AI Vendor Security Questionnaire: 33 Questions With Good Answers, Red Flags and Scoring

An AI vendor security questionnaire is the set of questions you send an AI supplier before its model, platform or embedded feature touches your data: whether it trains on your inputs, how long it keeps them, who else processes them, how it resists prompt injection and limits agent permissions, what it logs, how it reports incidents, its EU AI Act role and how you leave.

The question bank below has 33 questions in eleven domains, each with the answer you want and the answers that should slow or stop a deal. The frameworks, regulations and versions it relies on were checked on 14 October 2026. It is a working tool for security, privacy and procurement teams, not legal advice.

Our procurement guide covers how to run the whole evaluation, and our procurement checklist for regulated organisations covers contract clauses and the exit test. This page is the security and data part, ready to paste into an email or a GRC tool.

Which frameworks the questionnaire draws on

Templates that cite the 2025 OWASP numbering need updating, since Excessive Agency was LLM06 there. Agent-specific risks sit in OWASP’s separate Top 10 for Agentic Applications, announced on 9 December 2025, including ASI02 Tool Misuse and Exploitation and ASI03 Identity and Privilege Abuse.

The AI vendor due diligence questionnaire

Number the questions so that answers can be scored and quoted in the contract, and ask for evidence with each one: a clause, a report, a screenshot or a test you can repeat.

1. Data use and model training

2. Retention and deletion

3. Sub-processors and data location

For how location differs from control, see our note on data sovereignty and data residency.

4. Model provenance and licences

5. Security testing and red-teaming

6. Prompt injection and agent permissions

An injected instruction can only do what the agent’s permissions allow, which is why 6.2 deserves more weight than 6.1.

7. Identity and access

8. Logging and audit

9. Incident response

10. EU AI Act role and obligations

If you build your own high-risk system on the vendor’s model or tools, Article 25(4) requires a written agreement covering the information, technical access and assistance you need as its provider. Public bodies preparing a fundamental rights impact assessment will reuse the answers to 10.2.

11. Exit and portability

For services that count as data processing services, the Data Act requires switching terms in the contract, a notice period of no more than two months and a transition of no more than 30 days (Article 25), and bars switching charges from 12 January 2027 (Article 29).

How to score vendor questionnaire answers

Score each answer from 0 to 3:

Then weight the domains by use:

Pick three to five knock-out questions before the answers arrive, so that no total can buy them back: typically 1.1 for confidential data, 3.3 where data must stay in a jurisdiction, 6.2 for agents with write access, 10.1 and 11.1. A workable rule is to proceed at a weighted average of 2.0 or more with no failed knock-out, to proceed only with remediation terms in the contract between 1.5 and 2.0, and to stop below 1.5. Treat those thresholds as a starting point to calibrate. Record each score and its evidence in your risk register; our AI risk assessment template has a vendor section.

Running the AI vendor assessment questionnaire

1. Tier the vendor first. A feature that sees only public data needs domains 1 to 3 and 8; an agent with write access to finance systems needs all eleven.
2. Ask for what already exists: a completed AI-CAIQ or STAR Registry entry, certificates with their scope, the latest test summary, the data processing agreement, the sub-processor list, model documentation and, for high-risk uses, the instructions for use.
3. Send only the gaps, with a deadline and an evidence requirement per question.
4. Verify in the pilot. Block outbound traffic and see what fails, export the logs, and run a known prompt-injection case against your own documents.
5. Write the answers into the contract: training ban, retention periods, sub-processor notice, incident deadlines, version pinning and exit assistance. EU public buyers can start from the Commission-hosted model contractual clauses for AI, in a full version for high-risk systems and a light one for others.
6. Ask again on every trigger: a new model, sub-processor or agent capability, a serious incident, and each renewal.

The functional side of the evaluation sits in our RFP checklist, and the AI vendor risk agent reads returned questionnaires and certificates against your criteria and reports missing evidence as findings.

Vendor questionnaire examples: answers to read twice

• “We never train on your data.” Ask where the contract says so, whether it covers feedback, and whether it binds the model provider underneath.
• “We hold ISO/IEC 42001 certification.” Ask for the certificate, the certification body and the scope; a certificate for one product line says little about another.
• “Zero data retention.” Ask whether that covers abuse-monitoring logs, caches and backups.
• “Agents only do what the user could do.” Ask for the permission model and a log of a blocked action. A shared service account makes the statement untrue.

How VDF AI fits

VDF AI is a vendor too, and answers questionnaires like this one against a concrete reference architecture. Its trust center sets out the deployment models, controls and sub-processor position for security and procurement reviews.

In a self-hosted deployment, many answers describe your environment rather than ours. On-premises, private cloud and air-gapped deployments need no third-party model API for production inference, data stays inside your perimeter, and you set retention and log export. Role-based access control is included on every plan, audit events can stream to your SIEM, and VDF AI Router keeps each workload on approved models, with an air-gap mode that routes only to local ones. Questions on updates, vulnerability handling and model provenance still apply to us.