AI Vendor Security Questionnaire: 30 Questions to Ask Before Signing a DPA
LLM due diligence checklist with scoring, DPA clauses, and AI-011 intake workflow.
Procurement teams evaluating LLM API providers, fine-tuning platforms, or embedded AI features in SaaS commonly receive a standard DPA that omits AI-specific risks — prompt retention, training use, jurisdictional routing, output IP exposure, and limited model transparency.
Standard DPAs were written for databases and SaaS applications, not probabilistic models that retain prompts for training, route data across jurisdictions, generate outputs with IP risk, and operate as limited black boxes.
This guide provides a production-ready AI vendor security questionnaire: 30+ copy-paste questions by risk domain, a scoring model, evidence requests, and mapping to AI-011 Vendor Intake and AI-012 DPA Addendum workflows.
Operational guidance only. This guide supports AI vendor due diligence. It is not legal advice. Engage counsel for contract negotiation and regulatory obligations.
LLM due diligence checklist, third-party AI risk assessment, AI procurement review — same structure regardless of name.
On this page
Quick Self-Assessment: Vendor Review Readiness
- We classify AI vendors differently from traditional SaaS
- We require model-specific disclosures (training, retention, fine-tuning)
- We verify whether prompts are used for model improvement
- We require jurisdictional transparency for inference routing
- We have a DPA addendum addressing AI-specific risks
5/5: ahead of most peers · 3–4: foundation, needs AI enhancements · 0–2: use this questionnaire as the baseline.
AI Vendor Risk Tiering Matrix
| Tier | Criteria | Scope | Approval |
|---|---|---|---|
| Critical | PII/PHI, customer-facing AI, business decisions | Full 30+ questions + contract negotiation | CISO + Legal + Business Owner |
| High | Internal business data, employee workflows | Core ~20 questions + DPA addendum | Security Lead + Legal |
| Medium | Non-sensitive read-only, prototyping | Basic ~10 questions + standard DPA | Business Owner + Procurement |
| Low | Public data only, no persistence/fine-tuning | Self-attestation + annual re-check | Procurement |
When uncertain, default to a higher tier. Scale down after evidence, not after an incident.
Vendor Evaluation Scoring Model
| Response | Score | Meaning |
|---|---|---|
| ✅ Acceptable | 2 | Meets requirements |
| ⚠️ Negotiation | 1 | Partial; contract terms needed |
| ❌ Red flag | 0 | Dealbreaker or executive risk acceptance |
Pro tip: Weight critical questions (Q1, Q4, Q25, Q28) at 3 points each.
Which Questions Matter Most by Vendor Type
LLM API providers
Prioritize Q1–Q4, Q2a, Q16, Q24–Q25 — training opt-out, retention, routing, versioning, audit logs.
AI SaaS platforms
Prioritize Q20, Q24–Q25, Q5, Q27 — SSO/SCIM, logging, subprocessors, DPA addendum.
Fine-tuning platforms
Prioritize Q12–Q13, Q28, Q32 — training isolation, output rights, export, deletion post-training.
Embedded AI features
Prioritize Q5, Q1, Q3, Q13, Q33–Q34 — hidden subprocessors, retention, vector/RAG controls.
AI-012 DPA Addendum: Key Clauses to Negotiate
When standard DPAs fall short, attach AI-specific terms from AI-012 as Exhibit B. Align privacy processor terms with PRI-004.
OpenAI, Anthropic, and similar vendors often won’t negotiate individual DPAs. Minimize risk via settings (training opt-out, data restrictions), compensating controls (prompt DLP), and documented executive risk acceptance.
The 30+ Question AI Vendor Security Questionnaire
Copy into your AI-011 intake. Request evidence: SOC 2, ISO certs, subprocessor list, DPA, model card, retention docs, pentest summary.
Data handling & retention (Q1–Q9)
| # | Question | Red flag |
|---|---|---|
| 1 | Do you retain customer prompts/inputs for training or improvement? | “Anonymized improvement” without clear opt-out |
| 2 | Retention period and deletion process if retained? | No customer-controlled deletion |
| 2a | Zero-retention / in-memory-only processing mode? | Mandatory logging with no opt-out |
| 3 | Opt out of prompt logging entirely? | Logging required for reliability, no exceptions |
| 4 | Where are inference requests processed (regions)? | Global routing without disclosure |
| 5 | Subprocess data to third-party model providers? | Subprocessors without notice or list |
| 6 | Tenant isolation during inference? | Generic multi-tenant only |
| 7 | Customer-managed encryption keys (BYOK)? | Platform-only encryption |
| 8 | Breach notification timeline? | Only “per applicable law” |
| 9 | Do documents enter a vector/RAG database? | Vector architecture “proprietary” |
Model governance & transparency (Q10–Q18)
| # | Question | Red flag |
|---|---|---|
| 10 | Model card / system card available? | No disclosure of capabilities/limitations |
| 11 | Training data sources; exclusion options? | No recourse on training composition |
| 12 | Bias, fairness, safety evaluations documented? | Generic filters only |
| 13 | Fine-tuning on customer data — protection & deletion? | Cross-customer model improvements |
| 14 | Configurable output filtering (PII, toxicity, copyright)? | Non-customizable moderation |
| 15 | Copyright/IP claims process and indemnification? | Customer solely liable for outputs |
| 16 | Audit/validate model behavior for our use case? | No external validation |
| 17 | Model versioning and deprecation policy? | Updates without notice |
| 18 | Documented AI governance (ISO 42001 / NIST AI RMF)? | “Frameworks not applicable” |
Q18 context: ISO 42001 certification is still emerging — focus on underlying controls, not the certificate alone.
Security & compliance (Q19–Q26)
| # | Question | Red flag |
|---|---|---|
| 19 | SOC 2 Type II, ISO 27001, or equivalent? | “Pursuing” without evidence |
| 20 | API key management and rotation? | Long-lived vendor-only keys |
| 21 | SSO/SAML and SCIM? | Manual user admin only |
| 22 | Vulnerability disclosure and patching SLA? | No committed timelines |
| 23 | Pentest/red team for AI attack vectors? | AppSec only |
| 24 | Prompt injection / jailbreak defenses? | Training-only; no runtime filters |
| 25 | Audit logs of API usage, prompts, outputs? | Logs only via support ticket |
| 26 | Embedding protection and deletion in vector DBs? | No customer-accessible deletion |
Legal & contractual (Q27–Q34)
| # | Question | Red flag |
|---|---|---|
| 27 | DPA includes AI-specific addendum? | One-size DPA for all services |
| 28 | Who owns model outputs? | Vendor license to customer outputs |
| 29 | Indemnification for copyright/IP claims? | Excludes third-party IP |
| 30 | Liability caps for AI-specific failures? | No liability for accuracy/appropriateness |
| 31 | Terminate for cause if data practices change? | No unilateral termination rights |
| 32 | Export fine-tuned models on switch? | Proprietary, non-portable weights |
| 33 | Export/destroy embeddings on termination? | Deletion not customer-accessible |
| 34 | Vector stores isolated per customer? | Isolation not disclosed |
Q29 context: Major LLM APIs often don’t offer broad output IP indemnification — use filters, takedown process, and legal sign-off.
Automatic escalation triggers
Escalate to security/legal immediately if a vendor:
- Uses prompts for training without explicit opt-in
- Refuses subprocessors or inference regions
- Won’t commit to breach notification timelines
- Refuses AI control audit rights
- Can’t explain retention/deletion
- Updates models without notice or migration path
- Retains rights to outputs or fine-tuned models
- Lacks vector/embedding isolation
Negotiation priority matrix
| Priority | Focus | Key questions |
|---|---|---|
| 🔴 Must have | Data control & ownership | Q1, Q8, Q27, Q28 |
| 🟡 Strongly prefer | Transparency | Q4, Q5, Q10, Q18, Q25 |
| 🟢 Nice to have | Advanced controls | Q7, Q21, Q16, Q32–Q34 |
AI-011 Vendor Intake Workflow
RACI
| Activity | Procurement | Security | Legal | Business |
|---|---|---|---|---|
| Classify risk tier | R | C | I | C |
| Send questionnaire | R | C | C | I |
| Review security answers | I | R | C | I |
| Review DPA terms | I | C | R | I |
| Score & escalate | C | R | C | I |
| Approve onboarding | C | C | C | A |
R = Responsible, A = Accountable, C = Consulted, I = Informed
Steps
- Classify — use tiering matrix; log in AI-006 (e.g.
AI-VEN-003,OpenAI,GPT-4 API,High,Annual). - Send questionnaire — written answers from security/legal, not sales only; ~10 business day deadline.
- Score — 2/1/0 model; weight critical questions; document risk acceptances.
- Negotiate — AI-012 addendum for gaps.
- Approve & monitor — RACI sign-off; annual or trigger-based re-validation.
Vendor non-response
- Follow up (+5 business days)
- Escalate to vendor relationship manager
- Engage vendor security directly
- Offer a call if written response stalls
- Document non-response as a risk factor
- For Critical tier, treat persistent non-response as a potential dealbreaker
Evidence for audits
| Evidence | Supports |
|---|---|
| Completed questionnaires + evaluations | SOC 2 CC3.2, ISO 42001 A.8.2, GDPR Art. 28(8) |
| Risk tier documentation | SOC 2 CC3.1, ISO 42001 A.5.2 |
| Negotiated AI DPA addenda | SOC 2 CC9.2, GDPR Art. 28(3) |
| SOC 2 / ISO / pentest summaries | SOC 2 CC3.2, ISO 42001 A.10.2 |
| Stakeholder approval records | SOC 2 CC1.2, ISO 42001 A.5.3 |
| Annual re-validation logs | ISO 42001 A.8.3, SOC 2 CC7.2 |
Shadow AI discovery
Include unsanctioned tools: browser assistants, meeting AI, CRM AI, Copilot/Cursor, support AI, Notion/Grammarly AI. Tactics: SSO logs, expense reports, engineering surveys, API endpoint monitoring. See the dedicated shadow AI inventory spreadsheet guide and ISO 42001 register walkthrough.
Major LLM providers (OpenAI, Anthropic, Google)
Same questionnaire — emphasize Q1–Q5, Q16, Q25, Q28–Q29. Expect limited DPA negotiation; document compensating controls and annual re-review.
Get the AI-011 Vendor Intake Kit
Procurement-ready questionnaire and DPA addendum from the AI Governance Toolkit.
- AI-011 vendor security intake questionnaire (docx)
- AI-012 AI vendor contracting & DPA addendum
- Pair with AI-006 system register for approved vendors
- Align processor terms with PRI-004 for GDPR/CCPA
Related controls & resources
- DPA guide for SaaS startups
- ISO 42001 AI register walkthrough
- Shadow AI inventory spreadsheet
- EU AI Act Article 50 disclosures
- Prevent source code leaks to AI tools
FAQ
Implementation checklist
- Classify vendor with tiering matrix
- Send prioritized questions by vendor type
- Score responses; escalate per triggers
- Negotiate AI-012 addendum for critical/high vendors
- Document risk acceptances with executive sign-off
- Add vendor to AI-006 with review cadence
- Configure technical controls (opt-out, logging, data limits)
- Collect SOC 2, model card, subprocessor list, DPA
- Schedule annual or trigger-based re-validation
- Retain evidence mapped to audit controls
Complete this questionnaire before the first production prompt to an LLM API, AI SaaS platform, or embedded AI feature — due diligence upfront reduces incident remediation downstream.