AI compliance and supply-chain security in automotive manufacturing: keeping a multi-tier network audit-ready

Exposed is not the absence of compliance effort — most Exposed manufacturers run supplier questionnaires, hold IATF 16949 certificates and pass customer audits. What is missing is any connection between that paperwork and the way supply decisions are actually made. The questionnaire says the supplier has an information-security policy; the buying decision is made from a spreadsheet the questionnaire never touches; and when an analyst quietly runs a machine-learning model over last year's delivery data to rank suppliers, no register anywhere records that the model exists.

The tell is what happens when someone asks a specific question: which tier-2 supplier makes the microcontroller in this ECU, and who checked their security posture? At Exposed the answer is an investigation, not a lookup. Somebody emails the tier-1, the tier-1 emails their purchasing team, and three weeks later a partial answer arrives that is stale on arrival. The 2021–22 semiconductor shortage forced exactly this exercise on most of the industry, one part at a time, and most of what was learned was never written into a system.

This stage is where regulation now applies real pressure. UN R155 makes the vehicle manufacturer's type approval conditional on a certified CSMS that identifies and manages risks arising from suppliers — which an annual questionnaire cannot honestly claim to do. An Exposed operator is not merely inefficient; it is carrying an assurance claim it cannot evidence, and the gap surfaces at the worst possible moments: a customer audit, a type-approval review, or an incident.

Mapped is where most serious automotive operators sit, and it feels like more progress than it is. The semiconductor shortage and the R155 deadlines pushed the industry into mapping: critical parts have known sub-tier sources, the supplier master has been consolidated, and somewhere a data science team has built a risk score that combines delivery performance, quality PPM, financial signals and questionnaire age. Every artefact a regulator might ask about exists in some form. What does not exist is the connection between those artefacts and the moment a buyer awards volume or a quality engineer releases a lot.

The structural problem is the same one that stalls AI programmes everywhere, wearing compliance clothing: the score lives in a dashboard behind a separate login, so acting on it is voluntary, and voluntary steps disappear under pressure — precisely during the allocation crises and ramp-ups when supplier risk is highest. Worse, from an assurance point of view, even when a buyer does consult the score, nothing records it. The decision that R155 and a customer auditor will one day ask about is being made correctly and leaving no trace, which audits treat as indistinguishable from not being made correctly.

Time at Mapped also quietly builds a second liability: the map itself decays. Tier structures shift every sourcing cycle — a tier-1 changes its electronics sub-supplier and is under no obligation to mention it. A map built as a project rather than as a living dataset is typically 20–30% wrong within a year, and the operator does not know which 20–30%. The exit from Mapped is not a better map; it is wiring the map and the score into the systems where supply decisions execute, so that using them — and evidencing them — becomes the default.

Documented is the first stage where compliance stops being a project and becomes a by-product. The defining property is that evidence is generated by the operating system of the supply chain, not assembled for an occasion: when a buyer awards volume, the SRM records the risk score they saw, the model version that produced it, the data it read and what the buyer did — including overrides, with reasons. When a lot is released, the MES holds its provenance genealogy. Audit preparation shifts from an archaeology exercise to a query.

The second property is that the AI itself is brought inside the controlled estate. The models scoring suppliers and screening certificates are inventoried the way ECU software is inventoried: named owner, documented purpose and limitations, versioned releases, access control on training data, monitored performance. This is exactly the discipline ISO/SAE 21434 applies to vehicle software and the EU AI Act expects of consequential AI systems, applied to the factory's own decision tools. Operators who reach Documented consistently report the same surprise: the model-governance work they did for compliance is what finally made their AI reliable enough to trust operationally.

What Documented does not yet give you is external confirmation. The controls exist and the evidence flows, but no hostile reader has tested them: no TISAX assessor has walked the scope, no customer audit has pulled a thread, no type-approval review has sampled the CSMS evidence. Internal confidence at this stage runs about one stage optimistic — the gap is almost never the controls themselves but their edges: the contractor with lingering access, the legacy EDI feed outside the monitoring, the one plant whose MES was never wired into the genealogy. External assessment is what finds the edges.

Audited means the assurance claim has been tested by someone paid to break it. The TISAX assessment has walked the information-security scope — including, at mature operators, the environments where supplier-scoring models are built, because OEM data flows through them. The customer audits that used to be a week of disruption have become short, because the evidence is system-generated and internally consistent. Type-approval reviews of the CSMS sample supplier-risk evidence and find a live pipeline rather than a binder. The organisation has learned the difference between having controls and being able to demonstrate them at speed, which is the difference regulation actually prices.

The operational character of this stage is the remediation loop. External assessment always finds something — a site whose scope excluded a workshop network, a supplier whose contractual audit right was never exercisable in practice, a model whose documented retraining cadence had quietly slipped. What distinguishes Audited from Documented is not fewer findings but what happens to them: each has an owner and a date, closure is tracked, and the finding-to-closure cycle time is a number someone reports. Assurance has become an operating metric rather than an annual event.

The residual weakness is periodicity. TISAX labels run three years; customer audits are biennial; type approvals are per vehicle type. Between assessments, the network moves — suppliers change sub-suppliers, models retrain, staff rotate, new AI tools arrive through procurement — and the assurance statement quietly ages. Audited operators know their estate was sound at the last assessment; they infer, rather than know, that it is sound today. Closing that gap — turning point-in-time assurance into continuous assurance — is the move to Assured, and it is a monitoring and governance investment, not a bigger audit.

Assured is narrower and more specific than it sounds. It is not a fully autonomous compliance function; it is an enumerated set of supply-chain safeguards that execute without waiting for a human — a supplier whose TISAX label lapses is automatically flagged for requalification and its data connections moved to restricted mode; a lot whose provenance genealogy is incomplete is automatically held at inspection; an account belonging to an off-boarded supplier engineer is revoked within hours, not at the next quarterly review. Everything outside the enumerated set still escalates to a person. The policy that draws that line is versioned, reviewed and owned, exactly as ISO/SAE 21434 treats a cybersecurity case.

The engineering at this stage is largely settled; the discipline that sustains it is governance under change. Regulations move — the EU AI Act's obligations phase in over years, R155 interpretations harden with each type-approval cycle, VDA ISA versions add scope — and the Assured operator's distinguishing capability is a working regulatory-change loop: a named forum that maps each change to affected controls, models and contracts within a quarter, rather than discovering the gap at the next assessment. The same loop handles internal change: every retrained model, new supplier connection and procured AI tool passes the onboarding gate that attaches owner, documentation and monitoring before first use.

Regression is the permanent risk, and it arrives quietly: an escalation rate that drifts up because the network moved outside the policy's assumptions, an evidence-completeness metric that sags after an MES upgrade, a monitoring alert routed to a mailbox nobody owns after a reorganisation. Assured operators treat those three signals as the compliance equivalent of andon lights — a rise triggers a policy review before an incident forces one. The stage is sustained by the willingness to keep paying a modest, permanent monitoring and governance cost; operators who stop paying it do not stay Assured, they become Audited with a lag.