The European Union’s Artificial Intelligence Act has moved from preparation to enforcement.
On August 2, 2026, the European Commission and national authorities gained enforcement powers under the AI Act. Transparency requirements also became applicable for certain artificial intelligence (AI) systems.
For security leaders, the implications extend beyond the AI models their organizations build.
AI increasingly enters businesses through vendors, software providers, cloud services, and other third parties. That makes AI governance a supply chain issue, too.
What the AI Act requires
The AI Act takes a risk-based approach to regulating AI.
It prohibits certain uses that pose unacceptable risks to fundamental rights. It also creates requirements for general-purpose AI (GPAI) models and transparency obligations for certain AI systems.
GPAI obligations first became applicable months ago. The European Commission gained authority to enforce those requirements in August 2026.
High-risk AI requirements follow later under the revised implementation schedule.
Rules covering certain high-risk areas become applicable in 2027. Those areas include employment, critical infrastructure, biometrics, education, migration, and border control. Requirements for AI embedded in regulated products are slated to become applicable in 2028.
Organizations therefore face different obligations depending on how they develop, provide, deploy, or distribute AI.
That complexity makes one question increasingly important: Do you know where AI exists across your supply chain?
Your AI exposure extends beyond your organization
Most enterprises rely on hundreds or thousands of third parties.
Those relationships can introduce AI into business processes without security teams directly deploying the technology themselves. A software provider might add AI capabilities to an existing product. Another vendor might rely on a GPAI model from a separate provider.
Each dependency can introduce additional operational, cybersecurity, compliance, and governance considerations.
A traditional Third-Party Risk Management (TPRM) program may struggle to track those changes.
Annual questionnaires provide information at one moment. Vendor environments can change long before the next assessment arrives.
The AI Act makes persistent visibility increasingly important because AI dependencies can span several organizations.
Move from periodic reviews to continuous oversight
The AI Act reinforces a broader change already underway in third-party risk.
Organizations need to understand risk as it changes, prioritize meaningful exposures, and coordinate remediation with suppliers.
SecurityScorecard’s approach to threat-informed TPRM combines continuous visibility, third-party data, and threat intelligence. TITAN AI uses that intelligence to help teams detect, prioritize, and respond to supply chain risk.
This approach can support the security evidence organizations need as AI adoption expands across their vendor ecosystems.
It does not replace legal analysis or determine AI Act compliance. It gives security and risk teams better information for managing the cyber risks surrounding third-party technology.
The regulatory deadlines matter. The larger challenge will continue after those dates. Organizations need to know where third-party risk exists, recognize when it changes, and act before that exposure becomes an incident.
See how SecurityScorecard can help you continuously identify and reduce third-party cyber risk across your supply chain and explore TITAN AI today.
