Art. 13(5)

Training data and pretrained models are commonly sourced from third parties; (13)(5)'s component-due-diligence obligation triggers when a manufacturer integrates third-party ML pipelines exposed to poisoning.

Component collusion via supply-chain compromise is the precise risk (13)(5)'s due-diligence-on-third-party-components obligation triggers — manufacturers must ensure integrated components do not compromise product cybersecurity.

Manufacturer due-diligence on the supplier of the affected hardware/firmware is the upstream control that bounds the corruption surface beneath the software stack.

AI/ML training-data suppliers (data brokers, annotation services, pretrained-model vendors) fall within manufacturer due-diligence obligations on third-party component integration.

Manufacturer due-diligence on third-party component integration is the primary obligation that bounds supply-chain compromise; CRA Art. 13(5) explicitly requires manufacturers to exercise due diligence when integrating components, including verification that components do not compromise the product's cybersecurity.

Manufacturer due-diligence obligations apply to package registries, container base-image suppliers and CI/CD service providers that deliver software dependencies into the product build pipeline.

Software-supplier due-diligence is the upstream control on the build vendors, package signers and OTA distributors that software-supply-chain attacks ride through.

Hardware-supplier due-diligence under Art. 13(5) covers foundries, board houses and IC integrators where ASIC/FPGA Trojans, modified bootloaders and pre-delivery board manipulation are introduced.

SDR vendors and waveform suppliers fall under manufacturer due-diligence; the integrity expectations on vendor-supplied bitstreams and configuration profiles are part of supplier-integration vetting.

Manufacturer due-diligence applies to third-party integration relationships (vendors, partners, support providers) whose connections trusted-relationship attacks ride through.

Manufacturer due-diligence covers mission-collaborator integration via federated identity providers and shared data portals when those create dependencies on the product.

Vendor due-diligence is the canonical case for Art. 13(5): manufacturers must vet remote-administration suppliers and integration partners that hold persistent access to the product.

Manufacturer due-diligence on AIT facility, integrator and pad-side service providers covers exactly the touchpoints where ATLO compromise is introduced.

Hardware backdoors enter through silicon, board and firmware suppliers; manufacturer due-diligence on those suppliers is the upstream control on test/scan-chain enablement and bootstrap-mode misuse.

Software supply chains are the principal vehicle for backdoor introduction; manufacturer due-diligence frames the security expectations on supplier secure-development practices.

Manufacturer obligation to exercise due diligence when integrating components sourced from third parties is the upstream discipline that constrains supply-chain reconnaissance: a manufacturer with documented due-diligence cannot be surprised by what its supply-chain map reveals to an adversary.

Manufacturer due-diligence on hardware-component integration includes verification of supplier provenance, anti-counterfeit screening and tamper-evident packaging — the operational mechanisms that constrain how hardware moves from foundry to final integration.

Manufacturer due-diligence on software-component integration governs how vendor relationships, dependency manifests and provenance are vetted — the same pipeline software-factory reconnaissance attempts to enumerate.

Manufacturer due-diligence on supplier integration governs the contractual and operational mapping of relationships that business-recon adversaries enumerate; when manufacturers maintain documented due-diligence, the adversary's relationship-map asymmetry shrinks.