AI supply chain risk: what are teams actually missing?

TL;DR: AI supply chain risk is widening because organisations approve the front-door vendor while missing the hidden model, transcription, and cloud dependencies beneath it, according to Panorays; in a 2026 CISO survey of 200 US-based CISOs, 77% ranked third-party risk among their biggest threats, but only 13% track nth-party vendors. The control problem is no longer supplier review alone, it is continuous visibility into data flow and delegated AI service chains.

Editorial analysis by NHI Mgmt Group, based on content published by Panorays: “Confessions of an AI: How I See Your Supply Chain Risk”.

By the numbers:

• Only 13% track nth-party vendors, the layers behind the layers where AI systems move data.
• 60% say AI vendors are a different kind of risk than regular software.
• Only 22% have a real policy for evaluating AI vendors.

Key questions

Q: What should organisations do first to govern AI supply chain risk?

A: Start by building an AI inventory that lists models, agents, prompts, skills, MCP servers and the dependencies around them.

Q: Why do third-party AI dependencies create more risk than traditional SaaS vendor reviews?

A: Third-party AI dependencies are harder to govern because the organization often does not control the model, the tool layer, or the hidden suppliers behind them.

Q: What breaks when AI vendors use hidden upstream services?

A: The organisation loses sight of where sensitive data is processed, retained, and routed, which means policy and legal assumptions no longer match the technical path.

Practitioner guidance

• Map the full AI service chain Document every upstream component that processes business data, including transcription services, model providers, and cloud hosting layers, not just the contracted front-end application.
• Continuously discover nth-party dependencies Replace annual questionnaires with automated discovery that flags newly introduced upstream services, API integrations, and hidden subprocessors as they appear.
• Verify data isolation and retention claims Test how data is separated in practice, confirm retention and opt-out settings at each processing layer, and challenge any vendor claim that cannot be evidenced end to end.

Bottom line: AI supply chain risk arises when organisations trust the named vendor but miss the hidden services, hosting layers, and data flows that actually process information.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →