. Specifically, most organizations' AI models are utilizing the public cloud for training (63%), data storage (68%), and to perform inference (62%), according to S&P Market Intelligence's report "The Rise of Edge AI".
Big Tech concentration risks are increasing and are likely to be exacerbated over 2025. The increasing reliance of companies on a few third-party providers of hardware, cloud services, specialized software, and advanced genAI models exacerbates single-provider risk (see chart). Related dependencies increase systemic risks, particularly in the financial and public sectors (e.g., defense and healthcare). The CrowdStrike outage, in July 2024, highlighted some of the possible issues inherent to tech concentration risks and the interdependency of critical systems and software. Such incidents tend to impact credit risk related to revenue loss, reputational damage, and the financial costs of responding to and remediating issues.
Chart 1
Edge AI and smaller models will support more sustainable and resilient use. AI computation at the edge describes operations that occur on an organization's network (e.g., on their PCs, smartphones, or Internet of Things devices), rather than on centralized infrastructure, such as the public cloud. Companies are primarily opting to run and use AI models (known as inferencing) at the edge, with 82% of respondents choosing the edge over cloud for inferencing, according to a survey by 451 Research. However, large, frontier genAI models (chat GPT, Gemini, Claude) may struggle to run at the edge as they require significant computational power and training data to perform. That challenge is prompting companies seeking to deploy AI for more specific purposes to turn to small-language models (SLMs), which have lower computational requirements (and thus consume less energy), are more cost-effective to train and deploy, and can generate responses quicker, which is valuable in applications like virtual assistants. That makes SLMs more suited to run in edge environments and suggests a likely commercial shift from large to small models, at least in the short run.
Crypto technology can mitigate risks and support edge AI adoption. The emergence of decentralized physical infrastructure networks (DePINs) was a key crypto theme in 2024. These networks use blockchain technology to connect servers, sensors, phones, and wireless networks. They use crypto tokens as an economic incentive for users to participate. When applied to edge AI, DePINs can support networks of devices and AI models that don't rely on central entities for data storage and computation. They can also facilitate information traceability, identity management, model complexity, and reduce energy used in computation.
What We Think And Why
Security and data-privacy concerns will drive adoption of SLMs and edge AI. Security and data privacy are key drivers for companies adopting edge AI, according to a survey by S&P Global Market Intelligence. The technologies enable data to be processed locally, on handheld or desktop devices, which limits data transfer to a cloud server. The resultant reduction in interdependency can limit the potential for contagion from third-party cyber incidents (e.g., data poisoning or backdoor attacks) and can improve safety with regards to the use of sensitive data for personalized AI-powered services, which can be further enhanced with various cryptographic methods. Applications could include the provision of genAI virtual agents that provide personalized financial or medical advice to clients using their private data. Blockchain could also be used to verify the authenticity of AI-generated content and distinguish between humans and bots, potentially mitigating risks of deepfakes and misinformation.
Open-source small genAI models that run on edge devices will remain popular in 2025. This should support the widespread diffusion and adoption of these models. It should also encourage competition by opening genAI development and usage to small- and medium-sized enterprises, which have typically found barriers to entry--in terms of required investment--difficult to overcome. For example, French AI-startup Mistral, released new open-source edge AI models in October.
Devices and infrastructure networks will become key. We expect the continued adoption and development of DePINs and edge AI to offer improved computational power usage because of their complementary strengths in decentralization, which reduces the need for constant data transmission and leverages computational power from devices within a network. Furthermore, these technologies can enable companies to collaborate in training AI models without sharing data (a process known as 'federated learning').
As AI deployment expands, identity verification and proof of personhood tools will gain relevance. The most immediate use case for those technologies is the protection of personal data. Decentralized identity tools already help users safeguard their personal information and share only the minimum required information when interacting with a digital platform. In October, the city of Buenos Aires rolled out digital identities for its residents, using Zero Knowledge (ZK) proof technology. The system enables users to hold identification information in a "self-sovereign wallet" on the ZKSync Era network and retain control over how they share this data with the government, businesses, and individuals.
Beyond 2025, we expect that AI may gain in autonomy. Agentic AI (AI that independently makes decisions and takes actions, based on a human-defined goal) will place greater emphasis on the identification of human and AI agents in digital interactions. AI agents are already common in manufacturing, logistics, and social media platforms, and will increasingly find applications in a wide range of other fields. Use cases will take years to develop at scale, but Coinbase's October launch of a tool for building AI agents and Microsoft's November announcement of its Copilot AI agents highlight the work already under way. Blockchain technology can support proof-of-personhood applications. For example, the Worldchain project (launched by Open AI's CEO Sam Altman) supports only human-to-human transactions, using wallets attached to an iris scan to identify human transactors.
Chart 2
What Could Change
Exacerbated centralization risk. The pace of adoption of blockchain and edge technologies may not keep pace with the fast implementation of genAI. Competitive pressures could push corporations to overlook broader systemic concentration risk and focus on the convenience and ready availability of Big Tech solutions. The resulting increased reliance on a few companies and centralized data centers may exacerbate vulnerabilities to single points of failure, cyber attacks, and physical and geopolitical risks.
Nascent technology comes with evolving risks. Beyond a reliance on Big Tech, a rapid rollout of genAI tools could bring operational risks, cyber vulnerabilities, and legal risks--particularly with regard to the unforeseen liabilities that AI agents might create for developers and end users. Technological solutions addressing identification and verification are nascent, and failures could lead to data breaches and/or breaches of regulatory data-protection obligations.
The push for energy sustainability could backfire. While edge AI can, in theory, reduce overall computational demand and reduce computational power usage, that may not occur if the technology evolves in silos rather than networks. Siloed edge AI could increase computational demands for an organization and reduce computational power efficiency at centralized datacenters, resulting in greater energy consumption and increased sustainability risks.
Read More
- Agentic AI, Artificial Intelligence Insights Podcast, Oct, 30, 2024
- Financial Systems Will Face New Systemic Risks, Oct. 4, 2024
- Crypto and AI: Shaping the Future of the Internet, Oct. 1, 2024
This report does not constitute a rating action.
| Primary Credit Analysts: | Miriam Fernandez, CFA, Madrid + 34917887232; Miriam.Fernandez@spglobal.com |
| Andrew O'Neill, CFA, London + 44 20 7176 3578; andrew.oneill@spglobal.com |
No content (including ratings, credit-related analyses and data, valuations, model, software, or other application or output therefrom) or any part thereof (Content) may be modified, reverse engineered, reproduced, or distributed in any form by any means, or stored in a database or retrieval system, without the prior written permission of Standard & Poor’s Financial Services LLC or its affiliates (collectively, S&P). The Content shall not be used for any unlawful or unauthorized purposes. S&P and any third-party providers, as well as their directors, officers, shareholders, employees, or agents (collectively S&P Parties) do not guarantee the accuracy, completeness, timeliness, or availability of the Content. S&P Parties are not responsible for any errors or omissions (negligent or otherwise), regardless of the cause, for the results obtained from the use of the Content, or for the security or maintenance of any data input by the user. The Content is provided on an “as is” basis. S&P PARTIES DISCLAIM ANY AND ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE, FREEDOM FROM BUGS, SOFTWARE ERRORS OR DEFECTS, THAT THE CONTENT’S FUNCTIONING WILL BE UNINTERRUPTED, OR THAT THE CONTENT WILL OPERATE WITH ANY SOFTWARE OR HARDWARE CONFIGURATION. In no event shall S&P Parties be liable to any party for any direct, indirect, incidental, exemplary, compensatory, punitive, special or consequential damages, costs, expenses, legal fees, or losses (including, without limitation, lost income or lost profits and opportunity costs or losses caused by negligence) in connection with any use of the Content even if advised of the possibility of such damages.
Credit-related and other analyses, including ratings, and statements in the Content are statements of opinion as of the date they are expressed and not statements of fact. S&P’s opinions, analyses, and rating acknowledgment decisions (described below) are not recommendations to purchase, hold, or sell any securities or to make any investment decisions, and do not address the suitability of any security. S&P assumes no obligation to update the Content following publication in any form or format. The Content should not be relied on and is not a substitute for the skill, judgment, and experience of the user, its management, employees, advisors, and/or clients when making investment and other business decisions. S&P does not act as a fiduciary or an investment advisor except where registered as such. While S&P has obtained information from sources it believes to be reliable, S&P does not perform an audit and undertakes no duty of due diligence or independent verification of any information it receives. Rating-related publications may be published for a variety of reasons that are not necessarily dependent on action by rating committees, including, but not limited to, the publication of a periodic update on a credit rating and related analyses.
To the extent that regulatory authorities allow a rating agency to acknowledge in one jurisdiction a rating issued in another jurisdiction for certain regulatory purposes, S&P reserves the right to assign, withdraw, or suspend such acknowledgement at any time and in its sole discretion. S&P Parties disclaim any duty whatsoever arising out of the assignment, withdrawal, or suspension of an acknowledgment as well as any liability for any damage alleged to have been suffered on account thereof.
S&P keeps certain activities of its business units separate from each other in order to preserve the independence and objectivity of their respective activities. As a result, certain business units of S&P may have information that is not available to other S&P business units. S&P has established policies and procedures to maintain the confidentiality of certain nonpublic information received in connection with each analytical process.
S&P may receive compensation for its ratings and certain analyses, normally from issuers or underwriters of securities or from obligors. S&P reserves the right to disseminate its opinions and analyses. S&P's public ratings and analyses are made available on its Web sites, www.spglobal.com/ratings (free of charge), and www.ratingsdirect.com (subscription), and may be distributed through other means, including via S&P publications and third-party redistributors. Additional information about our ratings fees is available at www.spglobal.com/usratingsfees.