AI third-party risk management
AI vendor risk questionnaire
The questions to send an AI vendor before you sign. Each one names the framework clause it supports, so a weak answer tells you exactly which obligation is exposed.
No questions match. Clear the search or choose All frameworks.
Replace the placeholder
Questions use [Customer] where your organization’s name belongs. The Excel version has a response column, a status dropdown, and a column for evidence references.
Scope it to the vendor
Sections 1 and 2 apply to every AI vendor. Agentic autonomy, GenAI safety, and EU AI Act items apply only when the vendor’s system does those things, so filter before you send.
Ask for evidence, not adjectives
Where a question names a document, such as an AI bill of materials or a red-team summary, request the artifact. A clause reference with no artifact behind it is a finding.
Need help scoring the answers?
We review vendor responses against these frameworks, flag the gaps that matter for your use case, and write the contract language to close them.