One in five AI tools we catalogued no longer exists

Finding 1 — the mortality rate is one in five

Of 4,991 tools we catalogued and whose status we could verify, 1,027 no longer respond: dead domain, parked, 404, or DNS that does not resolve. That is 20.6% — one in five.

The number is not about startups that shut down: it is about addresses an employee could have opened in a browser and that no longer exist. For anyone who built a routine on one of them, the end came without notice.

Finding 2 — code and productivity tools vanish nearly three times more than platforms

The rate varies sharply by category, and the variation has a logic. The categories with the highest mortality are those with the lowest barrier to entry: a productivity tool or a coding assistant can be shipped by one person over a weekend.

The ones that endure require expensive, continuous infrastructure — model providers and orchestration platforms do not vanish because someone lost interest.

Finding 3 — the highest-risk tools are precisely the ones that do not vanish

This is the most counterintuitive finding, and the one with the greatest practical consequence for whoever sets AI usage policy.

The honest reading is that critical risk concentrates in categories dominated by established operations — voice cloning, video synthesis, autonomous agents and large language models — while the long tail that disappears is made of moderate-risk tools. We do not claim that being risky makes a tool durable; we claim that, in our catalog, the risky ones are the ones that stay.

The consequence is direct: postponing a decision on the highest-risk tools in the hope that the subject will pass is the worst possible bet. What passes is the moderate-risk long tail. What stays is exactly what requires a written policy.

Finding 4 — almost every AI tool in use is foreign

Among the 3,607 active tools with an identified home country, 16 are Brazilian. The other 3,591 — 99.6% — are headquartered abroad, spread across 79 countries.

For a Brazilian company this carries a legal consequence that often goes unnoticed: where personal data is involved, practically every AI adoption is an international data transfer, subject to article 33 of the LGPD.

And the deadline has passed. Resolution CD/ANPD No. 19/2024 approved the standard contractual clauses on 23 August 2024 and granted twelve months of transition, which ended on 23 August 2025. See the guide on the LGPD and AI tools.

What these numbers change in practice

• An inventory is a film, not a photograph. A list of AI tools compiled a year ago has, at our rate, roughly a fifth of entries that no longer exist — and contains nothing that arrived since.
• Operational dependency is measurable risk. The question “what happens if this tool disappears?” stops being hypothetical when one in five actually does.
• Blocking by list cannot keep up. A hand-written blocklist ages in both directions: it wastes lines on the dead and misses everything newly born.
• The riskiest ones will not leave on their own. A written policy is the only way through the critical band, because waiting does not solve it.

Methodology

The catalog covers tools detectable as AI usage in a corporate environment: what shows up in a process, a DNS query or the browser history of a workstation. Each entry carries a domain, a category, a risk level and the home country of the vendor.

An entry counts as “no longer exists” when the liveness check finds a dead domain, a parked page, a 404, or DNS that does not resolve. Entries retired after a scope review — personal rather than corporate use, or a cataloguing error on our side — are counted separately and excluded from the mortality rate.

A retired entry is not deleted: it stays in the catalog with its risk frozen, which is what allows mortality to be compared across risk bands without distortion.

Limitations, stated plainly

• This is not a market census. It is the mortality observed in our catalog, whose selection reflects what is detectable as corporate AI usage. Tools we never catalogued are not in the count.
• There is no time series. We record when we retired the entry, not when the tool went offline — so yearly mortality cannot be derived from this data.
• The risk classification is our judgement, based on public documentation. For that reason we left out findings that would merely measure our own criteria, such as the concentration of critical risk by jurisdiction.
• The origin percentages exclude active tools with no identified country.