Academician Yun Xiaochun on AI Supply Chain Security Challenges

On September 14, 2026, Chinese Academy of Engineering academician Yun Xiaochun delivered a speech titled "AI Supply Chain Security Situation and Challenges" at the Cybersecurity Technology Summit of National Cybersecurity Awareness Week in Shandong. He said AI supply chains cover seven interdependent asset classes and that governance must address changing system behavior, not only component invent

On September 14, 2026, the Cybersecurity Technology Summit of the 2026 National Cybersecurity Awareness Week was held at the Shandong International Exhibition Center. Yun Xiaochun, academician of the Chinese Academy of Engineering, delivered a keynote titled "AI Supply Chain Security Situation and Challenges." The following summarizes the main points of the speech.

Note: The image was provided by the conference organizers.

Object of AI Supply Chain Security

Yun said the object of AI supply chain security is continuously changing system behavior. Governance must assure that components are trustworthy and that processes and behavior are trustworthy. Traditional inventory-style supply chain governance mainly answers what was installed. AI supply chain governance must also answer why the system acted as it did, when it changed, and whether consequences are controllable.

Seven Interdependent Asset Classes

He said AI supply chains cover seven interdependent asset classes: data, models, software, compute, platforms, tools, and services. A change in the origin, update, or permissions of any class can change the security, compliance, and business performance of the final model.

Three Dynamic Risks

Compared with traditional software supply chains, AI supply chains add three dynamic risks.

Data risk: data input can shape overall AI behavior. Data origin, distribution, labeling, and contamination affect model quality and may embed bias, backdoors, and compliance risk.

Model risk: model components can show emergent behavior. Combinations of weights, adapters, and retrieved content may produce unexpected emergent behavior, so a single version number is not enough to describe the supply chain.

Runtime change: the AI supply chain can still change during operation. Policy and vendor updates can change results without rebuilding the application. AI construction is therefore continuous configuration and behavior management rather than a single build and a single acceptance.

Reuse, Open Source, and Servitization

Yun described high reuse and servitization as a distinct feature of AI supply chains.

Most AI applications do not train from scratch and often depend on third-party foundation models and adapters.

The open-source ecosystem is accelerating. Model repositories, datasets, and code packages raise the speed of innovation and also bring risks of impersonated sources, malicious files, and maintenance interruption.

Cloud delivery and API servitization of AI are becoming more evident. Models, vector databases, moderation, search, and monitoring are delivered as APIs, and users often cannot see all underlying components and changes.

Agents are composable. Tools, plugins, MCP services, and multi-agent setups form runtime dependencies, and third-party components can affect actions and permissions.

Compute and geographic constraints, including chips, cloud regions, networks, energy, and export controls, affect capacity, substitutability, continuity, and data boundaries.

He said AI supply chain risk has expanded from whether software has vulnerabilities to whether key capabilities are transparent, substitutable, and verifiable.

Trust Inheritance

As with traditional supply chains, attacks on AI supply chains enter high-value environments through trust inheritance. Upstream entry points, artifact changes, cooperative distribution, downstream execution, and business consequences have distinct characteristics. High upstream reuse, artifacts that are hard to inspect, high downstream privileges, automated updates, cross-organization incidents, and blurred responsibility boundaries amplify attack risk. He said defense should move earlier to origin, build, signing, and acceptance, while retaining runtime detection and revocation.

Deployment Boundaries

Deployment boundaries should limit the execution capability and data reachability of unknown artifacts. Typical practice is isolated loading: unknown or new-version artifacts are first parsed and trial-run in an environment without sensitive data, without external network access, and without long-term credentials. Model services and agent tools should use independent workload identities and short-lived credentials. Before deployment, signatures, origin, evaluation, scenario, data level, region, and approval validity period should be verified. Known-safe versions, configurations, routing, and data interfaces should be retained, supporting circuit breaking and vendor switching.

Response Goals

Emergency response to AI supply chain attacks generally includes six steps: confirm, locate, contain, verify, recover, and coordinate. In exercises, organizations must verify whether they can answer within hours which systems are using an affected component. The response objective is to identify all derived artifacts and stop continued trust.

Maturity Measures

Maturity should be measured by transparency, integrity, substitutability, and response speed. Effectiveness is measured by whether business interruption, data exposure, erroneous decisions, and compliance losses after a supply chain incident continue to decline. If those losses decline, the response is treated as effective. If they do not, the response is treated as ineffective.

Domestic and International Frameworks

Domestic and international frameworks are turning supply chain transparency into lifecycle responsibility. China's Interim Measures for the Management of Generative Artificial Intelligence Services require use of legally sourced data and foundation models. NIST lists value chain and component integration among generative AI risks. NTIA advocates datasheets, model cards, system cards, and independent assessment. The trend in AI supply chain governance is from principle-level trustworthiness toward component disclosure, independent evaluation, incident reporting, change management, and traceable responsibility.

Yun concluded that AI supply chain security ultimately must show that trustworthy dependencies can produce trustworthy results. Organizations need to see the full chain, bind verifiable evidence, and be ready to change and exit. Inventories make the supply chain visible, provenance makes artifacts trustworthy, evaluation makes behavior knowable, and resilience makes dependencies controllable.