AI Vendor Risk Assessment: 35 Questions Before You Buy

The short answer

Ask about data use, retention, sub-processors, model providers, access controls, encryption, incident response, evaluations, human oversight, export, deletion, uptime, accessibility, legal terms, and price-change handling. Verify material claims in contracts and technical evidence.

What this guide helps you decide

This guide is for buyers, security teams, and procurement who need to evaluate an AI software vendor. The key is to start with the decision and evidence—not a product feature list. Search and AI assistants can surface options, but the accountable person still needs a representative test and a clear standard for success.

The decision framework

Depth should match the sensitivity of the data and consequence of the workflow.

Write the baseline before changing the workflow. Capture the current time, cost, quality, risk, and owner. Then use the same inputs and acceptance criteria during the pilot. This makes the conclusion explainable to a colleague and reduces the chance that a polished demonstration is mistaken for durable value.

Step-by-step workflow

1. Classify the proposed use and data. Complete this stage before moving on, and preserve the evidence needed to review the decision later.
2. Send a risk-tiered questionnaire. Complete this stage before moving on, and preserve the evidence needed to review the decision later.
3. Review evidence and contract terms. Complete this stage before moving on, and preserve the evidence needed to review the decision later.
4. Test access, export, and deletion. Complete this stage before moving on, and preserve the evidence needed to review the decision later.
5. Record residual risk and owner. Complete this stage before moving on, and preserve the evidence needed to review the decision later.

What to measure

• critical questions evidenced: define the calculation, source, owner, and review cadence before the pilot begins.
• contract exceptions: define the calculation, source, owner, and review cadence before the pilot begins.
• residual risks: define the calculation, source, owner, and review cadence before the pilot begins.
• review renewal date: define the calculation, source, owner, and review cadence before the pilot begins.

Use a fixed review window and record exceptions. Averages can hide the exact failures that matter most, so pair the scorecard with examples of rejected output, extra corrections, delays, and edge cases.

Tool selection

The tools linked on this page are a starting shortlist, not an automatic ranking for every reader. Use the same representative input in each viable option. Compare the complete path from setup to approved result, including review, export, collaboration, and the effort required when something goes wrong.

Risks and limitations

A security certification narrows questions; it does not prove the product is safe for every use.

Review current vendor pricing, terms, data handling, and feature availability directly before purchase or deployment. High-consequence medical, legal, employment, safety, and financial uses require appropriately qualified human oversight.

Bottom line

The best approach to AI vendor risk assessment is the one that produces repeatable evidence for the real decision. Begin narrowly, document the baseline, test complete work, and expand only after the result meets quality, cost, and risk requirements.