Cabo Advisory

← Insights··Updated

The Invisible Supply Chain: Fourth-Party Risk in AI and Cloud Contracts

You signed one contract. Your service depends on five companies. Regulators — led by the EU's DORA — now expect you to see all the way down the chain, and your contracts are the only flashlight you have.

The dependency you never signed

Every modern AI or cloud service is a stack of other people's services. Your AI vendor calls a foundation model it doesn't own, running on GPUs it rents, in a data center operated by someone else, fed by data sources licensed from yet another party. You have a contract with exactly one layer of that stack. Everything below it is a fourth party (your provider's subcontractor), a fifth party (the subcontractor's supplier), or deeper — what risk professionals bluntly call Nth-party risk.

The scale is not hypothetical: the ECB's 2025 guide on outsourcing cloud services singles out subcontracting chains running beyond two or three levels as a supervisory concern. And the practical failure modes are exactly the ones Kemp IT Law flagged as top customer concerns for 2026: a key provider to your provider exits the supply chain, raises prices, or gets swapped out — your vendor quietly changes the underlying model — and your service degrades, without you ever having had a contract with the party that caused it.

AI makes the old cloud version of this problem sharper in three ways. Model dependency is opaque: many "AI vendors" are orchestration layers over one or two frontier models, so a deprecation or pricing change upstream is an existential event downstream. The chain is dynamic: providers swap models and sub-processors far faster than data-center relationships ever changed. And the concentration is extreme: a handful of model and compute providers now sit beneath a very large share of the world's AI products, so a single upstream incident propagates across entire markets at once.

DORA: the regulatory template everyone will copy

The most developed legal answer so far is the EU's Digital Operational Resilience Act (Regulation (EU) 2022/2554), applicable since 17 January 2025 for banks, insurers, investment firms, payment and crypto-asset providers, and more than a dozen other categories of financial entity. DORA's core move is simple and radical: outsourcing the service does not outsource the risk. The financial entity remains fully responsible, all the way down the chain.

Three mechanisms matter for contract drafters everywhere, because they are becoming the de facto international playbook.

Visibility. Article 28(3) requires a Register of Information covering every ICT third-party arrangement, maintained at entity, sub-consolidated, and consolidated levels and reported to supervisors — including subcontractor data. Compliance has been humbling: in the European Supervisory Authorities' 2024 dry run, only 6.5% of nearly 1,000 participating firms passed all 116 data quality checks, with missing subcontractor information among the most common failures. Article 29(2) then forces the substantive question, requiring firms that allow critical or important functions to be subcontracted to weigh how long or complex subcontracting chains would impair their ability to monitor the contracted function. That is fourth-party risk, written into pre-contractual due diligence.

Control. For arrangements supporting critical or important functions, DORA's contractual provisions and the accompanying Regulatory Technical Standards on subcontracting require real levers: contractual conditions on whether and how critical functions may be sub-outsourced, advance notice of material changes to subcontracting with a right to object, flow-down of equivalent contractual and security standards to the subcontractor tier, and — under the RTS (Commission Delegated Regulation (EU) 2025/532) — a right to terminate where the provider implements material subcontracting changes despite the customer's objection or without its approval.

Escape. Article 29 requires concentration-risk assessment before contracting — is this provider substitutable, and does the chain beneath it converge on a single point of failure? — and DORA mandates documented, tested exit strategies for critical arrangements. Supervisors are already probing whether exit plans are real: if the contract grants no data-export rights, or the migration plan assumes capabilities that don't exist, the plan is not defensible.

One more point that surprises many AI vendors: they are in scope. Model providers and AI inference services sold to financial entities are ICT third-party service providers under DORA, and register entries are expected to be specific — "AI inference for transaction risk scoring," not "AI." The largest already face direct EU oversight: in November 2025 the European Supervisory Authorities designated the first 19 critical ICT third-party providers, including the major hyperscalers.

Beyond finance: the flow-down is going global

DORA is sector-specific, but its logic is spreading. The EU's NIS2 Directive pushes supply-chain security duties across a much wider set of sectors (with DORA taking precedence for financial entities where both apply). The UK's Cyber Security and Resilience Bill, which passed the Commons in June 2026 and is in its final parliamentary stages, will modernize its own regime. And commercial practice is running ahead of legislation: enterprise customers far outside finance now routinely demand subcontractor disclosure, sub-processor change notification (a habit learned from GDPR Article 28 data processing agreements), and AI-specific transparency about which underlying models power a service. For an international vendor, the efficient strategy is usually to build one DORA-grade operating model rather than negotiate bespoke visibility regimes market by market.

The contract toolkit

For customers, six provisions do most of the work. A subcontractor disclosure and approval clause, scoped to material subcontractors and critical functions so it survives negotiation. Flow-down obligations requiring the provider to impose equivalent security, confidentiality, and data-protection terms down the chain — and to remain liable for its subcontractors' failures, so accountability never disappears into the stack. Change notification covering not just corporate sub-processors but model changes: advance notice, impact assessment, and for critical workloads a re-validation window before a swap takes effect. Audit and information rights that reach material subcontractors, at minimum through the provider. Concentration and exit provisions: data portability in usable formats, transition assistance, and termination rights triggered by unapproved subcontracting changes or upstream failures that materially degrade the service. And a register-friendly information covenant — an obligation to supply, and keep current, the structured data (entities, locations, functions, criticality) that regulated customers must report.

Be realistic about the friction. Hyperscalers and major model providers resist entity-specific approval and notification obligations; subcontractor audit rights can collide with the provider's own confidentiality commitments; and cloud delivery models change fast enough that any static subcontractor list is stale on signature. The practical compromises that are emerging — published sub-processor lists with subscription-based change alerts, pooled or third-party audits, objection-plus-exit rights instead of true prior approval — are worth taking, because they convert an unwinnable veto negotiation into a workable monitoring regime.

The bottom line

Fourth-party risk used to be an operational footnote; DORA turned it into a board-level, contract-drafted, regulator-audited discipline — and the rest of the world is borrowing the template. The parties you can't see are now the parties you must map, contract for, and be able to leave. The chain doesn't get shorter. Your visibility down it has to get longer.

Sources and further reading

This post is general commentary, not legal advice. Specific transactions should be reviewed by qualified counsel in the relevant jurisdictions.