An AI vendor security questionnaire is the set of written questions an enterprise customer’s security, privacy and procurement teams send before an AI product may touch their data or systems. It is the written part of an AI vendor security review and risk assessment. In 2026 the standard forms include the Shared Assessments SIG, which has an artificial intelligence risk domain, and the Cloud Security Alliance (CSA) CAIQ with its AI version, the AI-CAIQ. Buyers also write their own. Answers are read against ISO/IEC 42001, the NIST AI RMF, SOC 2 reports and the EU AI Act. This guide is a companion to our guide to production-ready AI agents. For an agent, the questions fall into twelve areas, from training on customer data to contract terms. In our view the answers on tool permissions, prompt injection, human oversight and evaluation evidence decide the review, because certificates and SOC 2 reports say little about them.

The questionnaires and frameworks behind AI vendor reviews

Shared Assessments SIG

Shared Assessments’ Standardized Information Gathering questionnaire (SIG) is a third-party risk questionnaire it says thousands of organisations use. The current edition, the 2026 SIG, was set for release on 19 September 2025 and added references to ISO/IEC 42001 (Shared Assessments, 18 July 2025). Its product page lists Artificial Intelligence among 21 risk domains. Product Release 2027, announced on 6 October 2026, will add EU AI Act alignment.

CSA CAIQ, AI-CAIQ and the AI Controls Matrix

CSA’s Consensus Assessments Initiative Questionnaire (CAIQ) asks yes-or-no questions against its Cloud Controls Matrix. Version 4.1, released in January 2026, has 283 questions and is what vendors submit to the STAR Registry for a Level 1 self-assessment (CCM v4.1, timeline). The AI Controls Matrix (AICM) v1.1, released on 22 June 2026, extends the matrix to AI with 247 control objectives in 18 domains, assigned to roles such as model provider and application provider. Its AI-CAIQ has 320 questions, and CSA maps the AICM to ISO/IEC 42001, the NIST AI RMF, the EU AI Act and AIUC-1, an AI-agent certification (CSA, 14 July 2026). Submitting the AI-CAIQ earns STAR for AI Level 1. Level 2 needs a third-party ISO/IEC 42001 certificate and a scored AI-CAIQ.

ISO/IEC 42001

ISO/IEC 42001:2023, published in December 2023, specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. Certification bodies audit against it under ISO/IEC 42006:2025. In our reading, a certificate shows how an organisation governs AI and doesn’t test a particular agent.

NIST AI RMF

The NIST AI Risk Management Framework (NIST AI 100-1, 26 January 2023) is voluntary guidance built on four functions: Govern, Map, Measure and Manage (AI RMF 1.0). A Generative AI Profile (NIST AI 600-1) followed on 26 July 2024, and NIST says it is revising the framework as part of the White House AI Action Plan.

SOC 2 and AI

SOC 2 is a CPA firm’s examination of a service organisation’s controls against the AICPA’s Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy (2017 criteria, 2022 points of focus). CSA, which runs its own STAR for AI programme, wrote on 30 August 2026 that the AICPA “has not published AI-specific Trust Services Criteria”, so two AI vendors’ clean reports may cover different controls. Buyers, CSA says, should read the system description (CSA research note). On 11 September 2026 the AICPA published questions and answers in section 9561 on how a service organisation’s use of AI affects SOC examinations.

EU AI Act duties buyers ask about

The AI Act (Regulation (EU) 2024/1689) applies in stages, and the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved some dates (timeline). A vendor that develops an agent and sells it under its own name is its provider, and a business using it is a deployer (Article 3). Four duties reach vendor questionnaires:

  • From 2 August 2026, providers must build a system that interacts directly with people so it tells them, by the first interaction, that it’s an AI system, unless that’s obvious. Generative systems must also mark output as AI-generated in machine-readable form, but those already on the market have until 2 December 2026 (Article 50).
  • Providers and deployers must take measures to support their staff’s AI literacy, a softened version of the duty in force since 2 February 2025 (Article 4).
  • High-risk rules start on 2 December 2027 for Annex III uses such as employment and education, and on 2 August 2028 for Annex I products (Commission). Deployers of those systems must give human oversight to competent people and keep logs for at least six months (Article 26).
  • Since 2 August 2025, general-purpose AI model providers must document their models for providers that integrate them (Article 53).

AI agent security review questions, area by area

Several questions come from Shared Assessments’ suggested AI questions (21 August 2026).

Training on customer data

Whether the buyer’s data trains or fine-tunes any model, stays apart from other customers’ data and can be opted out. Shared Assessments adds that these commitments belong in the contract. A good answer separates your practice from your model provider’s and cites the provider’s dated terms.

Retention and deletion

How long prompts, outputs, traces and tool results are kept, including copies in trace stores, eval datasets and provider logs, and how deletion is proven. The EU’s model clauses for public AI procurement have the supplier destroy the buyer’s data on request, with evidence if asked (light version). Give one period per data type.

Sub-processors and model providers

Which foundation model the product relies on, which other services see customer data, where, and the notice you give before adding one. Under Article 28 of the UK GDPR, a processor needs the controller’s prior written authorisation to use a sub-processor and stays liable for it (ICO). List every model provider and trace store. Engineers from a provider who reach the customer’s data count too. Our forward deployed engineer cost guide lists what to ask such a provider.

Data residency and transfers

Where data is processed, including inference, logs and backups, and what covers transfers out of the EU or UK, such as the EU’s standard contractual clauses of 4 June 2021, or the UK’s IDTA with a transfer risk assessment (ICO). Give a region per component.

Access control and tool permissions

Shared Assessments suggests asking what actions an agentic system can take and what limits them. Follow-ups cover each tool’s credential, scopes and identity (OWASP’s LLM06:2025 Excessive Agency in its Top 10 for LLM Applications, renumbered LLM03 in the 2026 edition). Answer per tool. Our MCP server security guide covers MCP connections.

Prompt injection and output handling

Whether the product has been tested for prompt injection and other adversarial attacks, which untrusted text reaches the model and how outputs are checked before use (OWASP’s LLM01:2025 and LLM05:2025, plus AICM control AIS-15). Name the routes tested, the results and the control that stops an injected instruction moving money or data.

Logging and audit trails

What is logged per conversation and tool call, who can get the logs and for how long. Under the EU model clauses, the supplier keeps logs for the contract term, then hands them over. List the fields, redactions and export format.

Human oversight and approval steps

What level of human oversight exists, which actions need a person’s approval and how hand-offs work. List each approval step, its threshold and the measured time to switch the agent off.

Model change management and regression testing

How customers will hear about model changes, retraining or upgrades, and what is re-tested first. The EU model clauses have the supplier update its documentation with every substantial modification. Name the pinned model ID, the regression suite that gates every change, the notice period and the rollback (regression testing after model updates).

Incident response

What AI-specific incident response looks like, how fast the agent or one tool can be stopped and when the customer hears. CSA lists AI incident-response testing as AICM control SEF-04. Define AI incidents and give the notification window and last test date.

Evaluation evidence and thresholds

How accuracy is measured on the buyer’s use case, which thresholds a release must pass and whether the buyer sees results. Give failure classes, case counts, thresholds set before the run, pass rates and gaps. Our AI agent deployment checklist lists the evidence behind each.

AI-specific terms in contracts

Whether you’ll commit in writing to no training on customer data, notice of significant AI changes before they ship, log access, data destruction and accuracy levels. The EU’s model contractual clauses for AI procurement, updated on 5 March 2025, come in full and light versions, and the light one sets accuracy levels in an annex. Write each answer as if it will become a clause.

An answer bank template for the AI vendor security questionnaire

Replace every placeholder with a fact you can show, and date the set with the configuration it describes (model ID, prompt version and tool list). It’s a template to adapt, not legal advice, so have a lawyer check anything bound for a contract.

Area Answer pattern to adapt Evidence to attach
Training on customer data We don’t train or fine-tune models on your inputs, outputs or tool results. Nor does [model provider], under [provider terms, dated] and [retention setting]. Contract clause [n] says so. Dated provider terms, account setting and clause
Retention and deletion We keep [conversation logs] for [retention period], [traces] for [period] and [eval cases from your data] until [event]. [Model provider] keeps API data for [period]. Deletion takes [n] days from a request, confirmed in writing. Retention schedule and deletion procedure
Sub-processors and model providers [Model provider] (inference, [region]), [trace store] (traces, [region]) and [others] see your data. We give [notice period] notice of a new sub-processor, and you can object under [DPA clause]. Sub-processor list, DPA and providers’ reports
Data residency and transfers Application data stays in [region], inference runs in [region], logs and backups sit in [region]. Transfers out of [EU or UK] rely on [transfer mechanism] and a risk assessment dated [date]. Data-flow diagram, transfer mechanism and risk assessment
Access control and tool permissions The agent calls [n] tools. [Tool] runs as [the signed-in user or a service credential] with [scopes]. The [n] tools that change data or money need [confirmation step]. Account IDs come from the session, outside the model’s control. One page per tool: credential, scopes held and needed, writes
Prompt injection and output handling Untrusted text reaches the model from [sources]. On [date], [n] of [n] injection cases across [routes] passed. Write actions need [control], so an injected instruction can’t [action] unconfirmed. Outputs are [validated or escaped] before [use]. Cases, results and residual-risk owner
Logging and audit trails Each tool call logs [user, tool, arguments, result, model ID, prompt version], with [fields] redacted, for [retention period]. Exports come as [format] within [time]. Log schema and a redacted sample trace
Human oversight and approval steps [Actions] need approval from [role], and [action] over [limit] goes to a person with [context]. [Role] can switch the agent off in [measured time], or [tool] alone in [time]. Approval flow and timed kill-switch test
Model change management and regression testing We pin [model ID] and version the prompt and tool list with it. Every change must pass our [n]-case regression suite at [thresholds]. Model changes get [notice period] notice, and rollback takes [time]. Change procedure, last suite run and rollback test
Incident response We treat [incident types] as AI incidents, notify you within [hours] of confirming one, contain it with [kill switch or tool flag] and review it with [owner]. Last tested: [date]. Incident plan section and last test record
Evaluation evidence and thresholds On [date] we ran [n] cases in [n] failure classes on [model ID and prompt version], against thresholds agreed before the run: [class: threshold]. Results: [class: passed of total]. Not covered: [classes]. Eval report, suite location and scope limits
AI-specific terms in contracts Our contract commits to no training on your data, [notice period] notice of material AI changes, log access for [period], deletion with written confirmation, [eval commitment] and [indemnity scope]. Draft clauses and DPA

Which answers a production readiness verdict supplies

Our production readiness review ends with a go/no-go verdict written for a customer’s security team, and you choose what they see. The sample verdict, for an invented company with invented numbers, has six sections:

Verdict section Areas it answers What it contains
Verdict and findings Evaluation evidence and model changes Verdict, findings by severity, the configuration covered and what reopens it
Scope and method Evaluation evidence and thresholds Traces reviewed, failure taxonomy, case design, thresholds agreed before the baseline, judge calibration
Eval results Evaluation evidence and prompt injection Pass rates per failure class against thresholds, and the failing cases
Tools and MCP connections Tool permissions and prompt injection Credential and scopes per connection, token passthrough, account scoping, injection routes tested
Operational checks Human oversight, incident response and logging Timed kill switch and rollback, rate limits, hand-off, tracing, alerts
Remaining risks and the re-run Model changes and risk owners Remaining risks with owners, and what closes each blocker

A verdict doesn’t supply:

  • SOC 2, ISO 27001 or ISO/IEC 42001 evidence
  • a penetration test of your infrastructure
  • legal terms (the DPA, the transfer mechanism and AI clauses)
  • your sub-processor list, retention schedule or data-flow map
  • training-data provenance, which your model provider answers
  • bias testing, unless a failure class chosen on day 3 covers it
  • company-wide controls such as HR and business continuity.

Our view

Answer agent questions with test evidence and company questions with the reports you hold, and keep them apart. A SOC 2 report can show that infrastructure access is controlled, but not what the agent does with a refund tool after reading a hostile invoice memo, and agent reviews turn on that. A Shared Assessments panel made the same point from the buyer’s side. Policies and certifications, it said, “are not a substitute for an independent assessment”.

Tie the answers to one configuration, and re-issue the rows a change touches. Where the answer is no, say so, with a date or a compensating control. Our security and data page says plainly that we don’t yet hold SOC 2 or ISO 27001.

What an answer bank can’t do

  • It isn’t legal advice. AI Act classification, transfer mechanisms and contract terms need a lawyer.
  • We haven’t reproduced SIG or AI-CAIQ questions. The SIG is licensed (USD 7,000 a year for a corporate licence). A buyer’s form will word things differently and ask more.
  • The frameworks move. Shared Assessments updates the SIG every year, and the ICO’s processor guidance is under review after the Data (Use and Access) Act. We’ve read only the public page of the AICPA’s section 9561.
  • A verdict covers one configuration and shows the failures its tests found. It can’t show that none remain.

If you’d rather we did this

We review the agent before an enterprise customer’s launch and write the verdict for that customer’s security team, in ten working days, for USD 10,000. See enterprise customer onboarding for AI vendors.

Sources

All pages opened on 19 October 2026.