Companion to the AI Sovereignty Risk Assessment Framework · CASE assessment 0d65200c-2dd5-4e98-9cf2-015acb62f617
# Is There a Hidden AI Supply Chain in Your Vendor?
*A plain-language walkthrough for GRC and compliance auditors, no technical background required*

**Organization:** Meridian Logistics Group  
**Vendor / dependency assessed:** RouteHelp (internally built assistant from open-source components)  
**Industry:** Generic business

*Generated by the CASE assessment pipeline on 2026-10-28. Metric values were assigned by retrieval-grounded agents and scored deterministically; they have not been reviewed by a human expert.*

## Before You Start

This is not a technical document. It answers one practical question a compliance auditor is increasingly asked: “We use a lot of software. Some of it quietly grew an AI feature. What do we actually need to worry about, and how bad is it?” It walks through one vendor from start to finish using the same seven questions every time. A small italicised note under each section (“Technical cross-reference”) points back to the technical rubric for anyone who wants to trace a rating to the formal scoring model; you can ignore those notes and still get full value.

### The Rating Scale, In Plain English

| Rating | Meaning |
|---|---|
| **RATING: LOW** | Normal and contained. If something went wrong here, you'd find out quickly and fix it without much trouble. |
| **RATING: MEDIUM** | Could cause a real problem, and you might not find out right away, worth tracking, not yet an emergency. |
| **RATING: HIGH** | Could cause serious damage, a data leak, a regulatory violation, or losing the ability to operate, and by the time you noticed, it might already be too late to undo. |

## The Scenario

> Meridian Logistics Group, a 35,000-employee freight and logistics company, runs RouteHelp, a customer-support knowledge assistant built by its internal platform team from open-source components: an embedding model downloaded from a public model hub, a tokenizer and orchestration framework installed from a public package registry, and a self-hosted vector database. Everything runs in Meridian's own cloud account and no commercial AI vendor is involved; the company adopted the stack deliberately to avoid vendor exposure.
>
> Dependencies are pinned by version but not by hash, the deployment pipeline pulls updates weekly, and no one reviews model-card or package changes before they reach production. A compromised or maliciously updated package, model file or tokenizer would execute with access to the support knowledge base and 40 million customer shipment records, and its outputs would flow straight to customer-service agents in twelve countries. The company can swap any component for an alternative in days, has no contractual counterparty to give it notice, and is not subject to sector regulation beyond general data-protection law.

## Walking Through It, Category by Category

### 1. Whose AI brain is this, really?

Every AI feature is powered by some underlying model, hosted somewhere, controlled by someone. That someone is very often not the software vendor you actually have a contract with.

**Ask the vendor:**

- *Whose AI model is actually answering our questions, yours, or one you're renting from someone else?*
- *If we stopped paying you tomorrow, could we take this AI capability somewhere else, or does it just disappear?*
- *Can the AI's behavior change overnight without you telling us?*

**What we found:**

Meridian Logistics Group genuinely owns the RouteHelp brain in the ways that matter most: the model weights are open and self-hosted in Meridian's own cloud account, and the platform team confirmed the whole stack could be rebuilt elsewhere with no loss of capability. The weakness is not where the model lives but who decides when it changes. Every week the deployment pipeline downloads a fresh copy of the embedding model from a public model hub, identified only by a version label and not by a fingerprint that proves the file is the same file, and nobody reads the accompanying documentation or tests the new model before it serves live answers. In practice the decision about how RouteHelp behaves rests with an anonymous publisher on a public website who owes Meridian no notice, no explanation and no warning, and who can push a change at any moment.

> **RATING: HIGH**, Meridian can move this system anywhere it likes, but it cannot currently tell you who changed the model's behaviour last week, or whether anyone checked.

*Technical cross-reference: dimensions 1.3 (Model update / versioning control), 1.2 (Model weight custody / control), 1.4 (Model evaluation / red-teaming ownership), Org Action Required (UI), Trigger Conditions (AT), Primary Dependency Impact -- Integrity (VI), Silent/Automatic Trigger (AU) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:H/SA:L/E:A/CR:M/IR:H/AR:M/S:N/AU:Y/R:U/V:D/RE:L/U:Red`, score 9.2 (Critical).*

### 2. What are we feeding it?

Once an AI feature exists, the next question is simple: what of ours does it actually see? Employee inputs, uploaded reference material, and anything the AI can reach and act on all count.

**Ask the vendor:**

- *What do our employees actually type into this thing, and does it include customer or confidential information?*
- *Did we upload or connect any of our own internal documents for it to search?*
- *Can this AI take real actions, look things up, change things, or does it only talk?*

**What we found:**

Meridian deliberately feeds RouteHelp its support knowledge base together with 40 million customer shipment records so the assistant can look up answers. Because the weekly downloaded components run inside the same process as that lookup, any tampered package, model file or tokenizer would read those documents in full and in the clear, not in fragments. The same components decide what gets indexed and what gets handed back, so a tampered component could also quietly insert false content that the assistant and the agents reading it would treat as genuine company material. Incidents of exactly this kind — tampered packages and model files pulled from public repositories that harvested everything they touched — are documented in the wild, not merely theorised. Because the corpus contains personal data about senders and recipients, exposure of even part of it would be a reportable personal-data breach for Meridian as controller.

> **RATING: HIGH**, The single most sensitive dataset Meridian holds is readable, and silently rewritable, by whatever code the pipeline happened to download last week.

*Technical cross-reference: dimensions 2.2 (Internal documents ingested for RAG), 2.1 (Prompts / user inputs), Trigger Conditions (AT), Primary Dependency Impact -- Integrity (VI), Primary Dependency Impact -- Confidentiality (VC) in the technical rubric. CASE vector `SOV:1.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:H/SA:L/E:A/CR:M/IR:H/AR:M/S:P/AU:Y/R:U/V:D/RE:M/U:Red`, score 7.0 (High).*

### 3. What does it create from our data: and where does THAT go?

This is the part almost every vendor review misses entirely. AI systems don't just read your data, they transform it into new things: mathematical fingerprints of your documents, logs of every answer given, records of which answers got a thumbs-down. Those new things get stored somewhere, often by a company you've never heard of and never contracted with directly.

**Ask the vendor:**

- *Does this turn our documents into some kind of derived file (an “embedding”) so it can search them faster?*
- *If so, who stores that derived file, you, or a completely different company?*
- *Do you keep a copy of everything the AI said back to us, a log of how we used it, or a record of when we said the answer was wrong?*

**What we found:**

The vector database that holds the processed form of the knowledge base and the 40 million shipment records is self-hosted in Meridian's own cloud account, so there is no third-party store, no outside contract and no foreign jurisdiction over it — a genuine strength. However, this store is the one lasting copy of everything Meridian has fed the assistant, and the weekly-downloaded components hold the application's own access rights to it, so there is no internal barrier between unreviewed code and the entire index. It is also worth recording that the processed form is not an anonymised abstraction: the numerical representations produced by this kind of model can be worked back into meaningful information about the original text. A tampered component could therefore copy the whole derived corpus out, or quietly alter what the assistant retrieves, and Meridian has no way to tell which entries were changed.

> **RATING: HIGH**, Keeping this database in-house removes the outside-party problem entirely but does nothing to limit how much is lost if a downloaded component misbehaves.

*Technical cross-reference: dimensions 3.2 (Vector database / embedding store location and control), 3.1 (Embeddings), 3.3 (Model outputs / completions), Position Required (PR) in the technical rubric. CASE vector `SOV:1.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:M/IR:H/AR:M/S:P/AU:Y/R:U/V:D/RE:M/U:Red`, score 7.0 (High).*

### 4. Who's deciding what the AI sees and does?

Between “the model” and “what we see” sits a set of decisions: which document gets pulled up, whether a filter blocks an answer, where an action actually executes. Each of those decisions can be made by yet another company.

**Ask the vendor:**

- *Who decides which of our documents actually get shown to the AI when it answers a question?*
- *Who runs the safety filter that sees every question and answer, and can we see its rules?*
- *If the AI takes an action on our behalf, where does that action actually happen, in your systems, ours, or a third location?*

**What we found:**

The framework that coordinates RouteHelp — deciding what to retrieve, how to assemble the question put to the model, and what text reaches the agent's screen — is installed from a public package registry and refreshed weekly without review. Self-hosting means no outside supplier watches these steps, which is a real benefit; the trade-off is that the integrity of this central component now rests entirely on code nobody at Meridian inspects. Whoever can publish a release under that package name can change the coordinating logic, and would be running inside Meridian's trust boundary with the system's own credentials to the knowledge base and shipment records. This is a well-documented attack route: published packages have been updated after gaining adoption specifically to silently copy everything passing through them, and security researchers have found numerous remote-code-execution flaws across this family of frameworks.

> **RATING: HIGH**, The component that controls what RouteHelp sees, says and reaches is replaced every week by an outside party on trust alone.

*Technical cross-reference: dimensions 4.2 (Orchestration / agent framework), 4.1 (Retrieval pipeline (RAG) ownership), Compulsion Complexity (AC), Primary Dependency Impact -- Integrity (VI) in the technical rubric. CASE vector `SOV:1.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:M/IR:H/AR:M/S:N/AU:Y/R:A/V:C/RE:L/U:Red`, score 7.0 (High).*

### 5. Which humans are actually looking at our stuff?

Not every risk is a computer. Somewhere in most AI products, an actual person, often a contractor, often outsourced, reads flagged conversations or debugs a problem using our data. That's a direct human set of eyes, independent of every technical safeguard above.

**Ask the vendor:**

- *Does a real person at your company, or a contractor of yours, ever read our conversations or our data?*
- *If a conversation gets flagged, does it go somewhere else to be reviewed or labeled?*
- *When your support engineers debug a problem for us, what can they see?*

**What we found:**

Because Meridian uses no commercial AI supplier, no outside staff, contractors or annotators ever see its prompts, outputs or logs — the usual concern in this area simply does not arise. The gap runs the other way: the only people in the loop are Meridian's own customer-service agents in twelve countries, who read RouteHelp's answers and act on them with no way to tell a correct answer from a quietly altered one. There is no verification step, no record of what changed in the weekly update, and no signal shown to the agent, so an altered or poisoned answer would look exactly as authoritative as a correct one. Any single upstream change reaches all twelve countries at once, with no case-by-case review to interrupt it.

> **RATING: MEDIUM**, No outsiders are reading Meridian's data, but no one inside Meridian is in a position to catch a bad answer either.

*Technical cross-reference: dimension 5.1 (Human review processes), Position Required (PR), Vendor Notice Posture (U) in the technical rubric. CASE vector `SOV:1.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:P/CR:M/IR:H/AR:M/S:N/AU:Y/R:A/V:D/RE:M/U:Red`, score 5.8 (Medium).*

### 6. Who's holding the steering wheel?

Somewhere, someone configures this thing: turns features on and off, sets filters, manages who has access, holds the keys. That control panel is itself a dependency, and it doesn't always sit where you'd expect.

**Ask the vendor:**

- *Where does the screen we'd use to configure or turn off this AI feature actually live?*
- *Is our employee login system, or our credentials to other systems, now tied into a system this vendor controls?*
- *Can settings change on us without anyone telling us?*

**What we found:**

The control plane is reassuringly Meridian's own — the build system and cloud console sit in its own account with no outside administrator. What undermines that is Meridian's own written practice for the pipeline: dependencies identified by version label only, an automatic weekly download, and no approval gate before anything reaches production. That configuration is precisely what converts a stranger's decision into a Meridian production change that nobody at the company authorised or recorded. Reusing a version label is enough to satisfy the current check, so an outside publisher does not need to defeat any safeguard; the policy lets the change through by design.

> **RATING: HIGH**, Meridian holds the steering wheel, but its own change-control policy hands the wheel to an outside publisher once a week.

*Technical cross-reference: dimensions 6.4 (Configuration and policy management), 6.1 (Centralized control plane / admin console), Org Action Required (UI), Position Required (PR), Primary Dependency Impact -- Integrity (VI) in the technical rubric. CASE vector `SOV:1.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:M/IR:H/AR:M/S:N/AU:Y/R:U/V:C/RE:L/U:Red`, score 7.9 (High).*

### 7. How many companies are really in this chain: and did we agree to it?

Add it all up. This is the question that actually matters most, and it's the one almost no vendor security review asks directly: how many companies now sit between us and our own data, and which of those did we ever actually agree to?

**Ask the vendor:**

- *List every company standing between us and the raw computer running this AI. How long is that list, really?*
- *Did we ever affirmatively choose to adopt AI here, or did it just arrive?*

**What we found:**

This is the headline finding. Meridian adopted an entirely self-built stack specifically to avoid supplier exposure, and in that narrow aim it succeeded: there is no commercial AI vendor, no subcontractor chain and no agreement Meridian did not read. The exposure has simply moved to the open-source supply chain. The embedding model comes from a public model hub and the tokenizer and orchestration framework from a public package registry, all identified by version label rather than cryptographic fingerprint, downloaded automatically every week and promoted to production without anyone reading the change notes. Anyone able to publish under those names — including by taking over an abandoned name or a maintainer's account — can place code inside Meridian's pipeline that runs with access to the support knowledge base and 40 million customer shipment records and whose answers go straight to agents in twelve countries. This pattern has repeatedly caused real incidents, and Meridian has no inventory of what these components are, no record of where they came from, and no counterparty obliged to warn it.

> **RATING: HIGH**, Meridian removed the commercial suppliers from the chain but not the strangers, and it currently has no list of who they are.

*Technical cross-reference: dimensions 7.4 (Open source components in the pipeline), 7.3 (Infrastructure providers beneath the AI vendor), Trigger Conditions (AT), Position Required (PR), Primary Dependency Impact -- Integrity (VI) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:M/IR:H/AR:M/S:P/AU:Y/R:A/V:D/RE:L/U:Red`, score 8.3 (High).*

## The Rollup

Put side by side, here is what one pass through all seven categories produced for RouteHelp (internally built assistant from open-source components):

| Category | Rating | Carried by |
|---|---|---|
| 1. Whose AI brain is this, really? | **HIGH** | 1.3 Model update / versioning control |
| 2. What are we feeding it? | **HIGH** | 2.2 Internal documents ingested for RAG |
| 3. What does it create from our data: and where does THAT go? | **HIGH** | 3.2 Vector database / embedding store location and control |
| 4. Who's deciding what the AI sees and does? | **HIGH** | 4.2 Orchestration / agent framework |
| 5. Which humans are actually looking at our stuff? | **MEDIUM** | 5.1 Human review processes |
| 6. Who's holding the steering wheel? | **HIGH** | 6.4 Configuration and policy management |
| 7. How many companies are really in this chain: and did we agree to it? | **HIGH** ◆ | 7.4 Open source components in the pipeline |

◆ Headline finding: category 7, dimension 7.4 (Open source components in the pipeline), CASE score 8.3 High [portable (R:A); diffuse (V:D); regulatory consequence (S:P); silent/automatic trigger (AU:Y); no vendor notice (U:Red)].

## What Meridian Logistics Group Should Actually Do Next

- Meridian should immediately stop the automatic weekly promotion of new model, tokenizer and package versions into production and require a named person to approve each change, as an interim measure while the controls below are built.
- Meridian should pin every dependency — model files, tokenizer, orchestration framework and all transitive packages — by cryptographic fingerprint rather than version label alone, and configure the pipeline to refuse to load any artefact whose fingerprint does not match (AI artefact verification).
- Meridian should require and enforce signature checking for AI software, frameworks and model files, so that unsigned or post-signing-modified artefacts simply cannot execute in the RouteHelp environment (code signing).
- Meridian should compile an AI Bill of Materials for RouteHelp listing every component, its publisher, its origin and the provenance of the ingested knowledge base and shipment data, so that it can answer who is in the chain and respond quickly when a component is reported compromised.
- Meridian should isolate the RouteHelp components from the data they do not need, mediating access to the vector database and the shipment records through authenticated interfaces and running the model and orchestration code in a contained environment with restricted filesystem and network access, so that one tampered package cannot read 40 million records.
- Meridian should restrict and monitor write access to the vector store, model artefact store and configuration files, so that tampering with what RouteHelp retrieves leaves a trace and requires privilege that an outside publisher does not have.
- Meridian should log RouteHelp's inputs, outputs, retrieved sources and every artefact change with its fingerprint, and review those logs for unexplained shifts in behaviour, since there is no supplier who will ever notify the company of a change.
- Meridian should establish a documented model-card and package-change review step before production, and give customer-service agents in all twelve countries a defined route to flag and escalate answers that look wrong, together with guidance not to over-rely on RouteHelp output.
- Meridian should confirm with its data-protection function that the ingestion of 40 million customer shipment records into an AI retrieval pipeline is covered by a current data-protection impact assessment, and that breach-notification procedures explicitly cover exposure of this corpus.

## Running This Yourself

The seven questions above don't change from vendor to vendor, only the answers do. Any time your organization is told (or, more often, not told) that a piece of already-approved software just grew an AI feature, work through the same seven categories, in the same order, and rate what you find on the same three-colour scale. The scenario in this document exists to show you what that looks like done once, start to finish, the method itself travels.