What we learned about automotive supply chain due diligence from Ford, Yazaki, AIAG, and Microsoft

Highlights from the Microsoft + Resilinc executive workshop in Detroit, including a first look at Resilinc intelligence in Microsoft 365 Copilot

Yazaki recently looked at 334 wire harness part numbers for a single vehicle program. Beneath them sat 239,000 parts. Tracing every one of those parts ten tiers upstream, said Marten “Marty” Wojtowicz, Director of Supplier Quality at Yazaki, “that’s a career. That’s going to take you 30 years.”

Customers and regulators increasingly expect automotive suppliers to know their supply chains well beyond Tier 1. Doing that at automotive scale is another matter. That gap ran through the executive workshop Resilinc was glad to co-host with Microsoft on September 30 at Microsoft’s Detroit office. OEMs, Tier 1 suppliers, and the Automotive Industry Action Group (AIAG) came together to discuss multi-tier due diligence, work through real-world disruption scenarios, and see how AI, including Resilinc intelligence in Microsoft 365 Copilot, can help teams move faster while keeping people in charge of the decision.

Paul Rossi, Director of Automotive Expert Services at Resilinc, moderated a panel that covered every position in the value chain:

• Steve Faraci, Director, Supply Chain Risk Management, Ford: the OEM view
• Tanya Bolden, Vice President of Corporate Responsibility, AIAG: the industry view
• Marty Wojtowicz, Director of Supplier Quality, Yazaki: the Tier 1 supplier view
• David Breaugh, Supply Chain GTM Lead, Microsoft: the technology view

If you couldn’t join us, here’s what you missed.

Five takeaways from the room

1. Start now, with the data you have. An active, improving process matters more than perfect visibility.
2. OEMs want engagement, not data dumps. Naming your risks and your actions builds more confidence than reporting none.
3. Exposure matters once it’s tied to parts, plants, and programs. That connection separates real risk from noise.
4. Early warning is worth more in automotive than almost anywhere. Requalifying a part can take months, so act before a risk is confirmed.
5. AI accelerates the work; people own the decision. Copilot and agentic AI compress investigation and communication, with humans in every step.

Start where you are, but start

Tanya opened with the origins of AIAG’s Due Diligence Reporting Template (DDRT). It began with forced labor, but the OEMs always knew the scope would grow. European legislation, carbon reporting, and tariffs are all widening what supply chain risk means, and governments, Tanya said, “have gotten quite savvy, and very, very onerous in what they’re requiring in the supply chain.”

That’s why the DDRT is deliberately simple. The OEMs took a crawl, walk, run approach that meets suppliers where they are, from companies just getting started to those already sprinting. The visibility it builds also pays off beyond compliance, helping companies manage tariff costs “whether they are in place today or not in place tomorrow.” Tanya emphasized:

“We don’t want to make ‘perfect’ the enemy of ‘good.’ Do we have clear visibility today? Most do not. But companies have to start.”

The DDRT also answers a question suppliers have asked for years: “Why don’t the OEMs just get together and have one ask?” But a common template isn’t an invitation to check the box. OEMs don’t want a quick data search passed along; they want the dialogue and progress behind the submission. (For more on what that work involves, see what we learned about DDRT readiness from AIAG and Kharon.)

OEMs want engagement, not data dumps

Asked what gives an OEM confidence in a supplier, at Tier 1 and below, Steve Faraci, Director of Supply Chain Risk Management at Ford, put less weight on audit results than on the quality of the conversation. He looks for suppliers that understand their risks and have a team that owns them, whatever the company’s size.

“It’s not good if I talk to someone and they say, ‘I’m good, I have no risks.’ It’s good if I talk to someone and they say, ‘Here are the three things I have, here are the actions I’m taking, here’s where I’m going.’”

Asked whether the biggest gap today is visibility, data quality, or engagement, Steve chose engagement. Twenty years ago, multi-tier visibility was a dream; now there is plenty of data. “In the end, it’s just people working with people,” he said. OEMs need suppliers to work proactively through their own value chains and come to their customers first, rather than handing over data and waiting to be told what’s next.

For Tier 1 suppliers, the challenge is separating signal from noise

Marty described the Tier 1 squeeze: answering OEM requirements while producing reliable information about their own supply chains. Visibility into direct suppliers is strong. The tiers beneath them are hard. A plastic connector supplier might buy from 20 plastic suppliers globally, but not all of that material reaches Yazaki parts, and not all of those parts go to a given OEM. When a customer flags a company somewhere in that network, Marty said, “We’re a global company. That doesn’t mean we’re using them here in North America. That doesn’t mean we’re sending the parts to Ford.”

The discussion surfaced the commercial realities that make deep mapping harder:

• Direct suppliers take their cues from the OEM. “They view you as the customer,” Marty told the OEM side of the table. “We’re just the ones that write the check.”
• Some suppliers are also competitors, and they are understandably reluctant to share their own supply chains.
• Requirements are diverging. Some OEMs now ask for Tier N visibility, and sometimes restrict sourcing countries, at the RFQ stage. “The DDRT was very standardized, and it’s a great move,” Marty said, “but now this Tier N mapping is becoming a mixed bag.”

Marty proposed an industry-standard certification showing that a company has done the work to map its supply chain. The OEM side acknowledged the trade-off: making mapping a formal gate in sourcing could add to the critical path of a vehicle launch.

Tie every risk signal to parts, plants, and programs

So how does Yazaki decide whether exposure several tiers down is a real business risk? Marty pointed to a recent case. A customer-supplied list of 11 or 12 flagged companies included a smelter in China that appeared in Yazaki’s supply chain. Because Yazaki maps every part number it buys in Resilinc to the vehicle programs, plants, and distribution channels it serves, the answer came almost immediately. “We were able to use Resilinc, and within a minute we saw everything,” Marty said. The smelter had no connection to the North American supply flow in question.

The same structure works for disruptions. If a supplier has a fire, the team can see every part number it buys from that supplier, where those parts ship, which plants build with them, and which car lines depend on them.

Putting the scenarios to the test

The second half of the workshop turned to three scenarios designed to mirror what a team could face on any given morning:

1. Hidden risk: A critical shipment is detained because a sub-tier supplier is linked to forced labor.
2. Overnight change: A trusted supplier becomes high risk after a tariff, export control, or geopolitical shift.
3. The audit: A regulator or customer asks for evidence that your due diligence holds up.

Instead of splitting into breakouts, the room worked through the scenarios together, and the first one alone filled most of the session. The practical lessons:

• Trace in both directions. Containment means tracing upstream to the source and downstream to affected products and customers, then deciding quickly whether the problem is systemic or a one-off.
• Tier 2 is achievable; beyond that gets hard. With full Level 3 PPAP documentation, material certifications can get a supplier to Tier 2 quickly. After that, it’s supplier by supplier.
• Material questions are harder than supplier questions. Ask whether products contain antimony or rare earth elements and the answer is often, in effect, “I just buy this connector.” Declarations such as the Conflict Minerals Reporting Template (CMRT) are often enterprise-wide rather than product-specific. One participant’s ideal: AI that reads product designs to find gold or tungsten in a wire harness, and from there the affected plants and customer programs.
• Evidence is the bottleneck. Participants who have run mock detentions said producing documents is difficult even at Tier 2, especially when supplier relationships live in spreadsheets, disparate ERP systems, and email.
• Know the rules on your data. Tanya noted that IMDS was not developed to support purchasing decisions and that its use is governed accordingly.
• Alternative sourcing takes months, not days. PPAP, environmental testing, and validation stand between a replacement part and the line.

Why early warning matters

That last point is why the room kept returning to early warning. During the Nexperia disruption last fall, a geopolitical dispute cut off inexpensive but essential chips used by the hundreds in every vehicle. Events like that build over weeks, and a Resilinc team member described how the value lies in an alert that says “it’s going to affect these parts that you buy for these customers in these particular programs,” not just a headline.

One supplier in the room acted on exactly that kind of alert. “We got in touch with their distributors. We did hoover up a lot of the material, and we made it through.” Another traced a material shortage back to a chemical plant at Tier 4, then used HTS codes to find an alternate source for its supplier. Had it not, the participant said, “every OEM in North America would have gone down.”

Seeing forced labor risk before it’s confirmed

Marty’s “dream solution” is Kharon data embedded in Resilinc, so that any supplier connected to forced labor “is going to turn red” on the map. Yazaki also uses Resilinc risk ratings in sourcing decisions, covering geopolitical and natural disaster risk as well as forced labor. “Anybody that’s high risk, we try not to go with them,” he said.

Panelists explained why this kind of intelligence has become central to industry programs. If U.S. Customs and Border Protection detains a shipment on suspicion of forced labor, it won’t necessarily tell the importer why. Companies need both risk identification, to flag suspect entities, and supply chain mapping, to show whether those entities connect to their products.

Ranjit Jose, who leads partnerships at Resilinc, explained how Kharon extends visibility beyond public lists such as the UFLPA Entity List. The owner of a listed factory might hold a 60% stake in another that isn’t listed, a connection a supplier would struggle to uncover alone. Kharon identifies those connections as suspected entities, which Resilinc surfaces in the supply chain network graph. When the Department of Homeland Security added 43 companies to the UFLPA Entity List on July 31, its largest single expansion to date, 41 of them were already tracked by Kharon. Seeing suspected entities early gives companies time to transition away before they are confirmed and before a shipment is detained.

Kharon sits alongside other partners in Resilinc, including RapidRatings for financial risk, plus cyber and sanctions intelligence, so teams can map the supply chain once and layer in the data that matters for each type of risk.

Where AI is changing outcomes

“We’re still early days in AI,” David said, but Microsoft is “drinking our own champagne” across a supply chain that spans Surface and Xbox hardware and a fast-growing data center build-out. Microsoft uses Resilinc in its own material supply chain, and AI is helping in three ways:

1. Data readiness. Microsoft turns AI on the data itself. “You don’t need perfect data,” David said. “Data needs to be good enough.”
2. Signal from noise. Microsoft maps Resilinc risk signals to parts, locations, suppliers, product families, and even customers through a graph-based ontology layer in Microsoft Fabric.
3. Faster decisions. “Copilot’s been like a godsend there.” LLMs “are terrible at doing math,” David said, but strong at decision intelligence: assembling evidence, building the storyline, drafting communications, and tracking corrective action, “the project management work that nobody wants to do.”

“Although a lot of what I described sounds like it’s all automated, there are humans in the loop every step of the way.”

Tanya added that policymakers she has met in Washington often assume automotive already knows its supply chain, comparing it with sectors whose supply chains are shorter and more linear. In reality, OEMs tend to treat supplier information as proprietary, while suppliers readily share whom they supply. AI can help surface those connections, but human verification remains essential, she stressed, because companies and relationships change.

Bringing Resilinc intelligence into Microsoft 365 Copilot

Many of the challenges the panel described come down to getting the right intelligence to the right people quickly. That’s the idea behind the Resilinc connector for Microsoft 365 Copilot, announced the same day as the workshop. Built on the Model Context Protocol (MCP), it lets authorized users ask Copilot natural-language questions and get answers grounded in their organization’s Resilinc multi-tier data on suppliers, sites, parts, products, and materials, governed by existing Resilinc authentication, tenant isolation, licensing, and access controls.

From network view to executive briefing

The video we shared at the workshop followed an exposure investigation from start to finish, using an aerospace flight-controls example:

• See the network behind the product. Start with a category the business already uses, such as flight controls, to narrow the view to relevant supply relationships.
• Break down the materials. Resilinc’s material breakdown reveals the components beneath the finished system and focuses the supply chain view.
• Apply a regulatory lens. An Executive Order 14415 lens highlights relationships that warrant investigation, with companies, site counts, and sourcing context across tiers.
• Ask Copilot where to focus. Using Resilinc information, Copilot organizes the investigation around business exposure, sourcing concentration, and gaps in material evidence, then points to the supplier, site, and origin relationships to validate next.
• Brief leadership. Copilot turns the analysis into a presentation and a leadership email draft.

The same pattern applies directly to automotive: a forced labor alert, a critical mineral restriction, or a tariff change becomes a clear briefing for the people who need to respond, without anyone leaving the tools they already work in.

Live demo: agents in Resilinc, actions in Copilot

Bryce Nelson, Senior Solutions Consultant at Resilinc, then walked through the capabilities live:

• Multi-tier mapping from Tier 1 to Tier N, with lenses for rare earths, conflict minerals, and critical minerals that map as deep as Tier 10.
• Tariff impact analysis that pulls country of origin and HTS codes, calculates exposure including stacked tariffs, and reruns when rates change. Adding spend data sharpens the view.
• Alternative supplier discovery that matches a part description against market data to suggest other likely sources.
• Forced labor screening against the UFLPA Entity List and Kharon data, plus DDRT generation from the company’s supply chain data, optionally filtered by customer, leaving only a few fields for the submitter.

In Copilot, Bryce asked what it could do through Resilinc’s MCP server. The answer spanned disruption WarRooms, suppliers flagged for forced labor, and Tier 1 to Tier 9 network data, and Copilot can turn any of it into presentations and emails, including on mobile. Watching it come together, Ranjit noted “how Copilot’s able to mix and match all these capabilities, because that’s in many ways the power that it brings.”

Bryce also showed automations he set up in Copilot Cowork just by describing what he wanted: a daily 6 a.m. email ranking the most critical disruption WarRooms, and a Teams channel update limited to high-severity WarRooms with supplier-confirmed impact. He closed with a preview of work in progress that combines Resilinc disruption data with a company’s own inventory and logistics data, flagging impacted parts with less than six weeks of supply while accounting for material in transit, so teams can move from notification to action.

What to do in the next 90 days

Paul closed the panel by asking each panelist for one priority for the next 90 days to a year:

• Steve (Ford): Run a scenario. Taking what he called “a smaller, less aspirational approach,” Steve suggested picking one scenario and working through it with your team. Could you replicate what Yazaki did with the smelter? Let the gaps decide what you build. “Otherwise, you go build a bunch of tools and you find out it’s not answering the question.”
• Tanya (AIAG): Get the right people at the table. Know which legislation and customer expectations apply to you. Risk touches many functions, so run your worst-case scenario across them and “test how robust your model is.”
• David (Microsoft): Think platform, start narrow. “The AI we’re using today is going to be the worst AI in the history of the planet,” he said, so don’t wait. Pick a lane, such as a constrained supply line or a high-risk area, but build on a data and security foundation that can scale, or risk a proof of concept that can’t prove its ROI.
• Marty (Yazaki): Raise the bar together. Start the conversation on an industry-standard certification requiring companies to map their supply chains to at least Tier 3 or Tier 4, then go a tier or two deeper every couple of years.

Keep the conversation going

We’re grateful to Microsoft for co-hosting, Steve, Tanya, Marty, and David for their candor, and to everyone who joined us in Detroit. The message from the room was consistent: due diligence is a team sport; it works best when risk data is connected to the business, and AI is most valuable when it helps people make better decisions faster.

That’s what we’re building toward with Resilinc and Microsoft 365 Copilot: supply chain risk and compliance intelligence in the flow of work, so the people responsible for risk can see it sooner and act on it with confidence.

Already a Resilinc customer? Contact your Resilinc team to get the Microsoft 365 Copilot connector set up. New to Resilinc? Contact us to see how multi-tier mapping, forced labor compliance, and tariff intelligence work inside Copilot. Preparing for DDRT requests? Watch our on-demand workshop with AIAG and Kharon.

Frequently asked questions

What is the AIAG Due Diligence Reporting Template (DDRT)?

The DDRT is AIAG’s standardized template for automotive suppliers to report their forced labor due diligence to OEM customers. It was designed as an accessible starting point, so suppliers at every level of maturity can begin documenting their supply chain work and improve over time. The template reports on due diligence; it doesn’t replace the process behind it.

How does Resilinc work with Microsoft 365 Copilot?

Resilinc connects to Microsoft 365 Copilot through a federated connector built on the Model Context Protocol (MCP). Authorized users ask questions in natural language and get answers grounded in their organization’s Resilinc multi-tier data, then use Copilot to create presentations, draft emails, and set up recurring updates. Existing Resilinc authentication, tenant isolation, licensing, and access controls continue to govern what each user can access.

How can suppliers tell whether forced labor exposure is a real business risk?

Connect each risk signal to the parts, plants, distribution channels, and vehicle programs it touches. If a flagged entity doesn’t reach the product flow going to a given customer or region, the exposure may not apply. If it does, the same connections show exactly where to act.

What is a practical first step for strengthening due diligence?

Run a realistic scenario, such as a detained shipment linked to a sub-tier supplier, with every function that would need to respond. The gaps you find in data, evidence, supplier engagement, and ownership become your priorities.