The model supply chain covers six layers: the data the base model was trained on, the model files and weights, any fine-tunes or adapters, the corpus a retrieval system searches, the tools and connectors the model can call, and the framework and code that tie them together. The first three usually come from outside the organisation. The last three are usually built and changed inside it.
It is harder to secure than a classic software supply chain because the model is probabilistic, its weights cannot be read like code, and it takes instructions from the content it processes. Published research has shown poisoning, tampered weights, malicious model files and malicious connectors at different layers.
Classic controls such as signing and scanning confirm that a component is the one you expected. For a model that is necessary and insufficient: an unaltered, signed model can still carry a backdoor. Add provenance records for every layer and limits on what the model can do with its access.