Mapping TCG technologies to AI risk management

If the current threat landscape has proven anything, it’s that software-level security is no longer enough when it comes to securing assets. 86% of enterprises have already suffered an AI-related security incident in the past year, demonstrating that the real risks now sit in the infrastructure running these models.

This shift doesn’t just affect security teams – it also fundamentally changes what auditors need to verify to ensure any procured devices or components are safe to use. In this context, TCG technologies deliver cryptographically verifiable evidence that AI systems, data and execution environments are exactly what they claim to be. TCG technologies provide the security guarantees auditors require, delivering hardware‑anchored controls that shift enterprise risk management from ‘trust through policy’ to ‘trust through cryptographic proof’.

Through hardware‑rooted attestation, secure boot and confidential computing, they also establish verifiable integrity for models, data and runtime environments, forming the baseline for trustworthy, enterprise‑grade AI.

Which hardware defenses are relevant to supply chains?

For example, hardware‑based attestation provides a built‑in security check that proves the AI model on a device hasn’t been altered, both before inference begins and after it completes. If anyone tries to modify model weights or inject malicious code, the attestation process flags it immediately.

The same model weights also remain protected inside a Trusted Execution Environment (TEE), where they can only be decrypted within this isolated, hardware‑secured area. Even if someone steals the storage drive or gains OS‑level access, the model cannot be extracted because the decryption key never leaves the TEE. This isolation also prevents administrators, root users or other unauthorized parties from viewing or tampering with data during training or inference.

Additionally, each model version is cryptographically signed, ensuring the hardware only runs authorized, validated builds. This blocks poisoned updates, downgrade attacks and attempts to replace the model with a malicious version.

The functionalities for confidential computing – when anchored to a hardware Root-of-Trust such as a Trusted Platform Module (TPM) – verifies that the execution environment is genuine and uncompromised before any sensitive AI workload is allowed to run. For organizations deploying AI at the edge or in servers, these combined protections ensure models in the field remain exactly as intended: authentic, unmodified and shielded from theft or tampering, giving both manufacturers and users confidence in the integrity of their AI assets.

How can I overcome infrastructure and compliance risks?

TPMs, and other specifications like the Device Integrity Composition Engine (DICE) for more resource-constraint devices, create a silicon-anchored cryptographic foundation that can’t be bypassed through software attacks. Building on that, secure boot verifies the integrity of firmware every time the system starts, which blocks any unauthorized changes that could undermine AI workloads.

Hardware-based isolation then keeps AI processes separated from the rest of the system, which reduces the available attack surface while preventing adversaries from accessing sensitive operations. With this in place, businesses can be assured that their AI infrastructure is protected at the lowest possible layer, since supply-chain tampering, firmware manipulation or other deep compromises cannot take hold.

However, auditing teams also require cryptographically sound, regulator-ready compliance evidence, and this is achieved through remote attestation capabilities. These provide cryptographically verifiable proof that AI workloads are running in approved, trusted environments. TPM-based attestation also generates tamper-proof trails which can be used in audits to record every access, modification and change of state. This irrefutable history of system behavior is a key element of most, if not all, compliance processes.

In terms of data sovereignty – a hot topic within the industry – requirements are also met through hardware-backed key management, which ensures encryption keys always remain under the organization’s control.

How does TCG specifications map to security frameworks?

Let’s use Gartner’s AI Trust, Risk and Security Management (AI TRiSM) framework as an example. Created to be a structured approach for ensuring enterprise AI is explainable, secure, compliant and trustworthy, this framework can be easily operationalized through the use of TCG specifications.

Starting with AI governance, our solutions enable hardware-anchored attestation and TPM-based credential storage, providing the verifiable proof that AI workloads are aligned with policy and working optimally. Then, moving into runtime inspection and enforcement, TEEs and secure boot ensure that the models, data and execution states remain isolated and unmodified. Finally, information governance controls like encrypted storage delivers the end-to-end protection required for adequate data lineage and system integrity.

Together, these layers operationalize AI TRiSM in a practical, measurable way that grounds governance, security and compliance directly in device hardware.

Going forward, the next step is a practical, straightforward one. Companies must take advantage of these technologies and audit their existing AI hardware for TPM and attestation capabilities. Once this has been completed, they should then migrate any high-risk workloads into trusted environments to benefit from end-to-end, cryptographically validated protection.