AI Supply Chain Risk
AI Supply Chain Risk covers everything an enterprise inherits by depending on external AI vendors, open-source model weights, or third-party training data it doesn't control — vendor outages, model deprecation, licensing changes, or a vulnerability discovered in a widely-used foundation model. APRA CPS 230's extension to third-party AI providers from 2028 is a direct regulatory response to this risk category.
Primarily affects
The Governance dimension of the Australian Enterprise AI Index.
Related regulatory framework
See where this shows up in the Index
The open methodology explains exactly how each dimension is scored and weighted.
Related terms
Definitions are written for enterprise AI governance context, not a formal legal standard. Suggest a correction →