Send this AI vendor assessment questionnaire to any AI provider before you share company or client data. The questions cover data use, security, compliance and AI-specific risks, and follow what clients and regulators expect. Copy it into an email or download it as a Word document.
Tip: check the vendor's SafeScore first. If the answer is already public, you only need to ask the vendor to confirm it.
Section A: Company
- Legal name, registered address and country of the company providing the service.
- Which product, plan and version does this questionnaire cover?
- Which AI models power the product (your own or third-party, such as OpenAI, Anthropic or Google)?
- Which sub-processors handle our data, and in which countries?
Section B: Data use and privacy
- Is our content (prompts, files, outputs) used to train or improve any AI model? If so, can it be switched off, and is it off by default on our plan?
- How long do you keep our content, logs and backups? Can we delete them, and how quickly is deletion complete?
- Where is our data stored and processed? Can we choose the region?
- Will you sign a data processing agreement (DPA)? Do you support GDPR and CCPA rights?
- Can your staff access our content? Under what conditions, and is access logged?
- For health data: will you sign a HIPAA business associate agreement (BAA)?
Section C: Security
- Do you hold SOC 2 Type II, ISO/IEC 27001 or similar? Please share the latest report or certificate.
- Is data encrypted in transit and at rest? Who manages the keys?
- Do you support SSO/SAML, role-based access and audit logs?
- Do you run penetration tests and have a vulnerability disclosure or bug bounty programme?
- How and how fast will you notify us of a security incident affecting our data?
Section D: AI-specific risks
- Do you follow an AI risk framework or standard (ISO/IEC 42001, NIST AI RMF)? Are you certified?
- How do you test for accuracy, bias and harmful outputs? How do you reduce hallucinations?
- What protections do you have against prompt injection and misuse, especially for agents or integrations?
- Who owns the outputs? Do you offer IP indemnity?
- Can we review, approve or block actions before the AI takes them (human oversight)?
- How do you label AI-generated content, and how do you meet EU AI Act transparency duties where they apply?
Section E: Contract and exit
- What is your uptime commitment and support response time?
- Can we export all our data in a standard format if we leave?
- How will you tell us about changes to these terms or to the models you use?
Scoring the answers
Mark each answer green (meets our needs), amber (acceptable with conditions) or red (not acceptable). Any red in Section B or C for a tool that will see confidential data should stop the approval. Record the result in the AI risk register.