Identifying the Supply Chain of AI for Trustworthiness and Risk Management in Critical Applications