Very few organisations build AI from scratch. A typical AI feature is assembled from pre-trained models, public datasets, open-source libraries, plugins and tools, and third-party APIs. Every one of those is a link in your AI supply chain, and every link can be weak or deliberately compromised.
Supply chain risk is in the OWASP Top 10 for LLM Applications for good reason: attackers target the components many organisations share.
The layers of the AI supply chain
1. Pre-trained models
Models downloaded from public hubs or bought from vendors.
Risks: tampered or backdoored models; malicious code in model files (some file formats can execute code when loaded); models that misrepresent their capabilities, licence or training data; abandoned models with known problems.
2. Datasets
Public and purchased datasets used for training, fine-tuning or evaluation.
Risks: data poisoning, biased or low-quality data, unclear licensing or rights, and personal data collected without a lawful basis.
3. Software packages and libraries
The AI and machine learning frameworks, SDKs and their dependencies.
Risks: malicious packages published to public registries, often with names similar to real ones (typosquatting); compromised maintainer accounts; vulnerable dependencies. AI developers are a target because their tools often run with access to valuable data and credentials. Packages that AI coding assistants “hallucinate” are a newer risk: attackers can register those invented package names.
4. Plugins, tools and integrations
Extensions that give AI systems access to email, files, browsers and APIs, including agent tools and connectors.
Risks: over-privileged integrations, malicious or vulnerable plugins, and tools that pass untrusted content to the model (prompt injection). See AI agent security.
5. AI service providers and vendors
The API providers and SaaS vendors whose models you call or whose AI features you use.
Risks: how they store, use and protect your data; model changes that alter behaviour without notice; outages; sub-processors you don’t know about; and vendors’ own security posture.
How to manage AI supply chain risk
- Inventory your AI components. Extend your AI inventory to list models, datasets, key libraries and AI vendors for each system. Some teams keep an “AI bill of materials” (AI-BOM) for this.
- Use trusted sources. Prefer official, well-maintained models and packages, and pin exact versions.
- Verify integrity. Check hashes and signatures where available, and prefer safe model file formats that don’t execute code on loading.
- Scan dependencies for known vulnerabilities and malicious packages, and watch for typosquats.
- Isolate model loading and testing in sandboxed environments without access to secrets.
- Review AI vendors like any critical supplier: data use and retention, training on your data, security certifications, incident notification and sub-processors. Get commitments in the contract.
- Test behaviour after every change to a model, dataset or vendor version.
- Plan for failure: know how you’d roll back or switch if a component is compromised or a vendor fails.
The governance link
Supply chain management overlaps with AI governance. The EU AI Act expects providers of high-risk systems to manage risks across the lifecycle, and ISO/IEC 42001 includes controls for third-party and supplier relationships. Knowing what your AI is made of is the starting point for both.
Official sources
- OWASP Top 10 for LLM Applications: the OWASP GenAI Security Project’s list of the main LLM risks
- MITRE ATLAS: a knowledge base of real attack techniques against AI systems
More primary sources, with a short note on each, are on our Sources page.
Last reviewed October 2026. This article is general information for defensive purposes.