AI vendor review / AI Governance Kits

AI Vendor Review Questionnaire

A vendor-review questionnaire for evaluating AI SaaS tools before employees upload prompts, files, customer data, or confidential company information.

Who buys this

  • IT teams
  • security reviewers
  • procurement owners
  • AI governance leads

Deliverables

  • AI vendor questionnaire
  • Data-use and model-training questions
  • Security, privacy, retention, and subprocessor prompts
  • Approval bands and blocker criteria

Business outcomes

  • Ask AI vendors the right data-use questions before rollout
  • Separate acceptable pilots from blocked sensitive-data use
  • Create repeatable approval evidence for AI SaaS adoption

Proof points

  • Covers prompts, files, outputs, feedback, embeddings, metadata, training use, deletion, retention, and subprocessors.
  • Includes decision bands so the review ends in approve, pilot, defer, or block rather than vague concern.
  • Works for buyers reviewing AI tools and SaaS vendors preparing for customer questions.

Preview

Will prompts, uploaded files, outputs, embeddings, metadata, logs, or feedback be used for training or product improvement?
Can the buyer opt out of training and receive contractual language covering customer data and uploaded content?
Blocker: no deletion commitment, no retention window, no subprocessor list, and no training-use clarity for sensitive data.

Public sample

Evaluate AI SaaS vendors before employees upload prompts, files, customer data, confidential information, or regulated data.

Will prompts, uploaded files, outputs, embeddings, metadata, logs, or feedback be used for training or product improvement?
Can the buyer opt out of training and receive contractual language covering customer data and uploaded content?
Blocker: no deletion commitment, no retention window, no subprocessor list, and no training-use clarity for sensitive data.

Review full sample

Buyer FAQ

Is this a normal security questionnaire?

No. It includes normal security topics, but it focuses on AI-specific data, model, output, and vendor-control risks.

Can AI vendors use it too?

Yes. Vendors can use it to prepare evidence before customers ask these questions.