AI supply chain

What it is for

An AI system is assembled from parts you did not build: model weights, fine-tuning adapters, datasets, Python packages, container images, MCP servers and plugins. S4 makes that list explicit and checkable, so you can answer “are we affected?” the day a component is found to be compromised.

What we look at

• Every model and adapter in use, its source, its licence and its file format, including formats that can run code when loaded.
• Datasets used for training, fine-tuning, evaluation and retrieval, with their origin.
• Packages, images and servers in the build and at run time, and how versions are pinned.
• Whether artefacts are signed, and whether anything checks the signatures.

Standards we use

NIST SP 800-218A adds AI-specific practices to the Secure Software Development Framework for model creators, system builders and buyers.^⁠[1] For the bill of materials we use CycloneDX, whose machine-learning BOM represents datasets, models and their configurations,^⁠[2] and whose version 1.7 adds a cryptography bill of materials;^⁠[3] or SPDX 3.0, which added AI and Dataset profiles.^⁠[4] For signing we follow CoSAI’s staged guide, which moves from basic digital signatures to provenance tracking and policy-based attestations.^⁠[5]

What you receive

A machine-readable AI/ML bill of materials, a signing and provenance plan you can roll out in stages, and scan results for the model files in use.