A weighted 100-point scoring framework for evaluating AI vendors across 5 security domains. Score each vendor objectively and make defensible procurement decisions.
Updated March 2026 · 5 scored domains · GDPR Article 28, ISO 27001, SOC 2 aligned
Standard vendor security questionnaires were designed for SaaS and cloud infrastructure — not for AI. AI vendors introduce unique risks around data training, model inference, and AI-specific attack vectors that traditional vendor assessments miss entirely. Using this scorecard alongside your standard TPRM process ensures AI vendors are evaluated on the criteria that matter most.
Click each domain to expand the scoring criteria. Use the scoring guidance to allocate points and document justifications for each criterion.
Data security is weighted highest because AI vendors process your organisation's data in the model inference pipeline. Weaknesses here directly translate to data exposure risk.
Verify AES-256 encryption at rest and TLS 1.2+ in transit. Request documentation showing encryption covers training pipelines, not just API transport. Score 8 if both verified with evidence, 4 if self-attested only, 0 if not confirmed.
Contractual commitment that customer data (prompts, documents, outputs) is not used to train or fine-tune the vendor's models. This must be a contractual term, not a marketing claim. Score 8 if in writing in the DPA/contract, 0 if only in marketing materials or not available.
Documented retention periods for all data categories processed (prompts, outputs, logs). Ability to request deletion and confirmation of deletion within a defined SLA. Score 6 if fully documented with deletion capability, 3 if partial, 0 if no documentation.
Verification that data from different customers is logically or physically isolated — particularly in multi-tenant inference environments. Score 5 if documented isolation architecture provided, 3 if attested, 0 if not addressed.
Ability to specify data processing location (e.g. EU-only for GDPR compliance). Score 3 if configurable with contractual commitment, 1 if regional deployment available but not contractual, 0 if no control.
A scorecard produces useful outputs only when applied consistently. Follow these five steps to run an evaluation that produces defensible, comparable results across vendors.
A point-in-time vendor assessment captures your vendors' security posture on one day. Aona monitors all AI vendor usage across your organisation continuously — tracking which vendors employees are using, what data is being shared, and whether approved vendor controls are actually in effect.
Book a Demo