Companion to the AI Sovereignty Risk Assessment Framework · CASE assessment 79c54e9c-9ff2-44ae-b9f3-2238caaf7cc1 # Is There a Hidden AI Supply Chain in Your Vendor? *A plain-language walkthrough for GRC and compliance auditors, no technical background required* **Organization:** Brightwater Consumer Brands **Vendor / dependency assessed:** Orbit CRM (Orbit Insights AI feature) **Industry:** Fortune 500 enterprise *Generated by the CASE assessment pipeline on 2026-10-28. Metric values were assigned by retrieval-grounded agents and scored deterministically; they have not been reviewed by a human expert.* ## Before You Start This is not a technical document. It answers one practical question a compliance auditor is increasingly asked: “We use a lot of software. Some of it quietly grew an AI feature. What do we actually need to worry about, and how bad is it?” It walks through one vendor from start to finish using the same seven questions every time. A small italicised note under each section (“Technical cross-reference”) points back to the technical rubric for anyone who wants to trace a rating to the formal scoring model; you can ignore those notes and still get full value. ### The Rating Scale, In Plain English | Rating | Meaning | |---|---| | **RATING: LOW** | Normal and contained. If something went wrong here, you'd find out quickly and fix it without much trouble. | | **RATING: MEDIUM** | Could cause a real problem, and you might not find out right away, worth tracking, not yet an emergency. | | **RATING: HIGH** | Could cause serious damage, a data leak, a regulatory violation, or losing the ability to operate, and by the time you noticed, it might already be too late to undo. | ## The Scenario > Brightwater Consumer Brands, a Fortune 500 manufacturer, has used Orbit CRM, a leading SaaS customer-relationship-management platform, for eight years under a global enterprise agreement. In a routine quarterly release Orbit enabled Orbit Insights, an AI feature that summarises customer email threads and call notes and suggests next actions. It was on by default for all users. > > The summaries are generated by a third-party foundation-model provider that appeared in an updated subprocessor list published on Orbit's trust site the same day the release shipped. Brightwater's AI governance process, which requires a review before any AI service is adopted, never triggered because no one in the organisation adopted anything. Customer records in the CRM include contract terms, pricing and personal contact details for customers in forty countries. The feature can be disabled per tenant by an administrator, but Brightwater discovered it only when a sales manager asked why summaries were appearing. Orbit's terms allow feature changes at its discretion with notice at the time of release. ## Walking Through It, Category by Category ### 1. Whose AI brain is this, really? Every AI feature is powered by some underlying model, hosted somewhere, controlled by someone. That someone is very often not the software vendor you actually have a contract with. **Ask the vendor:** - *Whose AI model is actually answering our questions, yours, or one you're renting from someone else?* - *If we stopped paying you tomorrow, could we take this AI capability somewhere else, or does it just disappear?* - *Can the AI's behavior change overnight without you telling us?* **What we found:** The artificial intelligence behind Orbit Insights is not Orbit's own: the summaries are produced by a third-party foundation-model provider that Brightwater Consumer Brands has never contracted with, never reviewed and whose processing location it still cannot identify, even though the customer records involved cover people in forty countries. Orbit's contract lets it change features and the underlying model whenever it chooses, with notice only at the moment a change goes live, and Orbit confirms it does not tell customers about these changes in advance. Brightwater has no right to stay on a tested version, no advance notice, no change log and no way to test a new model before it reaches staff. The quarterly release proved the point: the model provider appeared on Orbit's subprocessor list the same day the feature switched on, and Brightwater found out only because a sales manager asked why summaries had started appearing. > **RATING: HIGH**, Orbit and its model provider can change how the AI behaves at any time without telling Brightwater first, so any assurance you obtain today describes a system that may be different tomorrow. *Technical cross-reference: dimensions 1.3 (Model update / versioning control), 1.1 (Model hosting location / jurisdiction), 1.2 (Model weight custody / control), Org Action Required (UI), Trigger Conditions (AT), Primary Dependency Impact -- Integrity (VI), Silent/Automatic Trigger (AU) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:L/E:A/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:D/RE:M/U:Red`, score 8.2 (High).* ### 2. What are we feeding it? Once an AI feature exists, the next question is simple: what of ours does it actually see? Employee inputs, uploaded reference material, and anything the AI can reach and act on all count. **Ask the vendor:** - *What do our employees actually type into this thing, and does it include customer or confidential information?* - *Did we upload or connect any of our own internal documents for it to search?* - *Can this AI take real actions, look things up, change things, or does it only talk?* **What we found:** What is being fed to the AI is not text that Brightwater staff chose to type in; it is existing CRM content assembled automatically by Orbit — customer email threads, call notes, contract terms, pricing and personal contact details for customers in forty countries. Brightwater never decided to send this material anywhere: the feature arrived switched on in a routine release and the platform began packaging records and transmitting them to the external model provider the same day that provider was added to the subprocessor list. There was no review of what would be sent, no opportunity to narrow the scope or redact sensitive fields, and no data protection impact assessment. Because the receiving party was never authorised in advance, the data flow by itself is a reportable data protection failure for Brightwater as the controller. > **RATING: MEDIUM**, Sensitive customer and commercial records left Brightwater's contracted boundary in bulk without anyone at Brightwater choosing, scoping or approving it, which is an independently reportable compliance breach. *Technical cross-reference: dimensions 2.2 (Internal documents ingested for RAG), 2.1 (Prompts / user inputs), Trigger Conditions (AT), Primary Dependency Impact -- Confidentiality (VC) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:P/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:C/RE:M/U:Amber`, score 6.7 (Medium).* ### 3. What does it create from our data: and where does THAT go? This is the part almost every vendor review misses entirely. AI systems don't just read your data, they transform it into new things: mathematical fingerprints of your documents, logs of every answer given, records of which answers got a thumbs-down. Those new things get stored somewhere, often by a company you've never heard of and never contracted with directly. **Ask the vendor:** - *Does this turn our documents into some kind of derived file (an “embedding”) so it can search them faster?* - *If so, who stores that derived file, you, or a completely different company?* - *Do you keep a copy of everything the AI said back to us, a log of how we used it, or a record of when we said the answer was wrong?* **What we found:** The feature creates new material from Brightwater's data: a written summary of each email thread and call note plus a suggested next action, saved back into the customer record. These summaries concentrate the most sensitive content — pricing, contract terms and named contact details — into a compact form, and they are produced by, and may be retained by, both Orbit and the external model provider. Nobody at Brightwater knows whether those summaries are kept for quality monitoring, for how long, who can read them or in which country they are stored, because the model provider was never assessed and no contract term covers retention of this output. The feature was on for every user, so this applies to every summary generated, not to a small sample. > **RATING: HIGH**, Brightwater cannot say where copies of AI-written summaries of its customer data are held, how long they persist or under whose laws, so it cannot answer a regulator's or customer's question about them. *Technical cross-reference: dimensions 3.3 (Model outputs / completions), 3.5 (Telemetry / usage logs), Org Action Required (UI), Trigger Conditions (AT), Primary Dependency Impact -- Confidentiality (VC) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:P/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:D/RE:M/U:Amber`, score 7.1 (High).* ### 4. Who's deciding what the AI sees and does? Between “the model” and “what we see” sits a set of decisions: which document gets pulled up, whether a filter blocks an answer, where an action actually executes. Each of those decisions can be made by yet another company. **Ask the vendor:** - *Who decides which of our documents actually get shown to the AI when it answers a question?* - *Who runs the safety filter that sees every question and answer, and can we see its rules?* - *If the AI takes an action on our behalf, where does that action actually happen, in your systems, ours, or a third location?* **What we found:** Orbit alone decides which customer records, email threads and call notes are pulled together and sent to the model for each summary, and Brightwater has no visibility into that selection at all. Orbit can change what is selected, how it is ranked, and which party in its chain performs that step, under the same contract clause that lets it change features at its discretion with notice only at release. Because the sales team reads the resulting summaries and suggested next actions as part of the customer record, a quiet change to what the pipeline includes — or quietly leaves out — would produce different, confident-looking conclusions with no signal to Brightwater and nothing to compare against. Brightwater also cannot bound what has already been sent, because it cannot see what the selection step chose. > **RATING: HIGH**, Brightwater can neither verify nor limit what customer information is handed to the AI, and would not detect a change that silently alters the advice its sales staff act on. *Technical cross-reference: dimensions 4.1 (Retrieval pipeline (RAG) ownership), 4.2 (Orchestration / agent framework), 4.4 (Guardrail / safety filter layer), Position Required (PR), Access Path (AV) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:P/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:D/RE:M/U:Amber`, score 7.9 (High).* ### 5. Which humans are actually looking at our stuff? Not every risk is a computer. Somewhere in most AI products, an actual person, often a contractor, often outsourced, reads flagged conversations or debugs a problem using our data. That's a direct human set of eyes, independent of every technical safeguard above. **Ask the vendor:** - *Does a real person at your company, or a contractor of yours, ever read our conversations or our data?* - *If a conversation gets flagged, does it go somewhere else to be reviewed or labeled?* - *When your support engineers debug a problem for us, what can they see?* **What we found:** Nothing in Orbit's disclosure tells Brightwater whether people — rather than only software — read its customer content once it reaches the model provider. Model providers commonly have staff sample prompts and outputs for quality, safety or abuse review, and because this provider was never assessed and no agreement rider was negotiated, Brightwater holds no commitment that no human sees its material, no limit on who may see it and no statement of where those reviewers are located. The content at risk is raw email threads and call notes containing named contact details, pricing and contract terms for customers in forty countries. This exposure is inferred from the absence of any disclosed policy rather than evidenced, but Brightwater currently has no basis on which to rule it out. > **RATING: MEDIUM**, Brightwater cannot tell a customer or regulator whether a stranger's staff have read their emails and call notes, because no one ever asked the question of the model provider. *Technical cross-reference: dimensions 5.1 (Human review processes), 5.3 (Support / debugging access), Position Required (PR), Vendor Notice Posture (U) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:P/CR:H/IR:M/AR:L/S:P/AU:N/R:U/V:D/RE:M/U:Red`, score 5.3 (Medium).* ### 6. Who's holding the steering wheel? Somewhere, someone configures this thing: turns features on and off, sets filters, manages who has access, holds the keys. That control panel is itself a dependency, and it doesn't always sit where you'd expect. **Ask the vendor:** - *Where does the screen we'd use to configure or turn off this AI feature actually live?* - *Is our employee login system, or our credentials to other systems, now tied into a system this vendor controls?* - *Can settings change on us without anyone telling us?* **What we found:** The decisive decision in this whole episode was a settings decision that Brightwater did not make: Orbit shipped Orbit Insights switched on for every user, and the only control Brightwater has is to switch it off per tenant after the fact. Brightwater's own rule — that no AI service may be used until it has passed a governance review — was effectively overridden, and the governance record now says no AI service was adopted while an AI service was live in production across the business. The administration console did not proactively surface the change, so Brightwater had no monitoring that would have caught it; discovery came from a sales manager's question. Orbit applied the same default to its whole customer base at once, with no case-by-case decision and no opportunity to object. > **RATING: HIGH**, Brightwater's AI governance policy can be overridden by a vendor release note, and its own compliance records will not show it happened. *Technical cross-reference: dimensions 6.4 (Configuration and policy management), 6.1 (Centralized control plane / admin console), Org Action Required (UI), Primary Dependency Impact -- Integrity (VI) in the technical rubric. CASE vector `SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:C/RE:M/U:Amber`, score 7.9 (High).* ### 7. How many companies are really in this chain: and did we agree to it? Add it all up. This is the question that actually matters most, and it's the one almost no vendor security review asks directly: how many companies now sit between us and our own data, and which of those did we ever actually agree to? **Ask the vendor:** - *List every company standing between us and the raw computer running this AI. How long is that list, really?* - *Did we ever affirmatively choose to adopt AI here, or did it just arrive?* **What we found:** This is the headline finding. Brightwater bought Orbit CRM eight years ago for reasons that had nothing to do with artificial intelligence, and Orbit has now inserted an AI feature and a new foundation-model provider into that relationship without Brightwater's agreement. The subprocessor list naming the model provider was published on the same day the feature went live, so the chain of companies handling Brightwater's customer data expanded with no prior authorisation and no opportunity to object. Brightwater's mandatory pre-adoption AI review never ran — not because it was bypassed, but because it is triggered by someone choosing to adopt AI, and nobody chose anything. The result is that customer email threads, call notes, pricing, contract terms and personal contact details for forty countries became readable to a company Brightwater never contracted with, continuously and for every user, until the exposure was found by accident. > **RATING: HIGH**, Brightwater's AI governance controls do not reach the largest AI exposure it currently has, because that exposure arrived inside a product it already owned. *Technical cross-reference: dimensions 7.2 (Third-party model providers embedded in a procured product (silent AI feature addition)), 7.1 (Downstream subprocessors), Org Action Required (UI), Trigger Conditions (AT) in the technical rubric. CASE vector `SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:A/CR:H/IR:M/AR:L/S:P/AU:Y/R:U/V:D/RE:M/U:Amber`, score 7.4 (High).* ## The Rollup Put side by side, here is what one pass through all seven categories produced for Orbit CRM (Orbit Insights AI feature): | Category | Rating | Carried by | |---|---|---| | 1. Whose AI brain is this, really? | **HIGH** | 1.3 Model update / versioning control | | 2. What are we feeding it? | **MEDIUM** | 2.2 Internal documents ingested for RAG | | 3. What does it create from our data: and where does THAT go? | **HIGH** | 3.3 Model outputs / completions | | 4. Who's deciding what the AI sees and does? | **HIGH** | 4.1 Retrieval pipeline (RAG) ownership | | 5. Which humans are actually looking at our stuff? | **MEDIUM** | 5.1 Human review processes | | 6. Who's holding the steering wheel? | **HIGH** | 6.4 Configuration and policy management | | 7. How many companies are really in this chain: and did we agree to it? | **HIGH** ◆ | 7.2 Third-party model providers embedded in a procured product (silent AI feature addition) | ◆ Headline finding: category 7, dimension 7.2 (Third-party model providers embedded in a procured product (silent AI feature addition)), CASE score 7.4 High [manual exit (R:U); diffuse (V:D); regulatory consequence (S:P); silent/automatic trigger (AU:Y); concurrent vendor notice (U:Amber)]. ## What Brightwater Consumer Brands Should Actually Do Next - Brightwater should decide immediately whether to disable Orbit Insights at the tenant level while the review it never got to perform is carried out, and record that decision and its rationale. - Brightwater should put a written demand to Orbit for the identity, processing locations and retention practices of the foundation-model provider, and for confirmation of whether any human at Orbit or that provider can read Brightwater content. - Brightwater should treat the undisclosed addition of a new processor to personal data for forty countries as a potentially reportable matter and have its data protection function assess notification obligations and complete the missing impact assessment without waiting for Orbit's answers. - Brightwater should serve notice under the enterprise agreement seeking contractual change: advance notice of sovereignty-relevant changes, the right to approve new subprocessors before processing begins, the right to stay on a tested model version, and explicit limits on retention of prompts and AI-generated summaries. - Brightwater should redefine the trigger for its AI governance review so it fires on vendor-initiated change — new or changed AI features, new subprocessors, new model providers — rather than only on a deliberate adoption decision by its own staff. - Brightwater should maintain a living inventory of the AI components, models and data flows inside every procured platform, so that a new model provider appearing in a vendor's chain is visible to the organisation rather than buried in a trust-site update. - Brightwater should require logging of AI feature usage, inputs and outputs that it can see and retain itself, together with monitoring that alerts on AI features switching on or on summary output appearing, so that the next change is detected by a control rather than by a sales manager's question. - Brightwater should put output controls in place for any AI feature it does keep — screening of what is sent as context for personal data, pricing and contract terms, and clear labelling of AI-generated text in the customer record — and define a short, documented test it runs against the feature whenever the vendor changes it. - Brightwater should run this same review across its other long-standing SaaS platforms, since any vendor with comparable discretionary-change terms can repeat exactly what Orbit did. ## Running This Yourself The seven questions above don't change from vendor to vendor, only the answers do. Any time your organization is told (or, more often, not told) that a piece of already-approved software just grew an AI feature, work through the same seven categories, in the same order, and rate what you find on the same three-colour scale. The scenario in this document exists to show you what that looks like done once, start to finish, the method itself travels.