AI Vendor SecurityQuestionnaire
Sixty questions to ask any AI vendor before they touch your data, plus the red-flag answers that should stop a purchase. Built by Petronella Technology Group for defense contractors, medical practices, and regulated firms buying AI in 2026.
Key Takeaways
- An AI vendor security questionnaire is a structured set of due-diligence questions that establishes how an artificial intelligence provider trains, hosts, isolates, logs, and retains the data you send it, before you sign anything.
- Standard vendor questionnaires do not cover AI risk. They ask about encryption and SOC 2 but never ask whether your prompts become training data, who the model subprocessors are, or how the vendor handles prompt injection.
- The eight domains that matter are model provenance, training data handling, tenancy and retention, prompt injection and output safety, identity and access, logging and incident response, compliance and contracts, and subprocessors and data sovereignty.
- For defense contractors, a single AI vendor that processes controlled unclassified information outside an authorized boundary can undo a CMMC assessment. The questionnaire is assessment evidence, not paperwork.
- Petronella Technology Group runs these reviews as a fixed-scope engagement and produces the completed questionnaire, a risk rating, and contract language your counsel can use.
What Is an AI Vendor Security Questionnaire?
An AI vendor security questionnaire is a structured due-diligence document that a buying organization sends to an artificial intelligence provider to establish, in writing, how that provider handles data, models, and access before a contract is signed. It differs from a general vendor security questionnaire because it asks about risks that only exist when a large language model or machine learning system sits in the data path: whether your inputs are used for training, which foundation model sits underneath the product, who the model subprocessors are, how the vendor defends against prompt injection, and what happens to your data when you terminate.
The document has two jobs. The first is decision support: it gives your security team a defensible basis to approve, conditionally approve, or reject a purchase. The second is evidence. Under CMMC, HIPAA, SOC 2, and the FTC Safeguards Rule, you are required to assess service providers before entrusting them with regulated data, and a completed, dated, signed questionnaire is the artifact an assessor will ask to see.
In our 24 years since 2002, Petronella Technology Group has watched the vendor-review problem repeat with every technology wave. What is different about AI is the speed of adoption and the invisibility of the data path. A department can buy an AI note-taker with a credit card on Tuesday and have four months of client conversations in a vendor's retention window by Friday, and nobody in security ever saw a purchase order. That is why the questionnaire has to be short enough to actually get used and specific enough to catch the failures that matter.
Why Your Standard Vendor Questionnaire Misses AI Risk
Most organizations already run vendor due diligence using a general-purpose questionnaire, often derived from a standardized industry template or a homegrown spreadsheet built years ago. Those documents are not wrong. They are simply blind in the places AI creates exposure.
A general vendor questionnaire asks whether data is encrypted at rest and in transit. An AI vendor can answer yes to that truthfully while still training its next model on your prompts, because training happens after decryption inside the vendor's own trusted boundary. Encryption was never the control that governed that behavior.
A general questionnaire asks whether the vendor holds a SOC 2 Type II report. An AI vendor can hold a valid SOC 2 covering its application infrastructure while the foundation model it calls is operated by an entirely separate company under an entirely separate control environment that the report never scoped. The certificate is real and the gap is also real.
A general questionnaire asks about subprocessors. Most AI vendors do disclose them, but the disclosure typically names a cloud host and stops. It rarely names the model provider, the vector database, the embedding service, the evaluation vendor, or the human review contractor who may read flagged conversations for quality assurance. Each of those is a place your data goes.
Finally, a general questionnaire has no concept of output risk. Traditional software either returns your data or it does not. An AI system generates new content that can leak information from other tenants, follow instructions embedded in a malicious document, or confidently produce a wrong answer that a staff member acts on. None of the standard control families describe that failure mode. This is the same reasoning behind our guidance on large language model security and detecting unsanctioned AI use.
| Risk | Standard Vendor Questionnaire | AI Vendor Security Questionnaire |
|---|---|---|
| Your data becomes training data | Not asked. Encryption questions do not reach it. | Asked explicitly, per data class, with an opt-out clause requirement. |
| Undisclosed foundation model provider | Subprocessor question stops at cloud hosting. | Model provenance section names every upstream model and its operator. |
| Prompt injection via uploaded documents | No equivalent control family exists. | Dedicated domain covering input sanitization and tool-use limits. |
| Cross-tenant leakage through shared embeddings | Multi-tenancy asked generically, if at all. | Asked at the vector store and cache layer specifically. |
| Human review of your conversations | Rarely surfaced. | Asked directly, including contractor access and geography. |
| Retention after termination | Asked for records, not for model artifacts. | Covers prompts, outputs, embeddings, logs, and fine-tuned weights. |
Buying AI and unsure what to ask?
Petronella Technology Group runs vendor security reviews for regulated organizations across Raleigh, Durham, and the Research Triangle, and nationwide. We complete the questionnaire with the vendor, score the result, and hand your counsel the contract language that closes the gaps.
Schedule a Free ConsultationThe Eight Domains That Matter
Every question below belongs to one of eight domains. If you shorten this questionnaire for a low-risk purchase, shorten it by taking fewer questions from each domain rather than by dropping a domain entirely. Each domain exists because a different class of incident lives there.
- Model provenance and supply chain. What model is actually running, who operates it, and what changes without telling you.
- Training data and your data. Whether your inputs improve the vendor's product, and whether you can refuse.
- Tenancy, isolation, and retention. Where your data sits, who it sits next to, and how long it stays.
- Prompt injection and output safety. What happens when a hostile instruction arrives inside otherwise normal content.
- Identity, access, and administrative control. Who at the vendor can read your data, and who at your organization can see that they did.
- Logging, monitoring, and incident response. Whether an incident would be detected, and whether you would be told.
- Compliance, certification, and contracts. What is attested, what is scoped out, and what is contractually binding.
- Subprocessors, hosting, and data sovereignty. Every other company that touches the data, and every jurisdiction it enters.
The 60-Question AI Vendor Security Questionnaire
Send these to the vendor in writing and require written answers. Verbal assurances from a sales engineer are not evidence, and in our forensics practice they are frequently contradicted by the vendor's own documentation once an incident is under investigation. Ask for the answers to be signed by someone who can bind the company.
Domain A: Model Provenance and Supply Chain
- Which specific foundation or base models does your product call, by name and version, for each feature we would use?
- Which company operates each of those models, and is that company a subprocessor under our agreement?
- Do you host the model weights yourself, or do you call a third-party inference API?
- How will you notify us before you change the underlying model, and what notice period do we get?
- Have you fine-tuned or otherwise modified any model using customer data, and if so, whose?
- Do you use open-weight models, and if so, what is your process for validating their integrity before deployment?
- What happens to our workload if your upstream model provider suspends or deprecates the model you depend on?
- Can you provide a bill of materials listing every model, library, and inference service in the data path?
Domain B: Training Data and Our Data
- Are our prompts, uploads, or outputs used to train, fine-tune, or evaluate any model, yours or a third party's?
- If yes, is opting out available on our contract tier, and is the opt-out contractual rather than a settings toggle?
- Does the opt-out flow through to your upstream model provider, and can you evidence that it does?
- Are our inputs used to build embeddings or caches that persist beyond the immediate request?
- Do humans at your company or at any contractor ever read our prompts or outputs, including for abuse review or quality scoring?
- If humans review our content, where are those reviewers located and under what contractual confidentiality terms?
- Can we designate certain data classes, such as protected health information or controlled unclassified information, as never eligible for retention or review?
- What is your documented process if a customer discovers their regulated data was used in training?
Domain C: Tenancy, Isolation, and Retention
- Is our data logically or physically isolated from other customers, and at which layers: application, database, vector store, and cache?
- Do you use a shared vector index across tenants for any feature, including search or recommendations?
- How long are prompts and outputs retained by default, and can that window be reduced by contract?
- How long are inference logs retained, and do those logs contain prompt or output content?
- What is retained after we terminate: prompts, outputs, embeddings, logs, fine-tuned weights, and backups?
- What is your documented timeline for complete deletion after termination, including from backups?
- Will you provide written certification of deletion, signed, on request?
- Can we deploy your product in a single-tenant, in-region, or on-premise configuration, and at what commercial terms?
Domain D: Prompt Injection and Output Safety
- How do you defend against prompt injection delivered inside documents, emails, web pages, or images that users submit?
- Does your system have tool-use or agentic capability, and if so, what actions can it take without a human approving them?
- Can the model access the internet, internal systems, or file storage during a request, and can we restrict that?
- What guardrails prevent the model from returning data belonging to a different customer or a different user in our tenant?
- Do you enforce authorization at the data layer, or does the model see more than the requesting user is entitled to see?
- What is your process for testing the system adversarially, and how often is it performed?
- Will you share the results, or a summary, of your most recent adversarial testing of this product?
Domain E: Identity, Access, and Administrative Control
- Which roles at your company can access our data in production, and how many people currently hold those roles?
- Is that access broken-glass and time-bound, or standing?
- Are administrative actions against our tenant logged and made visible to us in near real time?
- Do you support single sign-on, SCIM provisioning, and enforced multifactor authentication on our contract tier?
- Can we enforce role-based restrictions on which of our users may use which AI features?
- How do you authenticate our administrators when they contact your support, and can support staff change security settings on our behalf?
- Do you support customer-managed encryption keys, and does key revocation actually render data inaccessible?
Domain F: Logging, Monitoring, and Incident Response
- What audit logs are available to us, and can we export them to our own security monitoring platform?
- Do logs capture who accessed what data, including access by your own staff?
- What is your contractual breach notification timeline, in hours, from your determination of an incident?
- Does that timeline meet the 72-hour cyber incident reporting expectations that apply to our defense or healthcare obligations?
- Who at your company leads incident response, and will we get a named contact at contract signature?
- Have you had a security incident affecting customer data in the past 24 months, and can you describe it?
- Will you participate in our incident response exercises, and will you support a forensic investigation if we require one?
Domain G: Compliance, Certification, and Contracts
- Which certifications do you hold, and can we see the full report rather than the certificate?
- What is explicitly excluded from the scope of that report, and does the AI functionality fall inside or outside it?
- Does the certification cover your upstream model provider, or only your own infrastructure?
- Will you sign a business associate agreement if we process protected health information?
- Can you support controlled unclassified information handling requirements, and in which authorized environment?
- Do you align to a recognized artificial intelligence risk framework, and can you show the mapping?
- Will you accept contractual liability for a breach caused by your subprocessor?
- Will you commit to advance notice before any change that materially affects the security posture we are approving today?
Domain H: Subprocessors, Hosting, and Data Sovereignty
- Provide a complete current list of subprocessors, including model providers, vector stores, and human review contractors.
- In which countries is our data stored, processed, and cached, including transient inference traffic?
- Can we contractually pin processing to a specific region or to the United States only?
- How much notice do we receive before you add or change a subprocessor, and can we object?
- Do any subprocessors operate from jurisdictions that would conflict with our regulatory or contractual obligations?
- Is any part of your support, engineering, or review workforce offshore, and do they access customer data?
- If we require a fully sovereign or on-premise deployment, is that available, and what functionality is lost?
Red-Flag Answers: What Should Stop a Purchase
A vendor is allowed to have gaps. Every vendor does. What matters is whether the answer is specific, whether the gap is disclosed, and whether the vendor will accept contract language that constrains it. The answers below are the ones that, in our experience, correlate with real trouble later.
| Answer You Receive | Why It Is a Red Flag | What to Require Instead |
|---|---|---|
| "We take security very seriously and use bank-level encryption." | Non-answer. Encryption does not govern training, retention, or human review. | A written answer to the specific question asked, signed. |
| "We do not train on customer data." (no scope stated) | Frequently true of the vendor and untrue of its upstream model provider. | The commitment restated to cover all subprocessors, in the contract. |
| "You can turn that off in settings." | A settings toggle can be changed by a product update or a support agent. | The same control expressed as a contractual obligation. |
| "We are SOC 2 compliant." (declines to share the report) | The exclusions are the interesting part, and the AI feature is often excluded. | The full report under a mutual nondisclosure agreement. |
| "Our subprocessor list is available on our website." (list names only a cloud host) | Incomplete disclosure of the model provider is the single most common finding. | A complete list naming every model and review contractor. |
| "We will notify you of a breach promptly." | "Promptly" is unenforceable and will not satisfy a 72-hour reporting obligation. | A stated number of hours from determination, in the contract. |
| "No customer has ever had a security incident with us." | Either the vendor is new, or it lacks the detection capability to know. | A candid answer plus evidence of monitoring and logging. |
| Vendor will not commit to any deletion timeline after termination. | Your regulated data lives in their environment indefinitely. | A documented timeline plus written certification of deletion. |
Scoring the Results and Making a Decision
A questionnaire that produces a stack of paper and no decision has failed. Tier the vendor first, then score against the tier. A transcription tool used by the marketing team and a clinical documentation assistant touching patient records do not deserve the same review depth, and pretending they do is how organizations end up doing neither review well.
Tier the purchase before you score it
- Tier 1, regulated data. The vendor will process protected health information, controlled unclassified information, cardholder data, or privileged legal material. All 60 questions, contract review by counsel, and annual reassessment.
- Tier 2, confidential business data. Financial records, source code, customer lists, strategic plans. All 60 questions, with Domains B, C, and G weighted heaviest.
- Tier 3, public or low-sensitivity data. Marketing copy, public research. A reduced set drawn proportionally from each domain, with retention and training questions kept in full.
Score each domain, not the vendor as a whole
Rate each of the eight domains as acceptable, acceptable with contract language, or unacceptable. A single unacceptable domain in a Tier 1 purchase should block the purchase regardless of how strong the other seven are, because the domains are not compensating controls for one another. Strong logging does not repair a vendor training on your patient data.
Where a domain is acceptable only with contract language, write the specific clause before approval, not after. The point of leverage is the moment before signature, and it does not come back. Our third-party risk management practice keeps a clause library for exactly this reason, and our AI governance consulting engagements fold the resulting decisions into a governance record that survives staff turnover.
Mapping the Questionnaire to Your Compliance Obligations
The questionnaire is not only a purchasing control. For most regulated organizations it is required evidence, and the completed document should be filed where an assessor can find it.
| Framework | Why Vendor AI Review Is Required | Domains That Carry the Evidence |
|---|---|---|
| CMMC 2.0 and NIST SP 800-171 | Controlled unclassified information may only be processed inside an authorized boundary. An AI vendor outside that boundary extends the scope of your assessment. | A, B, C, G, H |
| HIPAA Security Rule | A vendor processing protected health information is a business associate and requires a signed agreement plus documented diligence. | B, C, E, F, G |
| SOC 2 Type II | The vendor management criteria expect documented, periodic assessment of significant service providers. | C, F, G, H |
| NIST AI Risk Management Framework | The Map and Govern functions expect third-party AI risk to be identified and documented, not assumed. | All eight |
| ISO 42001 | Requires an artificial intelligence management system that accounts for supplier and lifecycle risk. | A, B, D, G |
| FTC Safeguards Rule | Requires oversight of service providers handling customer information, with periodic reassessment. | C, E, F, H |
Defense contractors should treat Domain H as the decisive section. A capable AI product that routes inference through an unapproved region can quietly place controlled unclassified information outside the boundary you attested to, and the finding surfaces during assessment rather than during procurement. Our CMMC compliance team reviews AI purchases against the same boundary diagram used for the system security plan, and the NIST AI Risk Management Framework gives the governance vocabulary that ties the two together.
"Petronella Cybersecurity provides outstanding service! Their team is extremely knowledgeable, responsive, and truly cares about protecting their clients. They take the time to explain complex issues in simple terms and deliver real solutions, not just promises."
GB Entrainement, TrustIndex verified reviewPetronella Technology Group is rated 4.7 across 92 verified TrustIndex reviews and 5.0 across 15 Google reviews.
Running It Yourself Versus Running It With Us
- Questionnaire sent by a buyer who cannot evaluate the technical answer
- Vendor returns marketing language and the review stalls
- No clause library, so gaps are noted but never contracted
- Findings live in an email thread and are lost at staff turnover
- Assessor asks for vendor diligence evidence and none is filed
- Questions pressed until answers are specific and signed
- Technical claims tested against the vendor's own documentation
- Contract language drafted for every conditional acceptance
- Findings recorded in ComplianceArmor® as durable evidence
- Completed questionnaire filed where an assessor will look for it
How Petronella Technology Group Runs an AI Vendor Review
Craig Petronella, author of "Beautifully Inefficient" and an MIT AI-certified technologist, leads this practice. He is a CMMC Registered Practitioner and a North Carolina Licensed Digital Forensics Examiner, License #604180-DFE, which matters here for an unglamorous reason: the questions in Domain F are written by someone who has had to reconstruct what a vendor actually logged after an incident, and has found out the hard way which logs do not exist.
Organizations deploying artificial intelligence where the data never leaves their own network can avoid much of this review surface entirely. That is the argument for private AI solutions, and for medical practices specifically, for HIPAA compliant AI deployed inside a boundary you already control. When the model runs on your hardware, most of Domains B, C, and H stop being someone else's promise.
Get your AI vendor reviewed before you sign
Petronella Technology Group has secured regulated organizations from Raleigh, North Carolina since 2002. We will run the full questionnaire, score it, and give your counsel the clauses that close the gaps. Call 919-348-4912 or request a consultation.
Request a Vendor ReviewFrequently Asked Questions
What is an AI vendor security questionnaire?
How is it different from a standard vendor security questionnaire?
How many questions should we actually send?
Do we need this if the vendor already has SOC 2 Type II?
What is the single most common finding in these reviews?
How does this affect CMMC compliance for defense contractors?
How often should an approved AI vendor be reassessed?
Can Petronella Technology Group run the review for us?
Last Updated: August 26, 2026