Manufacturing & Supply Chain
Supplier Master Data & ESG Risk Screening
Minimal RiskUnverifiedDiscuss / dispute
Normalisation of BOM and supplier master data across plants, supplier risk scoring, and screening against ESG, labour, sanctions and customs criteria.
Classification rationale: Minimal-risk AI, but the output is the evidence base for CSDDD due-diligence obligations — so the assessment trail, source freshness and remediation follow-up carry the legal weight. Where screening affects individual persons at a supplier (sanctions hits, adverse media), GDPR and fair-processing duties attach to that path.
Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.
pricingPer screened supplier / per resolved risk case
oversightProcurement owner decision on supplier status changes
Compliance brief
This use case is minimal-risk under the EU AI Act (Minimal Risk); no product-specific obligations beyond general AI literacy apply.
What is owed
- Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.
- GDPR Art. 22. Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.
- GDPR Art. 17. Right to erasure collides with AI Act Art.
- GDPR Art. 25. Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.
- GDPR Art. 35. Data-protection impact assessment for high-risk processing — pairs with AI Act fundamental-rights impact assessment (Art.
Dates that bind
- 2026-08-02 — General applicability + Art. 50. Transparency obligations for chatbots, deepfakes and synthetic content; EU-level enforcement begins.
- 2026-12-02 — Additional prohibitions. Additional bans (deepfake CSAM et al.) and transition period for synthetic content under Art. 50(2).
Maximum exposure
- EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
- CSDDD (Corporate Sustainability Due Diligence): Turnover-based penalties (min. 5% of worldwide net turnover ceiling) plus civil liability.
- GDPR: Up to €20m or 4% of worldwide annual turnover
First five actions
- Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
- Commission and confirm the Art. 4, GDPR Art. 22, GDPR Art. 17 obligations named above as active workstreams with an accountable owner.
- Stand up the named oversight design — Mode 3 — with a documented human-review procedure.
- Produce the technical documentation and evidence artefacts already mapped to this use case (HITL Escalation Queue & Review UI, Bitemporal Memory (GDPR×Art.12), PII Scrubbing / DLP-NER Layer) before they are requested.
- Put 2026-08-02 — General applicability + Art. 50 — into the compliance calendar with an owner and lead time.
Terms used above: · · ·
Applicable Regulations (3)
EU AI Act (Regulation (EU) 2024/1689)
unverified · no verification date source EUR-Lex
Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Annex III → 2 Dec 2027, Annex I → 2 Aug 2028).
Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
CSDDD (Corporate Sustainability Due Diligence) (Directive (EU) 2024/1760)
unverified · no verification date source EUR-Lex
Risk-based human-rights and environmental due diligence across the chain of activities: supplier screening, remediation and documented assessment cycles.
Sanctions: Turnover-based penalties (min. 5% of worldwide net turnover ceiling) plus civil liability.
GDPR (Regulation (EU) 2016/679)
unverified · no verification date source EUR-Lex
Applies unchanged next to the AI Act for all personal data in training, fine-tuning, RAG and inference. Key friction points: Art. 22 automated decisions, Art. 17 erasure vs. AI Act logging, Art. 35 DPIA.
Sanctions: Up to €20m or 4% of worldwide annual turnover
Legal Obligations (5)
Art. 4 — AI Literacy
Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.
unverified · no verification date read the article artificialintelligenceact.eu
GDPR Art. 22 — Automated Decisions
Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.
unverified · no verification date read the article EUR-Lex
GDPR Art. 17 — Erasure
Right to erasure collides with AI Act Art. 12 immutable logging — resolved architecturally via bitemporal data modelling + physical partition scrub.
unverified · no verification date read the article EUR-Lex
GDPR Art. 25 — Data Protection by Design
Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.
unverified · no verification date read the article EUR-Lex
GDPR Art. 35 — DPIA
Data-protection impact assessment for high-risk processing — pairs with AI Act fundamental-rights impact assessment (Art. 27) for public-facing high-risk systems.
unverified · no verification date read the article EUR-Lex
Control Objectives (0)
obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact
Art. 4
control layer: community mandate — propose objectives
GDPR Art. 22
control layer: community mandate — propose objectives
GDPR Art. 17
control layer: community mandate — propose objectives
GDPR Art. 25
control layer: community mandate — propose objectives
GDPR Art. 35
control layer: community mandate — propose objectives
Take this into your GRC tooling
A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.
Standards & Evidence
ISO/IEC 42005 (AI Impact Assessment)
Guidance for AI system impact assessments — supports DPIA/FRIA-style analyses.
unverified · no verification date publisher ISO
evidence for: GDPR Art. 35
IEEE CertifAIEd™
Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.
unverified · no verification date
evidence for: EU AI Act
Architecture Blueprint
Agentic RDA Stack (6 Layers)
Regulatory Design & Architecture framework for agentic systems: (1) isolated ephemeral execution (gVisor/Firecracker, read-only root, egress allowlists) → (2) agentic zero-trust identity (per-agent ID, short-lived OBO OAuth 2.1 tokens) → (3) MCP gateway with default-deny ACLs & credential vault → (4) reasoning + guardrail interception (prompt shields, sidecar alignment checks) → (5) human-oversight & durable state persistence (propose-action objects, checkpoint store) → (6) continuous observability & signed audit logs (≥ 6 months, SIEM).
Mode 3 — Human-on-the-Loop
Autonomous execution with aggregate oversight: dashboards, sampling audits (5–10%), real-time veto. For high-volume, low-individual-impact steps.
Required Technical Components (23)
HITL Escalation Queue & Review UI
HITL escalation queue & review UI ('Human-as-a-Tool': the agent calls the human like any other tool via propose-action objects). Confidence- and risk-threshold routing, SLA timers, structured accept/modify/reject verdicts with digital reviewer signature at gate release — each verdict is itself Art. 14 evidence and feeds the active-learning loop.
from: GDPR Art. 22
Bitemporal Memory (GDPR×Art.12)
valid_from/valid_to + transaction time on every record: GDPR erasure removes data from the active retrieval path while the HMAC-chained immutable log survives for Art. 12 / PLD defence; tenant-scoped partitions allow physical scrub of PII.
from: GDPR Art. 17
PII Scrubbing / DLP-NER Layer
Automated detection, pseudonymisation and blocking of personal data in inputs, retrievals and outputs.
from: GDPR Art. 25
Per-Tenant Retrieval Segmentation
Retrieval is scoped by tenant and by caller entitlement at query time, preventing cross-client and cross-role leakage through shared indexes.
from: GDPR Art. 25
Segmented Vector Store (RBAC + CMEK)
Vector indexes, embeddings and document stores are logically and physically partitioned per client, with role-based access and customer-managed encryption keys.
from: GDPR Art. 25
Live Risk Register / Posture Management
Continuously updated risk register wired to runtime posture: threat-model deltas, open defects, control status, exposure per system. Includes Shadow-AI discovery — continuous scanning for unsanctioned agents, MCP servers and AI API usage outside the register; an unregistered agent is an unmanaged Art. 12/26 liability and the empirical driver of proportionate (not blanket) controls.
from: GDPR Art. 35 · CSDDD (Corporate Sustainability Due Diligence)
Ephemeral Execution Isolation
gVisor/Firecracker microVMs, read-only root, egress allowlists; container discarded after each task to prevent persistence of exploits.
from: Agentic RDA Stack (6 Layers)
Agentic Zero Trust
Unique cryptographic identity per agent; short-lived, finely-scoped tokens (OAuth 2.1 + PKCE); On-Behalf-Of flow so an agent can never see more than its triggering user.
from: Agentic RDA Stack (6 Layers)
MCP Gateway / Proxy
Central chokepoint for agent tool traffic: default-deny tool ACLs (tools/list vs tools/call), schema & argument inspection, credential injection from vault, rate limits, full audit mirror. Regulatory root cause: the base MCP protocol enforces no authentication or authorization at protocol level — Host/Client/Server topology with Tools/Resources/Prompts primitives ships without an identity layer, so a policy-enforcing gateway is not optional hardening but the only place Art. 12/15 duties can be enforced for tool calls.
from: Agentic RDA Stack (6 Layers)
Guardrail Sidecar / Interception
Rule-based (NeMo/Colang), model-based (alignment checkers) and structural validators deployed as sidecar or gateway plugin (<50 ms), decoupling safety scaling from inference scaling.
from: Agentic RDA Stack (6 Layers)
Propose-Action Objects
Agents never call target APIs directly: they emit typed proposal objects (endpoint, params, risk estimate, rationale) validated by the governance layer before execution; idempotent execution layer.
from: Agentic RDA Stack (6 Layers)
Durable Checkpointing (Pause & Resume)
At oversight gates the complete operational state — working memory, conversation history, tool arguments, intermediate artifacts — is serialized into a durable checkpoint (fast KV store for sub-ms lookups, transactional backend as recovery anchor, vector store for semantic caching of past human decisions). On approval the agent deserializes and resumes at the exact step; matched precedents can shortcut re-planning entirely.
from: Agentic RDA Stack (6 Layers)
Per-Action Autonomy Tiering
Tools tagged read-only / reversible-write / irreversible-write; controls layer routes each action to the matching oversight mode. Mode selection is per action type, never per agent.
from: Agentic RDA Stack (6 Layers)
Agent Identity & Access (IdP)
Per-agent identities, short-lived scoped tokens, OBO flow enforcement — the identity substrate of agentic zero trust.
from: Agentic RDA Stack (6 Layers)
Central Credential Vault
Agents never hold target-system keys; the gateway injects centrally managed credentials after policy checks.
from: Agentic RDA Stack (6 Layers)
OpenTelemetry / FCoT Tracing
Hierarchical trace spans for every sub-task, prompt, retrieved document and API call — the reconstructible decision path for Art. 12/14 and PLD disclosure.
from: Agentic RDA Stack (6 Layers)
WORM / Immutable Audit Vault
Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.
from: Agentic RDA Stack (6 Layers)
Watchdog Supervisor & Rate Limiting
Cost/iteration caps, loop detection, anomaly-triggered mandatory approval (CodeBuddy 'suspicious command override').
from: Agentic RDA Stack (6 Layers)
Trinity Defense (TCB + Command Gates + IFC)
Treats the LLM as an untrusted proposal engine behind a hardened non-LLM Trusted Computing Base. Three pillars: (1) command gates — actions only via a Finite Action Calculus, authorized by a deterministic policy checker before any execution; (2) information-flow control — lattice labels stop confidential data flowing to low-trust sinks without audited declassification; (3) privilege separation — sandboxed low-privilege planner ingests untrusted input, isolated high-privilege worker executes only gate-approved, TCB-normalized actions. Grounded in the impossibility result: token content alone can never unforgeably separate commands from data.
from: Agentic RDA Stack (6 Layers)
Guardian Agents (Runtime Policy Enforcement)
Autonomous supervisory agents outside the supervised agent's reasoning loop: stateful threat engines with graph-based cross-session history (catch multi-turn injection, gradual exfiltration, incremental privilege escalation), event-driven exposure visibility (permission drift, new connectors), and contextual risk correlation into unified issues — interception before execution, not post-hoc logging.
from: Agentic RDA Stack (6 Layers)
Deterministic Policy Engine (OPA / Cedar)
Policy-as-code decision point (PDP) with enforcement points (PEP) in front of every tool call: versioned policies in Git, microsecond evaluation, typed action schemas — authorization decided outside the model's reasoning space, never in the prompt.
from: Agentic RDA Stack (6 Layers)
Shadow-Mode Execution
Run governance controls in observe-and-score mode before enforcement: the policy engine and guardrails evaluate every agent action and log verdicts without blocking, yielding empirical false-positive/negative rates and calibrated thresholds. De-risks the enforcement cutover, produces baseline evidence for Art. 9 risk estimation, and is the standard migration path when retrofitting controls onto a live workflow.
from: Agentic RDA Stack (6 Layers)
Multi-Model Router & Fallback Abstraction
Abstraction layer decoupling application logic from model providers: dynamic routing on capability, cost, latency SLA and regulatory constraint (sensitive-data classes pinned to ZDR private/VPC endpoints or on-prem open-weight instances); real-time health monitoring with automatic fallback to secondary endpoints or local fine-tuned models on outage/latency spikes. Discharges resilience duties (DORA-class), prevents provider lock-in, and makes model deprecations a routing-table change instead of a re-architecture. Router decisions are logged into the decision trace — model version per event is an audit-packet field.
from: Agentic RDA Stack (6 Layers)
Delivery Stack & Pipeline Stage (5)
Service-as-a-Software delivery: the engines, patterns and artifacts this workflow needs on top of the generic obligations. See the full pipeline
Master-Data & Supplier Risk Engine
Normalises BOM and supplier master data, scores supplier risk, and keeps the assessment trail required for due-diligence reporting.
Data Lineage & Versioning
Provenance tracking of datasets, features and embeddings; write-time attribution (source, actor, timestamp, confidence).
Live Risk Register / Posture Management
Continuously updated risk register wired to runtime posture: threat-model deltas, open defects, control status, exposure per system. Includes Shadow-AI discovery — continuous scanning for unsanctioned agents, MCP servers and AI API usage outside the register; an unregistered agent is an unmanaged Art. 12/26 liability and the empirical driver of proportionate (not blanket) controls.
Human-on-the-Loop Statistical Sampling
For lower-risk batch workflows, agents execute autonomously while auditors review a statistically representative random sample per batch to track accuracy, error classes and drift.
Active-Learning Feedback Loop
Human corrections at oversight gates are serialized as structured data — original context, model proposal, human edit, rationale — and fed into fine-tuning pipelines and prompt registries, systematically reducing future escalation rates instead of dying in review UIs.
Required artifacts
Build or Buy — Vendor Layer (4)
The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.
Agent Orchestration & SDLC Toolkits
Developer middleware for multi-agent networks, tool-use chains, RAG abstraction, state/memory persistence and model routing. Exemplary (community-maintained): LangChain, LlamaIndex, AutoGen, CrewAI; MCP-based tool ecosystems. Regulatory posture: orchestration code is where autonomy tiering, propose-action objects and fallback routing get implemented — the framework choice constrains which controls are cheap and which are retrofits.
unverified · verified 2026-08-06 community-maintained
selection metrics: broad model-API abstraction, state/memory management, error recovery, fallback routing hooks
supplies: HITL Escalation Queue & Review UI · Multi-Model Router & Fallback Abstraction
AI GRC & Governance Platforms
Second-line systems of record: model/agent inventory incl. third-party SaaS AI, automated risk tiering, policy administration, cross-framework mapping & control deduplication, audit-evidence generation, intake workflows. Exemplary (community-maintained): ModelOp Center, Credo AI, IBM watsonx.governance, OneTrust, Holistic AI, Modulos (governance graph), Monitaur (insurance/lending), Fairly AI, Saidot, Trustible, Enzai, LatticeFlow (technical validation), Vanta (evidence automation), ServiceNow (intake/ITSM); data-catalog adjacency: Collibra, Alation, Informatica. Selection metrics: see meta.marketLandscape.selectionMetrics.grc.
unverified · verified 2026-08-06 community-maintained
selection metrics: multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication
supplies: Live Risk Register / Posture Management
Runtime Security & Guardrail Vendors
First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection & exfiltration defense, PII masking, grounding checks, SecOps routing. Exemplary (community-maintained): Prompt Security, HiddenLayer (MLSDR), Palo Alto AI Runtime Security, AWS Bedrock Guardrails, NVIDIA NeMo Guardrails, Guardrails AI, Robust Intelligence, LLM Guard / Llama Guard OSS class. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM.
unverified · verified 2026-08-06 community-maintained
selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM
supplies: MCP Gateway / Proxy · Guardrail Sidecar / Interception
Regulated Foundation-Model Platforms
Frontier commercial APIs and open-weight models under enterprise controls: zero-data-retention tiers, data isolation, fine-tuning governance, safety alignment documentation, EU-sovereign options. Exemplary (community-maintained): Anthropic Claude (ZDR enterprise tier), OpenAI GPT enterprise, Google Gemini Enterprise, Cohere (private-cloud RAG), Mistral (EU/self-hosted), Meta Llama (open-weight sovereignty). GPAI-chapter duties and vendor due diligence attach at this layer.
unverified · verified 2026-08-06 community-maintained
selection metrics: ZDR enterprise tiers, data isolation, EU-sovereign options, fine-tuning controls, safety alignment documentation
supplies: Multi-Model Router & Fallback Abstraction
Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.
Outsourced delivery BPO · SaaS · Service-as-a-Software caveats
Delivery Model — BPO · SaaS · Service-as-a-Software
Spectrum
BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk
SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk
Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk
Caveats in regulated markets
— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.
— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.
— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).
— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.
Threat Profile
Supplier Master-Data Degradation
Stale or unreconciled supplier and BOM records make risk scores and due-diligence conclusions unreliable.
mitigate with: Data Lineage & Versioning, Live Risk Register / Posture Management
LLM09 Misinformation
Hallucinated or wrong outputs create liability and decision risk.
mitigate with: Output Rails / Groundedness Check, Explainability API (SHAP/LIME/CoT)