Companion to the AI Sovereignty Risk Assessment Framework · CASE assessment 314a6973-a395-4aeb-bfd7-a021f77b86f2 # Is There a Hidden AI Supply Chain in Your Vendor? *A plain-language walkthrough for GRC and compliance auditors, no technical background required* **Organization:** Brightwater Consumer Brands **Vendor / dependency assessed:** Orbit CRM (Orbit Insights AI feature) **Industry:** Fortune 500 enterprise *Generated by the CASE assessment pipeline on 2026-10-28. Metric values were assigned by retrieval-grounded agents and scored deterministically; they have not been reviewed by a human expert.* ## Before You Start This is not a technical document. It answers one practical question a compliance auditor is increasingly asked: “We use a lot of software. Some of it quietly grew an AI feature. What do we actually need to worry about, and how bad is it?” It walks through one vendor from start to finish using the same seven questions every time. A small italicised note under each section (“Technical cross-reference”) points back to the technical rubric for anyone who wants to trace a rating to the formal scoring model; you can ignore those notes and still get full value. ### The Rating Scale, In Plain English | Rating | Meaning | |---|---| | **RATING: LOW** | Normal and contained. If something went wrong here, you'd find out quickly and fix it without much trouble. | | **RATING: MEDIUM** | Could cause a real problem, and you might not find out right away, worth tracking, not yet an emergency. | | **RATING: HIGH** | Could cause serious damage, a data leak, a regulatory violation, or losing the ability to operate, and by the time you noticed, it might already be too late to undo. | ## The Scenario > Brightwater Consumer Brands, a Fortune 500 manufacturer, has used Orbit CRM, a leading SaaS customer-relationship-management platform, for eight years under a global enterprise agreement. In a routine quarterly release Orbit enabled Orbit Insights, an AI feature that summarises customer email threads and call notes and suggests next actions. It was on by default for all users. > > The summaries are generated by a third-party foundation-model provider that appeared in an updated subprocessor list published on Orbit's trust site the same day the release shipped. Brightwater's AI governance process, which requires a review before any AI service is adopted, never triggered because no one in the organisation adopted anything. Customer records in the CRM include contract terms, pricing and personal contact details for customers in forty countries. The feature can be disabled per tenant by an administrator, but Brightwater discovered it only when a sales manager asked why summaries were appearing. Orbit's terms allow feature changes at its discretion with notice at the time of release. ## Walking Through It, Category by Category ### 1. Whose AI brain is this, really? Every AI feature is powered by some underlying model, hosted somewhere, controlled by someone. That someone is very often not the software vendor you actually have a contract with. **Ask the vendor:** - *Whose AI model is actually answering our questions, yours, or one you're renting from someone else?* - *If we stopped paying you tomorrow, could we take this AI capability somewhere else, or does it just disappear?* - *Can the AI's behavior change overnight without you telling us?* **What we found:** The summaries that now appear in Brightwater Consumer Brands' CRM are not produced by Orbit CRM itself but by a third-party foundation-model provider that Brightwater has never reviewed, contracted with or assessed. Because that provider was disclosed only through a subprocessor list published on Orbit's trust site on the day the release shipped, Brightwater cannot say in which country or under which legal system the summarisation actually happens. The material being sent there is regulated data: customer contract terms, pricing and personal contact details for customers in forty countries. Orbit's terms also allow it to change the feature, and therefore the model behind it, at its own discretion with notice only at the moment of release, so the provider could change again without Brightwater being told in advance. > **RATING: MEDIUM**, Brightwater cannot answer the most basic question an auditor or regulator will ask — where its customers' personal and contract data is processed and whose laws apply to it. *Technical cross-reference: dimensions 1.1 (Model hosting location / jurisdiction), 1.3 (Model update / versioning control), Trigger Conditions (AT), Primary Dependency Impact -- Confidentiality (VC) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:P/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:D/RE:L/U:Amber`, score 6.7 (Medium).* ### 2. What are we feeding it? Once an AI feature exists, the next question is simple: what of ours does it actually see? Employee inputs, uploaded reference material, and anything the AI can reach and act on all count. **Ask the vendor:** - *What do our employees actually type into this thing, and does it include customer or confidential information?* - *Did we upload or connect any of our own internal documents for it to search?* - *Can this AI take real actions, look things up, change things, or does it only talk?* **What we found:** What is being fed to the AI feature is not staff-typed questions but Brightwater's own system of record: customer email threads, call notes, contract terms, pricing and personal contact details already stored in Orbit CRM. Brightwater never selected this content for AI processing — Orbit began reading and transmitting it on Brightwater's behalf when the feature shipped on by default for all users. No terms covering how the model provider logs, retains or has people review that content have ever been reviewed by Brightwater, because Brightwater did not know the provider was involved. The scope is the whole record store for forty countries, not a sample or a pilot. > **RATING: MEDIUM**, Brightwater's most commercially sensitive and personal customer records have been flowing to an outside party under conditions nobody at Brightwater has read or approved. *Technical cross-reference: dimensions 2.2 (Internal documents ingested for RAG), 2.1 (Prompts / user inputs), Trigger Conditions (AT), Primary Dependency Impact -- Confidentiality (VC) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:P/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:D/RE:M/U:Amber`, score 6.3 (Medium).* ### 3. What does it create from our data: and where does THAT go? This is the part almost every vendor review misses entirely. AI systems don't just read your data, they transform it into new things: mathematical fingerprints of your documents, logs of every answer given, records of which answers got a thumbs-down. Those new things get stored somewhere, often by a company you've never heard of and never contracted with directly. **Ask the vendor:** - *Does this turn our documents into some kind of derived file (an “embedding”) so it can search them faster?* - *If so, who stores that derived file, you, or a completely different company?* - *Do you keep a copy of everything the AI said back to us, a log of how we used it, or a record of when we said the answer was wrong?* **What we found:** The feature produces thread summaries and suggested next actions that are shown to sales staff and written back into CRM records, where they become part of the customer file other staff rely on later. A summary of a pricing or contract conversation contains the sensitive substance of that conversation, so every summary carries regulated content to the outside model provider, and neither Orbit nor that provider has told Brightwater whether these outputs are kept for quality monitoring, for how long, or in which country. Brightwater has no way to detect it if the model behind the feature is changed and the summaries start being skewed, incomplete or simply wrong, because the vendor does not disclose such changes before they take effect. Staff are acting on these suggestions in front of customers with only partial review. > **RATING: HIGH**, AI-written content is already part of Brightwater's authoritative customer record and is being acted on commercially, with no assurance that it is accurate and no record of where copies of it are kept. *Technical cross-reference: dimensions 3.3 (Model outputs / completions), 3.6 (Cached / derived artifacts), Org Action Required (UI), Trigger Conditions (AT), Primary Dependency Impact -- Confidentiality (VC) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:P/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:D/RE:M/U:Amber`, score 7.9 (High).* ### 4. Who's deciding what the AI sees and does? Between “the model” and “what we see” sits a set of decisions: which document gets pulled up, whether a filter blocks an answer, where an action actually executes. Each of those decisions can be made by yet another company. **Ask the vendor:** - *Who decides which of our documents actually get shown to the AI when it answers a question?* - *Who runs the safety filter that sees every question and answer, and can we see its rules?* - *If the AI takes an action on our behalf, where does that action actually happen, in your systems, ours, or a third location?* **What we found:** Every step between Brightwater's CRM data and the AI model sits inside Orbit's own platform: Orbit decides which email threads and call notes are picked up, how they are bundled together, which model provider receives them, what filtering is applied, and how the suggestion is shown to the sales user. Brightwater has no visibility into any of those decisions and no ability to constrain them; the eight-year-old enterprise agreement predates AI features entirely and says nothing about them. Orbit can rewire any part of that chain at its discretion and is not obliged to tell Brightwater beforehand. That means Brightwater cannot state which customer records are selected for processing, nor evidence that the selection has not changed. > **RATING: HIGH**, Brightwater has no insight into, and no say over, how its customer data is gathered up and sent to an AI model — it must simply take the vendor's word. *Technical cross-reference: dimensions 4.2 (Orchestration / agent framework), 4.4 (Guardrail / safety filter layer), Access Path (AV), Compulsion Complexity (AC), Primary Dependency Impact -- Integrity (VI) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:D/RE:M/U:Amber`, score 7.1 (High).* ### 5. Which humans are actually looking at our stuff? Not every risk is a computer. Somewhere in most AI products, an actual person, often a contractor, often outsourced, reads flagged conversations or debugs a problem using our data. That's a direct human set of eyes, independent of every technical safeguard above. **Ask the vendor:** - *Does a real person at your company, or a contractor of yours, ever read our conversations or our data?* - *If a conversation gets flagged, does it go somewhere else to be reviewed or labeled?* - *When your support engineers debug a problem for us, what can they see?* **What we found:** The scenario does not tell us whether people read Orbit Insights content, and Brightwater cannot establish either way. The realistic exposure is routine support and troubleshooting: Orbit's support engineers, and now engineers at the foundation-model provider, can read the logs, traces and message content generated by a brand-new feature under a generic support-access clause in an eight-year-old contract that was never written with AI in mind. Those logs and traces carry contract terms, pricing and personal contact details for customers in forty countries. Nothing in the arrangement limits who may look, requires a documented reason, masks the data, or produces a record Brightwater can inspect afterwards. > **RATING: MEDIUM**, Named individuals at two companies — one of which Brightwater never contracted with — may be able to read customers' pricing and personal data in plain text, and Brightwater would have no record of it. *Technical cross-reference: dimensions 5.3 (Support / debugging access), 5.1 (Human review processes), Position Required (PR), Compulsion Complexity (AC), Primary Dependency Impact -- Confidentiality (VC) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:P/CR:H/IR:M/AR:L/S:P/AU:N/R:U/V:D/RE:M/U:Amber`, score 5.6 (Medium).* ### 6. Who's holding the steering wheel? Somewhere, someone configures this thing: turns features on and off, sets filters, manages who has access, holds the keys. That control panel is itself a dependency, and it doesn't always sit where you'd expect. **Ask the vendor:** - *Where does the screen we'd use to configure or turn off this AI feature actually live?* - *Is our employee login system, or our credentials to other systems, now tied into a system this vendor controls?* - *Can settings change on us without anyone telling us?* **What we found:** The event that caused all of this was a settings decision Brightwater did not make: Orbit shipped the feature switched on for every user in its tenant, in a routine quarterly release, with notice only at the moment it went live. The only control available to Brightwater is an administrator switch to turn the feature off, and Brightwater did not know that switch mattered until a sales manager asked why summaries were appearing. Brightwater's mandatory pre-adoption AI review never ran, because from Brightwater's side nothing was adopted. Orbit's terms let it make the same kind of change again, to this and every other customer at once, at any time. > **RATING: HIGH**, Brightwater cannot hold its own configuration and policy position against this vendor — the vendor can change what Brightwater's systems do, for everyone, without asking. *Technical cross-reference: dimensions 6.4 (Configuration and policy management), 6.1 (Centralized control plane / admin console), Org Action Required (UI), Primary Dependency Impact -- Integrity (VI) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L/E:A/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:C/RE:M/U:Amber`, score 7.9 (High).* ### 7. How many companies are really in this chain: and did we agree to it? Add it all up. This is the question that actually matters most, and it's the one almost no vendor security review asks directly: how many companies now sit between us and our own data, and which of those did we ever actually agree to? **Ask the vendor:** - *List every company standing between us and the raw computer running this AI. How long is that list, really?* - *Did we ever affirmatively choose to adopt AI here, or did it just arrive?* **What we found:** This is the central finding. Brightwater procured Orbit CRM eight years ago as a non-AI system, and an AI capability built on an unreviewed third-party model provider was added into it by the vendor, so Brightwater's AI governance gate never engaged and no review, impact assessment or data-transfer analysis was ever performed. Regulated personal, pricing and contract data for customers in forty countries became readable by a company Brightwater has no contract, data-processing agreement or transfer instrument with, and AI-generated content entered the CRM as fact. The chain beneath Orbit — the model provider and whatever infrastructure sits under it — was disclosed only by a trust-site list updated on release day and remains unreviewed. This was not a theoretical risk: it has already happened in Brightwater's own tenant, and the same change reached every Orbit customer simultaneously. > **RATING: HIGH**, Brightwater has become an AI deployer, and arguably in breach of its data-protection obligations, without a single decision or approval on its own side. *Technical cross-reference: dimensions 7.2 (Third-party model providers embedded in a procured product (silent AI feature addition)), 7.1 (Downstream subprocessors), Org Action Required (UI), Trigger Conditions (AT) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:A/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:C/RE:M/U:Amber`, score 8.2 (High).* ## The Rollup Put side by side, here is what one pass through all seven categories produced for Orbit CRM (Orbit Insights AI feature): | Category | Rating | Carried by | |---|---|---| | 1. Whose AI brain is this, really? | **MEDIUM** | 1.1 Model hosting location / jurisdiction | | 2. What are we feeding it? | **MEDIUM** | 2.2 Internal documents ingested for RAG | | 3. What does it create from our data: and where does THAT go? | **HIGH** | 3.3 Model outputs / completions | | 4. Who's deciding what the AI sees and does? | **HIGH** | 4.2 Orchestration / agent framework | | 5. Which humans are actually looking at our stuff? | **MEDIUM** | 5.3 Support / debugging access | | 6. Who's holding the steering wheel? | **HIGH** | 6.4 Configuration and policy management | | 7. How many companies are really in this chain: and did we agree to it? | **HIGH** ◆ | 7.2 Third-party model providers embedded in a procured product (silent AI feature addition) | ◆ Headline finding: category 7, dimension 7.2 (Third-party model providers embedded in a procured product (silent AI feature addition)), CASE score 8.2 High [manual exit (R:U); concentrated (V:C); regulatory consequence (S:P); silent/automatic trigger (AU:Y); concurrent vendor notice (U:Amber)]. ## What Brightwater Consumer Brands Should Actually Do Next - Brightwater should decide immediately whether to disable Orbit Insights at the tenant level while the position is assessed, and record that decision and its date as evidence of prompt action. - Brightwater should notify its privacy and legal functions now and assess reportability, given that regulated personal data for forty countries reached an undisclosed processor without prior authorisation, a documented transfer basis, a record of the processing activity or a data-protection impact assessment. - Brightwater should demand in writing from Orbit the identity and hosting jurisdiction of the foundation-model provider, the retention and human-review practices for all inputs and generated summaries, whether support staff can read this content, and the full subprocessor chain beneath the feature. - Brightwater should establish what content has already been sent and what AI-generated summaries and suggested actions now sit in its CRM, mark that content so staff can tell it apart from human-authored records, and require human verification before it is relied on for customer-facing or contractual decisions. - Brightwater should renegotiate the Orbit enterprise agreement to require advance notice and a right to object before any new AI feature, model provider, subprocessor or hosting change takes effect, with new AI capabilities defaulting to off, plus data-residency and support-access commitments and a flow-down data-processing agreement. - Brightwater should require that inputs and outputs be screened for personal data, pricing and contract terms before they leave its tenant and before generated content is written back into the CRM, and that this screening sits outside the vendor's AI pipeline where Brightwater can evidence it. - Brightwater should insist on access to logs showing what data the feature read, what it produced, which model version served each request and which personnel accessed that content, so that future changes are detectable rather than discovered by accident. - Brightwater should extend its AI governance process so it is triggered by vendor-side change — a standing review of subprocessor and trust-site notices across all major SaaS contracts — rather than only by an internal adoption decision, and then re-run that review across its other long-standing SaaS platforms for the same silent-feature exposure. ## Running This Yourself The seven questions above don't change from vendor to vendor, only the answers do. Any time your organization is told (or, more often, not told) that a piece of already-approved software just grew an AI feature, work through the same seven categories, in the same order, and rate what you find on the same three-colour scale. The scenario in this document exists to show you what that looks like done once, start to finish, the method itself travels.