{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"ai_governance","domain":["AI Governance","Third-Party / Supply-Chain Risk","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-supply-chain-concentration","description":"Because the organization relies on third-party pretrained models, datasets, and libraries that may carry backdoors, malicious code, or bias, and concentrates on a few external AI API providers, AI-dependent workflows are exposed to both supply-chain compromise and provider outage or insolvency, resulting in compromised model behaviour or sudden loss of AI capability.","details":{"category":"ai_governance","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"ai-supply-chain-concentration","taxonomies":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"],"treatment":"mitigate"},"id":"risk:ai-supply-chain-concentration","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-supply-chain-concentration","sourceIds":["aiuc-1","cobit-2019","dora","eu-ai-act","iso-27001","iso-42001","nis2","nist-800-53","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"AI supply-chain compromise and provider concentration","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:043720cf9cd31dbe678a12b73d62fc32982139c9e940b50b5d2535bf6e29ad50","properties":{"rationale":"Reimplementing or building custom variants of critical components reduces reliance on backdoored or concentrated third-party models and libraries.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-11-153d74aa.json","sourceId":"uc:UC-SDLC-11","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0f39056894c4e8d75a18c34a1a3a2322758c2b351a4612749e8cd6c6ae46e301","properties":{"rationale":"Contractual secure-dev requirements, deliverable review and testing evidence oversee third-party AI/component providers.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4746f726ca42899e12c82606705973809f9ec547fb6c7126256ccf7ff504038e","properties":{"rationale":"Verifying supplier alignment and evaluating AI suppliers is the direct control against backdoored/compromised third-party models, data and provider concentration.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7916d7c9f2c4e8859260a0dc210bf919e0e2f5540dc471e70d0c52e60a4a03f9","properties":{"rationale":"A current inventory of model/library/dataset dependencies with owners and provenance is the AI-BOM visibility control enabling detection of compromised or over-concentrated third-party providers.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-03-cba029bc.json","sourceId":"uc:UC-AI-03","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8320b41b9717aa08cd44fd936c3cf4d80cf5fa036bf5e437041beefe4bb2cf67","properties":{"rationale":"An accurate asset/license inventory tracks third-party/AI dependencies and provider end-of-support exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-12-08ce2fc7.json","sourceId":"uc:UC-SDLC-12","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c86031bc4374f6990fb02f9a0ad68d7634a83dea607bcbd4a27e8c6cf4a9db8f","properties":{"rationale":"Governing external and cloud AI service use with agreed exit terms and compliance monitoring reduces AI-provider concentration and outage impact.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-08-6de49908.json","sourceId":"uc:UC-TPRM-08","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d1bc3d44abfcb1b212921d6c5e3323d0b33cf5166e5957cd9e0d160834fac695","properties":{"rationale":"A criticality-ranked third-party register plus concentration and exit-strategy assessment applies to AI API providers, reducing concentration and outage impact.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d6f15bc8ce6e0050f9c3b0cfe127b25ccb8707150bc05add1d90a6261aeebf3e","properties":{"rationale":"Allocating lifecycle obligations across suppliers/partners clarifies responsibility for third-party AI components.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-13-2ce71d80.json","sourceId":"uc:UC-AI-13","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d9ebe8969ed3f91ee01f8cf8cc9f3e645a489e9cb80d7c9f765095278a628608","properties":{"rationale":"Evaluating supply-chain exposure and provider concentration before engaging AI providers reduces concentration and compromise exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-02-c35b26eb.json","sourceId":"uc:UC-TPRM-02","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e6a8f5a385fa28ecc7261429945fb96f9dafb9e5ff491947f66ec6472b318fc5","properties":{"rationale":"Baseline control and integrity verification of dependencies help detect malicious/backdoored third-party libraries.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-06-c1afc713.json","sourceId":"uc:UC-SDLC-06","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f6324bda249867c4d76237fbf840618741b03d0c45baa86c79ab49d905d785d6","properties":{"rationale":"Maintaining provenance and verifying integrity of components and data catches backdoored or malicious third-party libraries and models.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-07-c98d7242.json","sourceId":"uc:UC-TPRM-07","targetDetailPath":"/data/v1/records/risk-ai-supply-chain-concentration-9f791f54.json","targetId":"risk:ai-supply-chain-concentration","type":"mitigates"}],"schemaVersion":1}