For most of my career, supply chain risk assessment was a snapshot. You gathered documents, interviewed suppliers, reviewed ownership structures, and produced a judgment that was true on the day you wrote it. The risk picture changed the day after, and nobody knew until the next review cycle.
AI is changing that, and it is changing it in three ways that matter.
First, scale. Risk used to be limited by how much a team could read. Ownership records, trade data, sanctions lists, news reports, financial filings: a thorough assessment meant a small team reading a large pile slowly. AI can now work through that unstructured data at a scale no team can match, and surface the small number of items a human actually needs to judge. I recently applied multi-model LLM workflows, Claude, ChatGPT, and Gemini, under strict Human-in-the-Loop governance, to convert unstructured risk data into strategic decisions, including analysis that supported a presidential block of a foreign-controlled entity’s U.S. operations. The machines did the reading. The judgment stayed human.
Second, pattern recognition. Traditional risk assessment checks what you already know to look for: a sanctioned entity, a flagged country, a missing certification. AI is better at finding what you did not know to look for: anomalies in trade flows, ownership structures that do not match the story, supply chain patterns consistent with illicit finance and money laundering. At Section 2, I help train LLMs to identify exactly those anomalies. The model learns what normal looks like across thousands of transactions, and flags the ones that do not fit. That is a different kind of assessment than a checklist, and it catches things a checklist cannot.
Third, continuity. The old model assessed risk at a point in time. The new model monitors it continuously. Ownership changes, a new supplier appears three tiers down, a trade route shifts, and the picture updates while the assessment is still current. Risk becomes something you watch, not something you revisit once a year.
None of this removes the human from the loop. It raises the stakes on the human in it. An AI assessment that cannot show its work cannot survive an audit, a board question, or a government review. Every AI output I use in risk work has a named human owner, validation before action, clear limits on what data it may touch, and an audit trail that survives turnover. That is not caution for its own sake. It is what makes the assessment defensible when the decision matters, and in supply chain risk, the decision usually matters.
There is also a real danger in doing this badly. AI trained on incomplete or biased data will assess risk with the same blind spots, only faster and with more confidence. A model that cannot explain its reasoning will produce conclusions nobody can challenge, which is worse than no conclusion at all. The organizations that get this right treat AI as a force multiplier for experienced assessors, not a replacement for them. The ones that get it wrong will learn the difference in public.
The shift is real, and it is already here. Risk assessment is moving from periodic snapshots to continuous, data-driven monitoring, and the leaders who learn to govern AI well will see risk sooner and act on it faster than those who do not.
One action for the week: pick one supplier or one sub-tier relationship you have not reviewed in a year, and ask what the data says about it now, not what the file said then.
How is AI changing the way you assess risk in your supply chain?