CISOs Cited AI Supply Chain Risks as Primary Concern
Security leaders now face mounting pressure to manage third-party dependencies under evolving EU regulatory frameworks.
Updated on Oct. 13, 2026 in Artificial Intelligence
Live Poll
Do you trust that companies effectively manage the security risks of the AI tools they use?
A new survey from IG&H reveals that 75% of security leaders view AI as a top operational concern, with half specifically pointing to third-party supply chain exposure. These findings underscore the industry's shift toward continuous risk management to meet emerging accountability mandates.
Why it matters
Traditional annual supplier reviews are failing to keep pace with the rapid evolution of AI-related risk profiles. Organizations must now adopt continuous oversight to satisfy transparency requirements under the EU AI Act and Digital Operational Resilience Act.
Beyond supply chain concerns, 55% of surveyed security leaders expressed apprehension regarding their reliance on hyperscalers located outside the European Union. This uncertainty persists despite existing EU AI Act provisions aimed at mandating governance and transparency.
The players
IG&H
A consulting firm focused on digital transformation and operational strategy.
The details
Organizations are moving away from once-a-year supplier audits toward a continuous monitoring process to keep pace with dynamic AI model updates. This transition is driven by regulators, who now possess the authority to request real-time evidence of risk management and assessment of transparency requirements. These measures are designed to ensure that third-party information and communication technology (ICT) risks are mitigated in accordance with the Digital Operational Resilience Act.
Timeline
IG&H published the CISO Pulse Survey findings on October 13, 2026.
The Tech Race
This shift reflects an urgent industry-wide pivot to meet the compliance demands of the EU AI Act. It marks a departure from static security frameworks toward the proactive, continuous monitoring required by current regional accountability standards.
Organizations will soon mandate more frequent vendor audits, directly affecting the procurement workflows for teams integrating third-party AI tools. Companies must prepare for regulatory audits requiring documented proof of continuous risk assessment as enforcement phases of the EU AI Act proceed.
The takeaway
Security leaders are shifting their strategy from periodic reviews to continuous monitoring to mitigate rapidly evolving supply chain threats. Watch for updated regulatory guidance as the remaining provisions of the EU AI Act are phased in over the coming years.
Further reading
Explore deeper insights on technical governance within our Artificial Intelligence section.
Source note: This article includes information reported by Consultancy.
Live Poll
Do you trust that companies effectively manage the security risks of the AI tools they use?
