Ask an AI vendor where your data goes, whether it trains models, which model providers it uses, how long it keeps prompts and outputs, how access is controlled, and how it tests for misuse. The answers decide whether the tool fits a low, standard or critical tier in your vendor program.
Why AI vendors need extra questions
A normal software vendor stores your data. An AI vendor may also send it to a model provider, log prompts, and let the model act on your systems. That adds subprocessors, new retention paths and new ways for text to cause actions. Your standard questionnaire may not ask about these.
The ten questions
- Training. Is our data, including prompts and outputs, used to train or improve any model? Is that off by default, and in writing?
- Model providers. Which model providers receive our data? Are they listed as subprocessors, and are you told before they change?
- Retention. How long are prompts, outputs and uploaded files kept, by you and by the model provider? Can we set it?
- Deletion. Can we delete our data on request, and does deletion reach the model provider and backups?
- Location. Where is data processed and stored, including by the model provider?
- Access control. Does the tool respect our existing permissions, or can a user ask it to surface content they cannot normally open? How do we separate tenants?
- Actions. What can the AI do on our behalf: send email, change records, run code? Can actions require human approval? Can we limit them?
- Prompt injection. How do you handle untrusted content, such as web pages and documents, that tries to give the model instructions? Be wary of answers that depend only on a system prompt.
- Logging. Can we see logs of what the AI did and with which data? Can we export them?
- Incidents. Does the contract require notice of incidents, including at the model provider? Within how many hours?
How to judge the answers
- Good: specific, written, and consistent between the contract, the privacy terms and the questionnaire.
- Weak: "we take privacy seriously" or answers that cannot name the model provider.
- Worth a pause: training on customer data enabled by default for your plan, or no way to turn off retention.
Treat vendor claims about safety measures as claims until you see evidence or can test them.
Match it to your tier
Low-risk uses, such as drafting public marketing text, can pass with lighter review. Anything that touches customer data, credentials or production systems belongs in your critical tier. See how to tier vendors.
Related reading
If the AI can call tools, read our checklist on excessive agency, and for guardrail limits see whether a system prompt can stop prompt injection.
Quick check
Is it enough that the vendor says it does not train on our data?
Get it in the contract or terms, and check whether the model provider behind it has the same commitment.
Do AI vendors need a different questionnaire?
Add AI specific questions to your standard one. The ten above are a practical starting set.
Last reviewed: 19 October 2026.
