Distributed Responsibility, Contested Accountability: Auditing and Governing AI Systems Across the Supply Chain

Abstract

AI systems are increasingly produced through supply chains in which data workers, model developers, cloud infrastructure providers, application developers and deployers each contribute components, yet no single actor has full control over or visibility into the resulting system. Power in these supply chains is concentrated in a few actors, and in the deployment phase the chain is non-modular, components interact to produce emergent effects that no single actor designed or can observe. Harms surfacing at the application level may therefore originate far upstream. Evaluations and audits provide the evidentiary basis for attributing accountability, and the European Union is building an ecosystem of evaluations under the Digital Services Act, the Digital Markets Act and the AI Act. However, what these evaluations should capture sometimes remains conceptually vague. Evaluations designed around individual actors or components risk measuring compliance where they can "see" while missing the more opaque interactions from which cascading harms arise. This dissertation asks how power concentration, non-modularity and opacity in AI supply chains shape the conditions under which accountability can be attributed, systems evaluated and legal obligations enforced. It proceeds in three strands, conceptually, empirically and institutionally. The working hypothesis is that structural opacity places the actors responsible for cascading harms beyond the reach of existing accountability instruments.