Annual risk management reviews definitely favor large incumbents. Large incumbents have the ability to hire and maintain compliance teams. That burden is definitely a barrier to entry to new competitors (though not an insurmountable one).

But it only applies to AI controlling critical infrastructure, you think this is an issue in practice?

I would think if a power plant deploys some AI model to optimize something or other, it would be on the plant operator to perform the reviews, regardless of who they get the AI from.