50+ questions to evaluate any AI vendor before procurement. Free to use and customise.
Updated March 2026 - 5 domains - Governance, data handling, security controls, model security, compliance
When your team adopts an AI vendor, they are handing over some of the most sensitive data in your organisation - prompts containing customer records, financial analysis, legal documents, and intellectual property. Most procurement teams use standard vendor security questionnaires that were designed long before AI tools existed.
The risk is real: shadow AI adoption is outpacing procurement controls. Employees are using AI tools before security teams have assessed them. Vendors are training models on customer data without clear disclosure. And regulatory exposure from AI-related data breaches is growing as GDPR enforcement, the EU AI Act, and the Australian Privacy Act are all increasingly applied to AI processing.
This questionnaire gives security teams, CISOs, and procurement leads the AI-specific questions that standard frameworks miss. Use it before signing any contract with an AI vendor, and revisit it annually or after significant vendor changes.
Click each section to expand the questions. Score each section from 0 to 10 based on the completeness and credibility of vendor responses.
Does the vendor have a published AI ethics or responsible AI policy?
Who is accountable for AI governance at the vendor? (CAIO, CTO, dedicated team?)
Does the vendor maintain an AI risk register or inventory of AI systems?
Do they publish model cards or transparency reports for their AI models?
Is there an AI incident disclosure process - will they notify you of AI-related security events?
What is their policy on using customer data for model training or fine-tuning?
Do they have a process for human oversight of high-stakes AI decisions?
Have they conducted an AI impact assessment or ethical review?
Is there a process for customers to contest or appeal AI-generated decisions?
Do they have a documented AI change management process for model updates?
Score each of the five sections from 0 to 10 based on the quality and completeness of vendor responses. Add the scores for a total out of 50. Use the table below to determine your procurement recommendation.
A total score is a starting point, not a final decision. A vendor scoring 40 overall may still have a critical gap in data handling that creates regulatory risk. Always review individual section scores and flag any question where the vendor provides no evidence or declines to answer - these are your highest-risk areas regardless of total score.
Download the complete AI vendor security questionnaire as a formatted PDF ready to send to your vendors. Includes scoring columns, guidance notes, and evidence request checklist.
Start Free Trial