The AI supply chain is the set of third-party components a company's solution is built on – the underlying model, the infrastructure provider, the integrator and any additional tools. However, responsibility towards the customer is borne by whoever offers the solution under its own brand, not by the model supplier. There are three practical risks. The provider may change the model or end its support, changing the behaviour of the solution without any action on your part. The terms of use, including how submitted data is handled, may change. And in the event of an incident, you will need information that you only have if you requested it in the contract. The contract should therefore include notification of changes, availability of documentation, rules for data, and the ability to move to a different solution.
See also: Provider and deployer, Technical documentation of an AI system, Data processing agreement.
