AI Vendor Security Questionnaire Template
Standard security questionnaires miss the questions that matter for AI: does the vendor train on your prompts, who are the model sub-processors, and does the product respect source-system permissions. This template adds those to the usual access, logging and incident topics.
Fill in
AI Vendor Security Questionnaire Template
AI Vendor Security Questionnaire
From: Acme Precision Ltd To: Example AI Vendor Inc. Product: Hosted ERP assistant Contact: Head of Information Security Please respond by: 2026-11-14
Data in scope: ERP purchase order, item and supplier data; internal quality procedures. No export-controlled data and no employee personal data. Hosting requirement: Our private cloud tenant
Please answer each question directly. Where an answer is not yes or no, describe the control and attach evidence where possible.
1. Data handling and model training
| Question | Response | Evidence |
|---|---|---|
| Where is our data stored and processed, by region and sub-processor? | ||
| Is our data, prompts or outputs used to train or improve any model? Can this be contractually excluded? | ||
| What is the default retention for prompts, outputs and logs? Can we set it? | ||
| How is data deleted at contract end, and can you confirm deletion in writing? | ||
| Which sub-processors, including model providers, can access our data? |
2. Access control and tenancy
| Question | Response | Evidence |
|---|---|---|
| How is our tenant isolated from other customers? | ||
| Does the product enforce the permissions of the source system at query time? | ||
| Which vendor staff can access our data, and under what approval and logging? | ||
| Is single sign-on and multi-factor authentication supported? |
3. AI-specific controls
| Question | Response | Evidence |
|---|---|---|
| How do you defend against prompt injection from documents and tool outputs? | ||
| Can the agent write to our systems? What approval controls exist? | ||
| How are model versions changed, and will we be told before behavior changes? | ||
| Can users see the source or query behind an answer? |
4. Assurance, logging and incidents
| Question | Response | Evidence |
|---|---|---|
| Which independent audits or certifications do you hold, and what is their scope? | ||
| Are all prompts, tool calls and admin actions logged, and can we export the logs? | ||
| What is your incident notification commitment, in hours? | ||
| What are your business continuity and exit arrangements, including data export format? |
Reviewer sign-off
A questionnaire is a starting point for due diligence, not a substitute for contract terms or technical testing. Ask for evidence rather than relying on yes answers, and have legal review data processing and liability terms.
Compare vendors on these questions
Optional: an expert helps compare a hosted option and a private deployment against your answers.
Optional. The tool and every export work without this. No spam.
How to use this template
Fill in the vendor, product, data in scope and hosting requirement, then export and send it. Define the data in scope carefully, because answers that are acceptable for public documents may not be for supplier pricing or export-controlled drawings. Ask for evidence next to each answer, such as audit report extracts, architecture diagrams or contract clauses. Score the responses with your security team and record open items in your risk register.
The AI-specific questions
Four questions separate AI vendors from ordinary software vendors. First, whether your data trains their models. Second, which model providers and sub-processors see your prompts. Third, whether the product enforces the source system's permissions at the moment of each query rather than only at index time. Fourth, what happens when the vendor changes model versions, because behavior can shift without code changes on your side.
- Training and retention terms, in the contract and not only in marketing
- Sub-processor list with regions
- Permission enforcement at retrieval time
- Model change notification and version pinning
- Prompt injection controls for documents and tool outputs
When on-prem or private hosting changes the answers
If the software runs on your own servers or in your tenant, many data residency and sub-processor questions become simpler, but you take on operational duties such as patching and monitoring. Use the hosting field to set expectations. For export-controlled or highly sensitive data, ask for a deployment that keeps data and models inside your boundary, and verify it by reviewing network egress rules instead of relying on assertions.
Common mistakes
Common failures include accepting certifications without checking scope, ignoring sub-processors, sending the same questionnaire for every risk level, and treating answers as final. Scale the depth of review to the risk tier of the use case, and repeat the review when the vendor changes models, hosting or features.
Frequently Asked Questions
Which questions are most important?
Training use of your data, retention, sub-processors and regions, permission enforcement, write-back controls and incident notification. These decide most of the real exposure. The rest of the document provides supporting assurance and evidence.
Should we accept a vendor's standard security pack instead?
Use it as evidence, but check that it answers the AI-specific questions. Standard packs often skip model training use, prompt injection and model change management, so add those as follow-up questions.
How do we score the responses?
Rate each answer as meets, partially meets or does not meet your requirement, and mark which gaps are blockers. Carry unresolved gaps into your risk register with an owner and decision date.
Does this apply to open-weight models we host ourselves?
Many questions still apply to the software vendor or integrator around the model, such as permission handling, logging and support. Model provider questions shift to licence terms and your own operating controls.
Netray builds private and on-prem AI for ERP data. If you want to compare a hosted vendor with a private deployment on these questions, we can help prepare the comparison.
Related Tools
AI Acceptable Use Policy Template for ERP Users
A fill-in acceptable use policy that tells ERP users what they may and may not paste into AI tools, and who approves exceptions.
AI Agents & AutomationERP AI Data Source Inventory Worksheet
An editable inventory of ERP tables, file shares and document stores with classification and an AI-allowed decision per source.
AI Agents & AutomationAI Risk Register Worksheet for ERP Projects
An editable risk register with likelihood x impact scores, owners and mitigations, pre-filled with typical ERP AI risks.
AI Agents & AutomationAI Model Card Template for ERP Use Cases
A one-page model card for each AI model or agent in your ERP landscape, covering intended use, data, limits, evaluation and ownership.
More Compliance & Contracts tools
See all- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
- EU Machinery Regulation 2023/1230 Readiness Checklist