Identifying the Supply Chain of AI for Trustworthiness and Risk Management in Critical Applications

AI supply chain risks are largely overlooked: While researchers have extensively studied individual AI risks like algorithmic bias and model hallucinations, there is a significant gap in systematically assessing the complex web of data sources, pre-trained models, and services that feed into modern AI systems—a particularly critical oversight when these systems are used in essential sectors like healthcare, food supply, and transportation.

Critical applications require supply chain visibility: The paper identifies that AI systems used in high-stakes domains (food supply, healthcare, utilities, law, insurance, and transport) face unique vulnerabilities because organizations often lack visibility into all the components and dependencies that contribute to their AI system's outputs, making it difficult to identify where problems might originate.

A new taxonomy helps non-experts manage AI risks: The authors propose a taxonomy for categorizing AI supply chain entities specifically designed to help stakeholders without deep technical expertise "consider the right questions" and systematically map out their organization's AI dependencies—bridging the gap between current AI governance frameworks and practical risk management needs.

Governance frameworks are outpacing practical implementation: The paper highlights that while AI governance discussions have advanced, there remains an urgent need for actionable, systematic approaches to actually assess and manage AI risks in real-world critical applications, suggesting current frameworks may be too theoretical or disconnected from operational reality.