Demystifying Supply Chain Risk Assessment
Regulation / Standard |
Requirement Relevant SoT Categories / Factors |
Key Risk Measure Examples |
OMG / DTC Linkage |
EU AI Act Article 10 |
Data governance, training data quality, and provenance for high-risk AI |
RC-307: Digital Service Specific Security Risks / RF- 908 & RF-909: Data Protection, RC-695: AI Model Integrity / RF-1344: AI Model Poisoning
Is training data encrypted at rest and in transit? Are data provenance records maintained? Are datasets sourced from unverified third parties? Does supplier cryptographically hash training data?
|
DTC Data Quality: SoT provenance questions operationalize DTC data integrity assertions for AIenabled digital twins. |
EU AI Act Article 15
Accuracy, robustness, and cybersecurity throughout AI system lifecycle
RC-698: AI Governance and Compliance Risks / RF-1353, RF-1354 & RF-1355 AI Governance, Risk Assessment and Compliance, RC-696: AI Infrastructure Security Risks & RC-16: Security Training Deficiencies
Are vulnerability assessments conducted regularly? Does provider implement secure coding practices? Are security patches deployed within defined SLAs? Is guardrail integrity verified for AI components?
OMG SysML v2: Encode RF- 1353, RF-1355, RF-1355 Risk measures as formal system requirements traceable to AI component specifications.
EU AI Act Articles 9 & 25( Omnibus: backstop Dec 2027 / Aug 2028)
AI risk management and conformity assessment obligations
RC-698: AI Governance & Compliance RF-1355: Non- Compliance with AI Regulations & RF-1354: Insufficient AI Risk Assessment
Does supplier lack conformity assessments for high-risk systems? Are AI systems classified by regulatory risk tier? Is continuous risk monitoring in place? Have emergent-behavior risks been assessed?
DTC Intelligence capability: RC-698 assessments validate governance foundations for AI-driven supply chain decision systems.
ESPR Article 7 |
Digital Product Passport traceability for softwareembedded products |
RC-8: Supply Hygiene / RC- 527: Software Pedigree / RF- 741 & RC-251: Software Provenance / RF-312 Geopolitical concerns regarding software pedigree / provenance.
Does an up-to-date SBOM / AI-BOM exist? Does software contain code from countries of concern?
|
OMG SPDX 3.0 standard: SoT supply domain data risk questions look for SBOMstructured DPP information. AI-BOM defined in AI and Dataset Profiles of OMG SPDX 3.0 standard. |
ESPR Articles 5 & 40
Durability, repairability, recyclability, and supply chain actor verification
RC-675: Supply Availability RF-1265: Limited Availability of alternative subcomponents / raw materials; RC-678: Supply Material Sourcing Risks; RC-20: Supplier Quality Culture / RF-1235: Supplier lacks a mature quality management systen
What is expected product lifetime? Are spare parts available for minimum 7 years? Can product be disassembled for repair? Does supplier maintain ISO 9001 certification? Can supplier verify sub-tier supplier data?
DTC Connectivity & Modeling: Product lifecycle digital twins aggregate RC- 675, RC-678, and RC-20 data streams for ESPR circularity metrics.
EDM Association – Journal of Innovation 87