Most businesses that adopt AI tools focus on what the tool can do. Fewer ask what the tool can expose.
Third-party AI vendors introduce risks that traditional vendor assessments weren’t designed to catch. The data you send to an AI model may be used to train it. The vendor’s sub-processors may have access to that data. The model itself may be vulnerable to manipulation that no firewall can stop. These are documented failure modes of AI systems already in production.
The standard security questionnaire wasn’t built for this. A vendor risk assessment (VRA) designed for AI needs to target the specific ways these tools can go wrong: how they handle your data, how their underlying models can be attacked, how vendors manage their own supply chains, and whether they can actually recover when something breaks.
This guide covers nine risk areas that should form the backbone of any AI VRA, with core assessment questions for each.
1. Access Control
An AI system is only as secure as the controls governing who can reach it. Access control determines who can interact with the model, its training data, and the infrastructure supporting it. Without clear boundaries, the risk of unauthorised access, data exfiltration, or model manipulation rises significantly.
Core questions:
- Who holds administrative access to the AI model, its training data, and the deployment environment?
- Does the vendor implement role-based access controls to separate privileges for developers, data scientists, and end-users?
- How are API keys, access tokens, and credentials managed, rotated, and stored?
- Does the AI solution integrate with your organisation’s existing Single Sign-On and Identity and Access Management systems?
2. Application Security
Securing the application layer matters for any software but AI introduces threats that standard security testing wasn’t designed to find. Prompt injection, adversarial attacks, and data poisoning are AI-specific vulnerabilities that require specific countermeasures.
Core questions:
- Is Multi-Factor Authentication enforced across all access points and management interfaces?
- Does the vendor conduct regular, independent penetration testing, vulnerability scanning, and code reviews?
- How does the application detect and respond to AI-specific threats such as prompt injection, data poisoning, and adversarial inputs?
- Does the vendor follow a secure software development lifecycle that embeds security from design through to deployment?
3. Asset and Information Management
AI tools consume often sensitive data to function. Understanding what leaves your organisation, where it goes, and what happens to it is foundational to managing AI risk. The concern isn’t just data leakage; it’s whether your data contributes to training models that may be shared with others.
Core questions:
- What categories of data are transmitted to the AI tool, including personally identifiable information, intellectual property, or financial records?
- How does the vendor classify and label data, and does this align with your organisation’s data governance policies?
- Is input data used to train or fine-tune the vendor’s foundational models? If so, under what conditions and with what safeguards?
- What retention policies apply to input data, intermediate processing results, and AI-generated outputs?
4. Compliance Management
Regulatory requirements for AI are already in place. The EU AI Act has passed. Data protection laws in multiple jurisdictions impose obligations that AI vendors must meet. Assessing compliance is no longer a box-ticking exercise but a legal and operational requirement.
Core questions:
- Does the vendor comply with applicable data protection regulations, including GDPR, CCPA, HIPAA, and the EU AI Act?
- What certifications and attestations does the vendor hold, for example, SOC 2, ISO 27001?
- How does the vendor manage third-party and nth-party risks within its own supply chain, particularly around sub-processors and external AI models?
- Are independent compliance audits conducted regularly, and are results available for client review?
5. Network Security
Data in transit is data at risk. Network security governs how information flows between your systems and the vendor’s infrastructure, and how well that infrastructure is protected from external threats.
Core questions:
- Is all data encrypted in transit using current cryptographic protocols?
- Are robust network controls in place, including firewalls, Web Application Firewalls, and Intrusion Detection/Prevention Systems?
- How is the AI infrastructure logically and physically isolated from other vendor environments and customer data?
- Are API endpoints protected against unauthorised access, brute-force attacks, and denial-of-service attempts?
6. Operational Resilience
If an AI tool is embedded in your core operations, its failure is your failure. Operational resilience determines whether a vendor can sustain service continuity, recover from disruptions, and communicate clearly when something goes wrong.
Core questions:
- What uptime, performance, and support response commitments does the vendor’s Service Level Agreement specify?
- Does the vendor maintain a tested disaster recovery and business continuity plan specifically for the AI service?
- How frequently are data backups performed, and are they tested for integrity and restorability?
- What is the vendor’s process for communicating outages, service disruptions, or security incidents to customers?
7. Physical and Environmental Security
Cloud-hosted infrastructure still lives somewhere physical. Data centres can be breached, flooded, or lose power. Physical security may feel abstract when you’re using a Cloud hosted AI tool, but it represents a real layer of risk when you’re assessing what happens if the vendor’s infrastructure fails.
Core questions:
- Where are the data centres or physical facilities hosting the AI infrastructure located?
- What physical access controls are in place: surveillance, access logging, visitor management?
- Are adequate environmental controls implemented, including fire suppression, climate control, and redundant power?
- If the vendor uses major cloud providers such as AWS, Azure, or GCP, what physical security certifications and assurances do those providers offer?
8. Privacy Management
AI tools process personal data at scale and at speed. Privacy management determines whether the vendor treats that data responsibly and whether your organisation remains on the right side of its obligations to the people whose data is involved.
Core questions:
- Does the vendor publish a clear privacy policy covering how personal data is collected, processed, stored, and shared?
- Can individuals exercise their rights, such as access, rectification, erasure, over data processed by the AI tool?
- How is data anonymised or pseudonymised before processing, where applicable?
- Does the vendor provide a Data Processing Agreement that clearly defines each party’s responsibilities under applicable data protection law?
9. Threat Management
A vendor’s ability to detect and respond to threats matters as much as its ability to prevent them. Threat management assesses whether the vendor operates with the vigilance that your organisation’s risk profile demands.
Core questions:
- Does the vendor operate a 24/7 Security Operations Centre or equivalent continuous monitoring capability?
- What does the vendor’s incident response plan specify, and how quickly can they detect, contain, and recover from security incidents?
- How are security logs generated, monitored, and retained, and for what duration?
- Does the vendor run a vulnerability disclosure programme or bug bounty programme to proactively identify and address security flaws?
Turning Assessment into Action
A vendor risk assessment is only useful if it changes decisions. The nine areas above are a diagnostic that directly inform whether you adopt an AI tool, what conditions you place on that adoption, and how often you revisit the assessment as the vendor’s product and your organisation’s risk profile evolve.
AI regulations are tightening. Vendor supply chains are growing more complex. The attack surface for AI systems is expanding as adoption accelerates. Build your VRA process to keep pace with all three: review it at least annually, trigger a reassessment whenever a vendor makes significant changes to its product or infrastructure, and treat gaps not as reasons to stall, but as requirements to negotiate.