Security and compliance questionnaire

AI Vendor Risk Assessment Questionnaire

This interactive worksheet helps procurement and vendor management teams assess security and compliance risks associated with AI vendors. It guides users through key risk factors with scored inputs, producing an overall vendor risk rating to support decision-making.

Evaluating AI vendors requires a structured approach to identify security and compliance risks that could impact enterprise operations or data governance. This interactive questionnaire covers critical areas such as data handling, model transparency, third-party audits, and incident response.

Fill out the following fields based on vendor documentation, compliance certifications, and security policies. Answers generate a cumulative risk score to inform procurement decisions and ongoing risk management.

Inputs

Does the vendor encrypt customer data at rest and in transit?

Yes, uses strong encryption standards (e.g., AES-256, TLS 1.3)Partial encryption (only in transit or at rest)No or unclear encryption policies

Refer to vendor security whitepapers or documentation.

Has the vendor undergone third-party security audits or certifications (e.g., SOC 2, ISO 27001)?

Yes, multiple relevant certifications or auditsLimited audit scope or outdated certificationsNo third-party audits or certifications

Verify recent audit reports or certification status.

Does the vendor provide model explainability features for AI outputs?

Yes, detailed explainability tools and documentationBasic or partial explainability capabilitiesNo explainability features offered

Check product specs or compliance disclosures.

Does the vendor have a documented incident response and breach notification plan?

Yes, detailed and compliant with regulatory timelinesPlan exists but lacks detail or regulatory alignmentNo formal plan disclosed

Review contract terms and vendor policies.

Is the vendor's data retention and deletion policy clear and aligned with your compliance requirements?

Yes, policy matches or exceeds your standardsPolicy partially meets requirements or has exceptionsPolicy is unclear or insufficient

Consult vendor contract and data processing agreements.

Does the vendor enforce strong identity and access management (IAM) controls?

Yes, industry-standard strong IAM practicesBasic IAM controls but gaps presentWeak or no IAM controls

Look for multifactor authentication, role-based access controls.

Result

Vendor Risk Score (out of 18)

(data_encryption + third_party_audit + model_explainability + incident_response_plan + data_retention_policy + access_controls)

High risk

The vendor demonstrates adequate security and compliance controls for most enterprise AI use cases.

Tip

Use this questionnaire as part of a broader vendor due diligence process, including in-depth contract review and technical validation where possible.

Subsequent sections unlock after submit