AI Supplier Due-Diligence Questionnaire
Assess a model API, AI-enabled SaaS product or data vendor before it touches your data: training on your data, retention, model versioning, prompt-injection testing, incident notice, sub-processors and exit — scored, with the material gaps and an onboarding recommendation.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- Thirty-four questions across eight areas that matter for AI suppliers specifically — not a generic security questionnaire with "AI" added.
- The first question to settle: is your data used to train the supplier's models, and is the answer in the contract rather than a settings page?
- Mark each answer Yes, Partial, No or N/A with the supplier's evidence; material questions answered "No" become red flags.
- A supplier score and a recommended decision (approve, approve with conditions, remediate first) adjust to the criticality tier you set.
Frequently asked questions
How is an AI supplier questionnaire different from a normal security questionnaire?
A normal questionnaire covers hosting, access control and certifications. AI suppliers add new questions: whether your prompts and outputs train their models, how long they are retained, whether the model can change without notice, how they test for prompt injection and jailbreaks, which foundation model sits underneath, and whether you can take fine-tuned assets with you when you leave.
Does this satisfy ISO/IEC 42001 or the EU AI Act supplier requirements?
It helps you gather the evidence that the third-party relationship controls of an AI management system expect, and the information you need for your own EU AI Act deployer duties. It is a template: whether your process is sufficient is for your auditors and legal advisers to judge.
What should I do with a "No" on a material question?
Either get it fixed in the contract before signing, put a compensating control in place (for example, stripping personal data before it is sent), or formally accept the risk with a named owner. For a Tier 1 supplier the template recommends not onboarding until material gaps are closed.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.