AI supply chain
In AI security, the AI supply chain is the full set of external components a model-backed system depends on: downloaded model weights, third-party datasets, embedding stores, agent tools and the libraries around them. Treating these as a supply chain, and testing them as one, is the discipline almost no product glossary applies.
How it works
Almost no organisation trains a model from scratch. It downloads pre-trained weights from a public hub, fine-tunes on third-party or scraped data, indexes documents into a vector store, and connects the result to external tools. Every one of those is a dependency supplied by someone else, which makes it a supply chain in the same sense as software: weights are a binary of unknown provenance, a dataset is untrusted input, an agent tool is third-party code with access to your data. The concept of an AI bill of materials extends the idea of an SBOM to this stack, recording which model, which data and which components a system actually depends on.
What goes wrong
The attacker does not need to breach your network if they can influence a component you will pull in willingly. A tampered set of weights carries a backdoor through training data poisoning that survives into your deployment. A malicious package on a model hub, or a compromised tool exposed to an agent, is a software supply chain attack wearing an AI label. In the systems we review, these components are adopted with far less scrutiny than a normal dependency: nobody verified the weights, nobody pinned the dataset, and the tool the agent trusts was added because it was convenient. The trust is implicit, and that is the opening.
Where this shows up in an audit
We inventory the AI supply chain and assess provenance and integrity at each link: where the weights came from and whether they are verified, how training and fine-tuning data are sourced, and what each connected tool or MCP server is trusted to do. Regulatory exposure under the Cyber Resilience Act is noted where the product ships to others. The finding is written against the missing control in the chain, not the model output. This is part of how we review the components behind an AI system.