Executive Summary
UK NCSC and ENISA issued joint guidance on managing AI supply chain risks across models, data and third-party tooling for SMEs and SaaS vendors.
What Happened
The UK National Cyber Security Centre and ENISA issued joint guidance outlining how SMEs, startups, and SaaS vendors should manage AI supply chain risks across models, data, and third-party tooling.[rich_content:7] The document stresses that organizations often depend on external LLM APIs, datasets, and model hubs that may introduce prompt injection, data poisoning, and model theft risks.[rich_content:7] It recommends vendor security questionnaires tailored to AI, contractual controls over training data use, and technical measures such as input validation and model isolation.[rich_content:7]
Vulnerability / Attack Technique
AI supply chain risk (guidance)
Technical Mechanism
Guidance covering prompt injection, poisoning and model theft.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Government guidance aligned with OWASP categories.
Recommended Controls
- Use vendor questionnaires for AI suppliers
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
UK NCSC / ENISA: https://www.ncsc.gov.uk/guidance/securing-ai-supply-chains-for-smes-and-saas
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.