Key takeaways

• AI can introduce hidden dependencies that may sit outside the scope of traditional third-party risk assessments.
• Point-in-time assessments can age quickly when suppliers restructure, outsource operations or move workloads into different environments.
• Supplier diversity at the third-party level can conceal concentration among shared fourth parties and infrastructure providers.
• Continuous visibility, stronger procurement governance and closer operational coordination with suppliers matter more than assessment frequency alone.

How AI is changing the supply chain risk picture

Traditionally, supplier risk starts with a familiar process: assess the vendor, document the controls, and revisit the relationship at the next review. AI is starting to challenge that model because the service being assessed keep evolving after the assessment is complete.

AI can create hidden dependencies that traditional third-party risk assessments may not be designed to detect. Providers are embedding AI into existing products, changing how information is processed and stored, and potentially increasing reliance on external models, specialist infrastructure and other service providers

The original vendor assessment may no longer describe the service being delivered today.

This blog walks through the key aspects of the supply chain risk management process for technology, security and infrastructure leaders running businesses across Asia-Pacific (APAC).

Read on to understand:

• Why third-party risk frameworks need to evolve
• What makes embedded AI a distinct risk factor
• Why AI risk needs to be considered during procurement and onboarding
• How concentration risk can affect resilience
• How to build a more connected supply chain operating model

Why third-party risk frameworks need to evolve

Questionnaires, evidence reviews and reassessments still matter. The weakness often appears after assessment: supplier relationships can keep changing.

A supplier might later outsource an operation, divest part of its business, change a subcontractor, embed an AI agent or move a workload into a new cloud environment. Each change alters exposure, even if it never appears in the original risk record.

According to a 2025 IDC InfoBrief sponsored by Lumen, 42% of respondents identified real-time monitoring and threat detection as primary gaps in their cybersecurity programmes.¹ Periodic reviews alone can allow visibility gaps to develop between assessment cycles.

Regulatory expectations are also moving towards stronger ongoing oversight. For APRA-regulated entities in Australia, CPS 230 requires continuing management of material service provider arrangements, including relevant fourth-party risks. Organisations should assess which requirements apply to their sector and circumstances. A practical response can combine periodic assessments with independent assurance and proportionate ongoing monitoring.

Treat embedded AI as a distinct risk factor

Embedded AI should be captured in vendor assessments and supplier registers as it can introduce functionality and data processing into an existing service without separate review through an organisation’s established governance process.

Assessments should seek to confirm what data AI processes, which models are involved, where data is stored, who can access it, and whether it is segregated and used only for the agreed purpose.

ISO/IEC 42001 can provide a management-system framework for considering issues including governance, human oversight and controls relating to AI systems. Decisions about agent autonomy should also reflect the organisation’s risk appetite, intended use, legal obligations and operational controls.

Bring AI risk into procurement and onboarding

Supplier onboarding should assess whether a vendor can deliver the service and manage the associated risk.

Identity and access management remains important, but procurement, security and risk teams also need to ask:

• How the supplier uses AI in delivering the service
• What customer information is processed by AI systems
• Which models and infrastructure providers are involved
• What independent attestations or assurance the supplier can provide
• How the supplier would continue operating during a disruption
• How material changes to the service will be disclosed

Organisations can consider addressing AI use, data handling, subcontractors, incident notification, service changes and continuity in relevant contracts. Depending on the service, risk profile and negotiating position, appropriate obligations can also be applied to subcontractors and other material downstream providers.

A contract will not prevent every incident. It can document agreed expectations, allocate responsibilities and support evidence that contractual controls were considered and implemented. Whether those controls are reasonable or sufficient will depend on the circumstances, applicable requirements and how the arrangements operate in practice.

Look beyond supplier diversity to concentration risk

A varied list of immediate suppliers does not necessarily represent a diverse supply chain.

Several third parties rely on the same infrastructure provider, specialist service or fourth-party vendor. A supply chain can appear diverse at tier one while remaining concentrated at lower tiers.

The same 2025 IDC InfoBrief sponsored by Lumen reports that 34% of respondents identified maintaining visibility across expanding attack surfaces is crucial for effective security.¹ That attack surface can extend into downstream suppliers, where an organisation’s visibility can be limited.

Organisations can start by mapping critical dependencies: which suppliers support essential services, which downstream providers they share, and what happens if a common dependency fails.

Where concentration sits with a parent company, ask how the service would continue if an underlying provider or operation were disrupted. Resilience is judged by service continuity, not supplier count.

Include infrastructure in the supplier risk picture

AI workloads often depend on specialist compute, cloud platforms and data centre environments. These are supply chain relationships, not just hosting choices.

If infrastructure supporting a critical service is disrupted, organisations need to understand how the workload would be restored, what alternative capacity exists and which service commitments apply.

For organisations that are responsible entities for critical infrastructure assets under Australia’s Security of Critical Infrastructure Act, additional obligations can apply. Enhanced requirements can also apply where an asset is declared a System of National Significance. In these contexts, the identity of service providers, data flows and infrastructure locations can become relevant governance considerations alongside technical requirements.

Business continuity plans should account for these dependencies and, where appropriate, be rehearsed with suppliers involved in the response. Rehearsal tests roles, communication routes and whether documented processes still reflect reality.

Build a more connected supply chain operating model

Supply chain risk often sits across procurement, legal, security, compliance, risk and operations. Each team may hold part of the picture, but not always a connected view.

Fragmented ownership can contribute to duplicated activity, inconsistent decisions and gaps in accountability across supply chain risk processes.

Depending on their sector, activities and geographic reach, regional organisations need to consider local and extraterritorial requirements. Examples include applicable Singapore financial-sector technology and outsourcing guidance, Australia’s CPS 230 and CPS 234 for APRA-regulated entities, relevant SOCI obligations, and EU regimes such as NIS2 and DORA.

The EU Cyber Resilience Act can also be relevant where products with digital elements are placed on the EU market. Organisations should confirm the requirements that apply to their specific circumstances.*

*Note: This content is provided for general educational purposes and does not constitute legal, regulatory or compliance advice. Requirements vary by jurisdiction, sector and organisation. Readers should obtain advice on the obligations applicable to their circumstances.

Separate programmes can lead to repeated supplier assessments against overlapping requirements.

A connected model can bring these inputs together: assessments create a baseline, contracts set expectations, monitoring identifies change, and exercises test response.

The practical shift is from assessing suppliers as static organisations to monitoring them as part of a changing ecosystem.

Five decisions worth weighing

These five decisions usually shape how quickly organisations can move from assessment to control.

Decide your scope

Build the controls

Conclusion

For technology leaders across APAC, supply chain risk increasingly requires ongoing attention rather than reliance on a one-time certification exercise. Risk profiles can change over time, extend beyond immediate supplier registers and include AI-related dependencies within previously assessed services.

The response does not need to start as a transformation programme. Map critical dependencies, set a defensible tolerance, mandate disclosure down the chain, and rehearse disruption with the suppliers involved. Visibility is likely to improve when governance, data, connectivity and security move together.

Lumen security solutions are designed to support activities such as continuous monitoring, access to threat intelligence and cyber resilience planning, subject to the selected services, customer environment and service availability. Lumen’s connectivity capabilities can support organisations seeking to improve visibility, governance and resilience across their supply chain and AI ecosystem.

Talk to a Lumen expert about supporting secure, governed connectivity across your AI ecosystem.

Want to take a deep dive into supply chain risk management in the AI era?

¹IDC InfoBrief, sponsored by Lumen, The New Cybersecurity Equation: Risk, Response, and Business Outcomes, #US53083025, February 2025.

Percentages and descriptions should be read in the context of the research methodology and respondent base set out in the source.

Disclaimer: Services not available everywhere. Business customers only. Lumen may change, cancel or substitute products and services, or vary them by service area at its sole discretion without notice. ©2026 Lumen Technologies. All Rights Reserved.