As healthcare organizations accelerate adoption of frontier artificial intelligence (AI) technologies, a new report from Health Information Sharing and Analysis Center (Health-ISAC), published on July 14, warns that traditional third-party risk management practices are no longer sufficient to address the growing complexity of AI-enabled supply chains.

The report, Frontier AI in the Health Sector: Managing Supply Chain and Vendor Risk, urges healthcare organizations to expand vendor oversight beyond conventional cybersecurity reviews to include AI-specific governance, transparency, and lifecycle risk management. As AI capabilities become embedded in electronic health records (EHRs), clinical decision support systems, medical devices, revenue cycle platforms, and administrative workflows, healthcare providers are increasingly exposed to risks originating from third-party AI developers, cloud providers, open-source components, and other downstream suppliers.

Health-ISAC notes that AI supply chains introduce new challenges because organizations often have limited visibility into how AI models are developed, trained, updated, or integrated into vendor products. These "black box" dependencies can create security, privacy, regulatory, and operational risks that are difficult to detect using traditional procurement processes.

Among the report's recommendations are:

• Establish AI-specific vendor governance and procurement policies.
• Require greater transparency from vendors regarding AI models, training data, software dependencies, and subcontractors.
• Continuously monitor AI-enabled systems throughout their lifecycle rather than relying solely on point-in-time security assessments.
• Incorporate AI risk into existing enterprise risk management, cybersecurity, and compliance programs.
• Develop clear contractual requirements covering AI governance, incident reporting, model updates, and accountability.

The guidance aligns with the National Institute of Standards and Technology's (NIST) AI Risk Management Framework (AI RMF) and emphasizes that healthcare organizations should evaluate not only direct technology vendors but also the broader ecosystem of suppliers supporting AI-powered products and services.

The report arrives as supply chain attacks remain one of healthcare's most significant cybersecurity threats. Health-ISAC's 2026 Global Health Sector Threat Landscape report found that attackers are increasingly targeting vendors and technology providers to gain access to multiple healthcare organizations through a single compromise. It also identified AI-enabled cyberattacks as one of the sector's top concerns for 2026.