AI Vendor Risk Questionnaire Template (ISO/IEC 42001, AI Act Art. 25)

AI supplier due diligence: tiering, provenance, data residency, OWASP LLM security, evals, bias, incidents, GPAI dependencies, Art. 25, scoring

ISO 与合规完整ISO/IEC 42001:2023 A.10; NIST AI 600-1 GOVERN 6; Regulation (EU) 2024/1689 Article 25; OWASP Top 10 for LLM Applications 2026CC BY-SA 4.0vendor risk questionnaire更新于 2026年10月21日

在编辑器中打开下载 .md

使用方法: Use it before contracting any AI product, model API or AI feature, and again at renewal or on a vendor model change. Tier the vendor first and send only the sections the tier requires, asking for evidence rather than statements. The main pitfall is ignoring the upstream GPAI model behind the vendor, whose changes reach you without notice.

预览

AI Vendor Risk Questionnaire: [Vendor name] / [AI product]

Due diligence questionnaire and assessment record for a supplier of an AI system, AI feature, general-purpose AI model or AI service. It covers the vendor profile, system description, model provenance and training data, data handling and residency, security (including the OWASP Top 10 for LLM Applications), evaluation evidence, bias and fairness, transparency, human oversight, incident and change notification, subprocessors and model dependencies, regulatory status under the EU AI Act (Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, including Article 25 value chain duties), contract clauses, a scoring rubric and the decision. It supports ISO/IEC 42001:2023 Annex A controls A.10.2 and A.10.3 and the third party actions of NIST AI 600-1 (GOVERN 6.1 and 6.2). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Field	Value
Document ID	[AIVRQ-001]
Version	[0.1]
Status	[Draft / Sent to vendor / Under review / Approved / Rejected / Superseded]
Owner	[@procurement-lead]
Approvers / reviewers	[@ai-governance-lead], [@security-lead], [@dpo], [@legal]
Last updated	YYYY-MM-DD
Classification	[Confidential]
Vendor	[Legal name, registered address]
Product and version	[Name, version, model IDs]
Internal use case	[UC-ID, short description]
Internal business owner	[@business-owner]
Vendor contact	[Name, role, email]
Date sent / date returned	YYYY-MM-DD / YYYY-MM-DD

Approvals

Role	Name	Decision	Date
Business owner	[@name]	[Accept / Accept with conditions / Reject]	YYYY-MM-DD
AI governance lead	[@name]	[Decision]	YYYY-MM-DD
Security lead	[@name]	[Decision]	YYYY-MM-DD
Data protection officer	[@name]	[Opinion]	YYYY-MM-DD

Revision history

Version	Date	Author	Change summary
0.1	YYYY-MM-DD	[@name]	Questionnaire prepared and sent
1.0	YYYY-MM-DD	[@name]	Example: Scored and approved with conditions
1.1	YYYY-MM-DD	[@name]	Example: Re-assessed after vendor switched underlying foundation model

1. Assessment scope and tier

Factor	Answer	Points
Does the AI output affect decisions about individuals (employment, credit, access to services, health)?	[Yes / No]	Yes = 3
Will personal, confidential or regulated data be sent to the vendor?	[None / Internal / Personal / Special category or secret]	0 / 1 / 2 / 3
Is the system customer-facing or public?	[Yes / No]	Yes = 2
Can the system take actions in our systems (agents, tools, write access)?	[Yes / No]	Yes = 2
Is the use case in an AI Act Annex III area or a regulated product?	[Yes / No / Unsure]	Yes or Unsure = 3
Is the vendor a single point of failure for a critical process?	[Yes / No]	Yes = 2

Total points	Tier	Sections required	Approver
0 to 3	Low	2, 3, 6, 12, 15	Business owner
4 to 8	Medium	2 to 13, 15	Business owner and AI governance lead
9 or more	High	All sections, plus evidence review or call with vendor	AI governance board

Tier assigned: Example: High (11 points: personal data 2, customer-facing 2, tool actions 2, single point of failure 2, Annex III status unsure 3).

2. Vendor profile

Answer guide for sections 2 to 15: answer each question in the Vendor answer column and list supporting documents in the Evidence column. Mark a question not applicable only with a reason.

ID	Question	Evidence
VQ-PRF-01	Legal entity, country of incorporation and the entity that will contract and process data
VQ-PRF-02	Ownership, parent company and any change of control in the last 24 months
VQ-PRF-03	Certifications held and their scope (for example ISO/IEC 42001, ISO/IEC 27001, SOC 2), with issuing body and expiry	Certificates
VQ-PRF-04	Name and role of the person accountable for AI governance
VQ-PRF-05	Published AI policy or responsible AI principles	Link
VQ-PRF-06	Number of customers using this AI product in production and main sectors
VQ-PRF-07	Relevant litigation, regulatory investigations or enforcement related to AI, privacy or security

3. AI system description

ID	Question	Evidence
VQ-SYS-01	Intended purpose of the product and uses the vendor does not support or prohibits	Terms of use
VQ-SYS-02	AI techniques used (for example LLM, classifier, recommender), modalities and whether outputs are generated or selected
VQ-SYS-03	Architecture: models, retrieval, tools or agents, guardrails, and which components run where	Diagram
VQ-SYS-04	Level of autonomy: can the system take actions without human approval, and which actions
VQ-SYS-05	Configuration options available to customers (model choice, temperature, filters, logging, data retention)	Admin guide
VQ-SYS-06	Known limitations, failure modes and conditions where performance degrades	Model or system card
VQ-SYS-07	Product roadmap items in the next 12 months that change AI behaviour or data use

4. Regulatory status and value chain roles

ID	Question	Evidence
VQ-REG-01	The vendor's role under the EU AI Act for this product (provider of an AI system, provider of a GPAI model, both, or not in scope) and the reasoning
VQ-REG-02	Whether the product, or any intended use, is classified as high-risk (Article 6 and Annex III, or Annex I products), and the conformity assessment status	Declaration of conformity, registration
VQ-REG-03	Whether the vendor has screened the product against the prohibited practices in Article 5, including those added by Regulation (EU) 2026/1744
VQ-REG-04	How the product supports transparency duties under Article 50 (interaction disclosure, machine-readable marking of synthetic content)
VQ-REG-05	If a GPAI model is provided or integrated: who the model provider is, whether it signed the GPAI Code of Practice, and what Article 53 documentation is available to downstream providers	Model documentation
VQ-REG-06	Whether the GPAI model is classified as having systemic risk (Article 51) and how Article 55 duties are met
VQ-REG-07	Information, technical access and assistance the vendor will provide if we become a provider under Article 25(1) or need to meet deployer duties under Article 26	Draft agreement
VQ-REG-08	Willingness to sign a written agreement under Article 25(4) where we are the high-risk provider and the vendor supplies a component
VQ-REG-09	Other AI laws the vendor complies with in markets where we operate (for example US state laws, Korea AI Basic Act)

Internal note: record our own role for this use case: [Deployer / Provider (Article 25) / Integrator of a GPAI model into our own system]. High-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under the amended Article 113; check the consolidated text.

5. Model provenance and training data

ID	Question	Evidence
VQ-MOD-01	Models used: name, version, developer, and whether trained in-house, fine-tuned from a third-party model or used as is	AI-BOM or model list
VQ-MOD-02	Sources and types of training, fine-tuning and evaluation data, and the legal basis or licence for each	Datasheet or data summary
VQ-MOD-03	For GPAI models: the public summary of training content and the copyright policy, including how rights reservations (opt-outs) are honoured	Links
VQ-MOD-04	Whether customer data, prompts or outputs are used to train or improve models, by default or with opt-in, and how to opt out
VQ-MOD-05	Data quality and curation steps, including removal of personal data, illegal content and duplicate or synthetic data
VQ-MOD-06	Indemnity offered for intellectual property claims arising from outputs, and its conditions	Contract draft
VQ-MOD-07	How model versions are identified to customers and how long a version stays available

6. Data handling, privacy and residency

ID	Question	Evidence
VQ-DAT-01	Data categories processed (prompts, files, outputs, embeddings, logs, telemetry) and the purpose for each	Data flow description
VQ-DAT-02	Locations where data is stored and processed, including model inference and support access; options to restrict region	Data residency statement
VQ-DAT-03	Retention periods for each data category, including abuse-monitoring logs, and deletion on request or contract end
VQ-DAT-04	Role under data protection law (processor or controller) and the data processing agreement offered	DPA
VQ-DAT-05	International transfer mechanisms used
VQ-DAT-06	Isolation between customers in shared models, caches, vector stores and fine-tuned adapters
VQ-DAT-07	Human review of customer content by vendor staff: when, by whom, and how customers can opt out
VQ-DAT-08	Support for data subject requests concerning data held in logs, embeddings or fine-tuned models

7. Security

ID	Question	OWASP reference	Evidence
VQ-SEC-01	Defences against direct and indirect prompt injection, and how they are tested	LLM01:2026 Prompt Injection
VQ-SEC-02	Controls preventing disclosure of other customers' data, secrets or training data in outputs	LLM02:2026 Sensitive Information Disclosure
VQ-SEC-03	Limits on actions, tools and permissions the system can use, and human approval for high-impact actions	LLM03:2026 Excessive Agency
VQ-SEC-04	Supply chain controls for models, datasets, libraries and plugins (provenance checks, signing, SBOM or AI-BOM)	LLM04:2026 Supply Chain
VQ-SEC-05	Protection against data and model poisoning in training, fine-tuning and retrieval sources	LLM05:2026 Data and Model Poisoning
VQ-SEC-06	Rate limits, quotas and cost controls against resource exhaustion and denial of wallet	LLM06:2026 Unbounded Consumption
VQ-SEC-07	Protection of system prompts, hidden instructions and other non-user context from extraction	LLM08:2026 Hidden Context Exposure
VQ-SEC-08	Access control, tenant isolation and poisoning defences for embeddings and vector stores	LLM09:2026 Vector and Embedding Weaknesses
VQ-SEC-09	Validation and encoding of model output before it reaches browsers, code execution or downstream systems	LLM10:2026 Improper Output Handling
VQ-SEC-10	Measures against misleading or false output presented as fact	LLM07:2026 Misinformation
VQ-SEC-11	Independent AI red teaming: scope, frequency, last date and summary of findings		Red team summary
VQ-SEC-12	Protection of model weights and fine-tuned adapters from theft or tampering
VQ-SEC-13	Security logging available to customers (prompts, tool calls, guardrail events) and export format

8. Evaluation and performance evidence

ID	Question	Evidence
VQ-EVL-01	Evaluation methods and datasets used for accuracy, robustness and safety, and the latest results	Evaluation report
VQ-EVL-02	Results for tasks, languages and domains matching our use case
VQ-EVL-03	Hallucination or groundedness measurement and current rates
VQ-EVL-04	Whether we may run our own evaluation and red team tests against the product, and under what terms	Terms
VQ-EVL-05	Regression testing performed before model or prompt changes are released
VQ-EVL-06	Production monitoring for drift, degradation and abuse, and what is shared with customers

9. Bias and fairness

ID	Question	Vendor answer	Evidence
VQ-BIA-01	Groups and attributes for which performance or outcome differences were tested
VQ-BIA-02	Metrics used and the latest results, including known gaps
VQ-BIA-03	Mitigations applied in data, model or post-processing
VQ-BIA-04	Support for our own fairness testing (access, test data handling, result sharing)
VQ-BIA-05	Language and accessibility coverage, and known weaker languages

10. Transparency and documentation

ID	Question	Evidence
VQ-TRN-01	Model card, system card or instructions for use, and update frequency	Documents
VQ-TRN-02	Explanations available for individual outputs (citations, reasons, confidence)
VQ-TRN-03	Content provenance features (watermarking, metadata, C2PA manifests) for generated media
VQ-TRN-04	Customer-facing transparency material we may reuse
VQ-TRN-05	Public transparency or safety reports	Links

11. Human oversight and control

ID	Question	Vendor answer	Evidence
VQ-HUM-01	Features to review, approve, edit or reject outputs before they take effect
VQ-HUM-02	Ability to stop, pause or roll back the system and its agents
VQ-HUM-03	Controls to configure or disable features, tools and data sources per customer
VQ-HUM-04	Guidance and training material for our staff who oversee the system

12. Incident, vulnerability and change notification

ID	Question	Evidence
VQ-INC-01	Definition of an AI incident the vendor uses and examples
VQ-INC-02	Notification deadline and channel for security incidents and AI incidents affecting us	Contract or SLA
VQ-INC-03	Process for serious incident reporting to authorities where the vendor is a provider under the AI Act, and how customers are informed
VQ-INC-04	Vulnerability disclosure policy and bug bounty for AI issues	Link
VQ-INC-05	Advance notice period for model, prompt, guardrail or data use changes that may alter behaviour
VQ-INC-06	Change log and version pinning options
VQ-INC-07	Post-incident reports shared with customers	Sample report

13. Subprocessors and model dependencies

ID	Question	Evidence
VQ-DEP-01	List of subprocessors involved in AI processing (model providers, hosting, monitoring, human review), with location	Subprocessor list
VQ-DEP-02	Upstream GPAI models used, their providers and the contract terms that pass through to us
VQ-DEP-03	Fallback if an upstream model is withdrawn, changed or degraded
VQ-DEP-04	How subprocessors are assessed for AI risk, and notice given before adding one
VQ-DEP-05	Open-source models or components used and how their licences and vulnerabilities are tracked

14. Continuity and exit

ID	Question	Evidence
VQ-EXT-01	Availability commitment and support hours	SLA
VQ-EXT-02	Business continuity and disaster recovery arrangements for AI services
VQ-EXT-03	Export of our data, configurations, prompts, fine-tuned adapters and logs on exit, and format
VQ-EXT-04	Deletion confirmation at contract end, including backups and fine-tuned models
VQ-EXT-05	Notice period before discontinuing the product or a model version

15. Contract clauses

ID	Clause	Status
CL-01	Purpose limitation: our data used only to provide the service; no training without written opt-in	[Agreed / Negotiating / Refused]
CL-02	Ownership of inputs and outputs, and licence to use outputs
CL-03	Data residency, retention and deletion commitments
CL-04	Security requirements, including AI-specific testing and right to receive test summaries
CL-05	Notification of security and AI incidents within [x hours]
CL-06	Advance notice of material model or behaviour changes and version pinning
CL-07	Audit or evidence rights, including independent assessment reports
CL-08	AI Act cooperation: documentation, information and assistance (Articles 25 and 26), and the Article 25(4) agreement where applicable
CL-09	Transparency support: disclosure and marking features for Article 50
CL-10	Intellectual property indemnity for outputs
CL-11	Subprocessor approval and flow-down of obligations
CL-12	Service levels, support and continuity
CL-13	Exit assistance, data export and deletion certificate
CL-14	Liability allocation that does not shift vendor-caused AI harms to us unexpectedly

16. Scoring rubric

Score each question: 0 = no answer or unacceptable; 1 = partial, no evidence; 2 = adequate with evidence; 3 = strong, independently verified. Section score = average of its questions times the weight.

Section	Weight (High tier) Example	Weighted	Minimum to pass
4 Regulatory status	15		2.0
5 Provenance and training data	10		1.5
6 Data handling	15		2.0
7 Security	20		2.0
8 Evaluation	10		1.5
9 Bias and fairness	5		1.0
10 Transparency	5		1.5
11 Human oversight	5		1.5
12 Incidents and change	10		2.0
13 Dependencies	5		1.5
Total	100	[0 to 300]

Weighted total	Outcome
240 or more, all minimums met	Accept
180 to 239, or one minimum missed with a remediation plan	Accept with conditions
Below 180, or a minimum missed in sections 4, 6, 7 or 12 without a plan	Reject or escalate

A "0" on any of VQ-REG-03, VQ-DAT-04, VQ-MOD-04 or VQ-INC-02 blocks acceptance regardless of total.

17. Findings and remediation

Finding ID	Question	Finding	Risk	Remediation	Owner	Due	Status
FND-001 (Example)	VQ-INC-05	No advance notice of model changes; vendor updates the model behind a fixed API name	High	Contract clause CL-06 with 30 days' notice; our regression evaluation on each change	[@legal]	YYYY-MM-DD	Open
FND-002 (Example)	VQ-DAT-03	Abuse-monitoring logs retained 30 days outside the EU	Medium	Zero-retention option enabled; DPA annex updated	[@dpo]	YYYY-MM-DD	Closed
FND-003 (Example)	VQ-SEC-11	Red team summary older than 12 months	Medium	Vendor to share new summary; we run our own test before go-live	[@security-lead]	YYYY-MM-DD	Open

18. Decision

Item	Value
Tier	[Low / Medium / High]
Weighted score	[x / 300]
Outcome	[Accept / Accept with conditions / Reject]
Conditions	Example: FND-001 and FND-003 closed before production use
Our AI Act role confirmed	Example: Deployer; no Article 25 trigger because we do not rebrand or modify the system
Next review	Example: At renewal or on notice of a model change, whichever is first
Decided by	[@name], YYYY-MM-DD

19. Source mapping

Section	ISO/IEC 42001:2023 Annex A	NIST AI 600-1 suggested actions	EU AI Act
1 Tier	A.10.3	GV-6.1-005	Art. 6, Annex III
2 Vendor profile	A.10.3	GV-6.1-007
4 Regulatory status	A.10.2	GV-6.1-009	Art. 5, 25, 26, 50, 51, 53, 55
5 Provenance	A.7.3, A.7.5, A.10.3	GV-6.1-009, MP-4.1-007	Art. 53(1)(c), (d)
6 Data handling	A.7.2, A.10.3	GV-6.1-009	Art. 10 (high-risk)
7 Security	A.10.3	GV-6.1-009, MG-3.1-002	Art. 15 (high-risk)
8 Evaluation	A.6.2.4, A.10.3	MS-2.3-002, MG-3.1-005	Art. 13, 15
10 Transparency	A.8.2, A.10.3	MG-3.1-005	Art. 13, 50, 53(1)(b)
12 Incidents and change	A.8.4, A.10.2	GV-6.2-003, GV-6.2-007	Art. 26, 73
13 Dependencies	A.10.2, A.10.3	GV-6.2-001, GV-6.2-004	Art. 25(4), 53(1)(b)
14 Continuity and exit	A.10.3	GV-6.2-006
15 Contract clauses	A.10.2	GV-6.1-004, GV-6.1-006, GV-6.2-007	Art. 25(4)

20. Glossary and references

Term	Meaning
Provider	Under the AI Act, the party that develops an AI system or GPAI model and places it on the market or puts it into service under its own name
Deployer	Under the AI Act, the party using an AI system under its authority in a professional activity
GPAI model	General-purpose AI model that can perform a wide range of tasks and be integrated into many systems
Value chain	The suppliers, components, models and data that together make up an AI system
AI-BOM	Machine-readable inventory of models, datasets and components in an AI system
Red teaming	Structured adversarial testing to find failures and vulnerabilities

References:

Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, consolidated text on EUR-Lex; Articles 5, 6, 10, 13, 15, 25, 26, 50, 51, 53, 55, 73, 113
NIST AI 600-1, Generative AI Profile, July 2024, GOVERN 6.1 and 6.2, https://doi.org/10.6028/NIST.AI.600-1
ISO/IEC 42001:2023, Annex A controls A.10.2, A.10.3, A.10.4
OWASP Top 10 for LLM Applications 2026, OWASP GenAI Security Project, https://genai.owasp.org/
Related templates: Supplier security assessment, Statement of Applicability (ISO/IEC 42001), AI policy (ISO/IEC 42001), Generative AI risk profile (ai-data/genai-risk-profile), AI risk assessment (ai-data/ai-risk-assessment), AI use case intake (ai-data/ai-use-case-intake)

Standard and licence note

Based on Regulation (EU) 2024/1689 (the AI Act) as amended by Regulation (EU) 2026/1744, in particular Article 25 on responsibilities along the AI value chain, and on NIST AI 600-1 (July 2024), GOVERN 6.1 and 6.2 suggested actions; EU legislative texts are free to reuse and NIST publications are public domain in the United States. Provisions and actions are summarised in original wording. ISO/IEC 42001:2023 is a copyrighted standard and is cited by control number only, with no text reproduced. Section 7 references the OWASP Top 10 for LLM Applications 2026 by the OWASP GenAI Security Project, licensed under Creative Commons Attribution-ShareAlike 4.0 (https://creativecommons.org/licenses/by-sa/4.0/); only entry IDs and short names are used, with attribution, and any OWASP descriptive material you adapt into this template must be shared under CC BY-SA 4.0. Check the current consolidated text, NIST publication and OWASP list before use. This is a documentation format, not legal advice. Template licence: MIT.