A utility risk team reviews AI dependencies beyond traditional app CVEs. Which systemic AI risk should they add?
Select an answer to reveal the explanation.
Short Explanation
Your AI risk isn’t just last week’s CVE list. Model supply-chain dependency is a systemic risk—printer firmware and scanner-only views miss it.
Full Explanation
A utility risk team reviewing AI dependencies beyond traditional app CVEs should add supply-chain model dependency as a systemic AI risk. Foundation models, hosted endpoints, fine-tune pipelines, and third-party model cards create concentration and change risk that classic network vulnerability scanners do not fully express. Municipal utilities relying on external model providers inherit availability, integrity, policy-shift, and data-handling exposures that belong on the systemic risk register alongside application CVEs.
Including only risks that appear in classic network vulnerability scanners fails by concept because model-provider dependency can fail without a local CVE hit. Including only risks related to office printer firmware fails because printers are unrelated to AI model supply-chain exposure. Believing foundation-model providers create zero systemic exposure fails because provider outages, silent model updates, or policy changes can disrupt utility AI services at scale.
Exam caveat: supply-chain model dependency is systemic—even “API-only” use creates operational dependence; pinning, monitoring, and exit plans are part of treatment, not optional extras. Operational check: inventory model providers and versions for each utility AI use case, document fallback procedures, subscribe to provider change notices, and review concentration risk with utility enterprise risk on a fixed cadence.