A model dependency is an AI model or service that another product relies on to provide a feature. It may be directly integrated, called through an API, hosted by a subcontractor, or bundled into a larger service, so the dependency is not always obvious to the customer.
In cyber security and supply-chain management, hidden model dependencies matter because they can affect data flows, vendor risk, compliance, and incident response. For example, a product may send user prompts to an external model provider or inherit restrictions tied to the technology it uses. Defenders can manage this risk by inventorying AI components and subprocessors, requiring vendor disclosures, documenting model provenance, and reviewing changes before deployment.