AI VENDOR DUE-DILIGENCE QUESTIONNAIRE
Ask for evidence before the AI vendor becomes infrastructure.
Traditional software questionnaires do not fully describe model providers, training use, prompt retention, agent permissions, unpredictable output, model changes, or the evidence needed to govern them. Start with the exact product and intended use, then ask the vendor to answer and prove each material claim.
- Free Word download
- No signup
- No upload
- Qualified review required
FREE BROWSER-LOCAL WORD GENERATOR
Create a 40-question AI vendor due-diligence request.
Collect evidence about the exact product, model supply chain, data, security, agent actions, testing, governance, incidents, contract, and exit. BrandQuill does not assess or approve the vendor.
THE PRACTICAL ANSWER
Make each decision narrow, owned, and reviewable.
Send one questionnaire for the exact vendor, product, plan, model supply chain, configuration, data, integrations, users, and intended workflow under review. Require current evidence, owners, and dates. Qualified reviewers should verify the answers, record gaps and conditions, and make a separate approval decision. A complete questionnaire is evidence for review, not proof that the vendor is safe or compliant.
WHAT THE TEMPLATE SHOULD CAPTURE
The fields that turn a conversation into a decision record.
Exact product and AI functionality
Identify every AI feature, whether it is optional, the proposed configuration, intended use, prohibited use, and role in decisions or actions.
Models and fourth parties
List model providers, model versions, data providers, plug-ins, sub-processors, gateways, and the process for material changes.
Data use and retention
Document what is processed, where it travels, whether customer content improves models, how long it remains, and how deletion is verified.
Security and agent permissions
Capture identities, scopes, repositories, APIs, tools, external actions, human approvals, logs, rollback, and misuse controls.
Performance and affected people
Request representative evaluation, limitations, different group and language results, accessibility, unsafe output, and reliance controls.
Governance and incidents
Identify accountable roles, approval gates, monitoring, complaint and failure routes, evidence preservation, notification, containment, and recovery.
Contract and exit rights
Review data, ownership, output, training, changes, audit, liability, remedies, suspension, portability, return, and verified deletion.
Evidence and internal decision
Attach current documentation, record gaps and owners, route qualified review, set conditions and expiry, and obtain an authorized decision.
A WORKABLE PROCESS
Complete the record in four passes.
- 1
Scope the exact purchase
Name the product, plan, configuration, region, features, model supply chain, integrations, users, data, intended workflow, outputs, decisions, and contract stage.
- 2
Send the evidence request
Ask the vendor to answer every applicable question, identify unknowns, attach current evidence, name the evidence owner, and date the response.
- 3
Verify instead of accepting
Route the answers and evidence to the qualified procurement, security, privacy, legal, accessibility, risk, records, and operational reviewers that apply.
- 4
Record a separate decision
Capture gaps, required changes, contract conditions, permitted scope, prohibited use, monitoring, incidents, expiry, reassessment triggers, and final approval authority.
COMMON FAILURE MODES
A completed form can still hide the real risk.
- Sending a generic security questionnaire without identifying model providers, training use, prompt retention, AI-specific failures, or agent actions.
- Accepting a yes or no answer without requesting the current document, report, log, contract term, configuration, test result, owner, and date that support it.
- Assessing the vendor brand in general instead of the exact product, plan, configuration, region, model supply chain, features, integrations, and intended workflow.
- Treating certifications, model cards, or contract language as substitutes for testing the proposed use, people, data, outputs, decisions, and operating controls.
- Approving onboarding without change notice, monitoring, incident duties, audit rights, exit support, verified deletion, reassessment triggers, and an accountable owner.
THE COMPLETE OPERATING SET
Use one coordinated toolkit instead of disconnected forms.
The BrandQuill AI Policy Operations Kit includes the editable AI policy, tool approval register, use-case risk assessment, incident report, acknowledgement form, Excel AI governance workbook, implementation guide, and lifetime BrandQuill Solo access.
$19 once
No subscription. Seven-day fit guarantee.See the complete kit →Download the free Excel vendor assessment →COMMON QUESTIONS
Use the template for structure, not certainty.
What is an AI vendor due-diligence questionnaire?
It is a structured information and evidence request used to examine an AI vendor, product, model supply chain, data practices, security, testing, governance, incidents, contract, and exit before a separate approval decision.
Is this different from a normal vendor security questionnaire?
Yes. Use it alongside the organization's existing security and procurement process. It adds AI-specific questions about models, training use, prompt and output handling, retrieval, agent permissions, unpredictable output, human oversight, monitoring, and model changes.
Does BrandQuill send my entries to an AI model?
No. The questionnaire is assembled locally in the browser from fixed, reviewable question sets. Entries are not sent to BrandQuill or an AI model.
Can I edit the questionnaire in Microsoft Word?
Yes. The free generator creates a normal editable DOCX with 40 questions, response and evidence prompts, reviewer fields, a decision record, and reference points for qualified reviewers.
Does a completed questionnaire mean the vendor is approved?
No. Vendor answers and evidence require verification. Qualified reviewers must assess the exact purchase and use, resolve gaps, set conditions, and record the authorized decision.
What does the paid kit add?
The free generator creates one vendor questionnaire. The $19 AI Policy Operations Kit adds the coordinated AI policy, living tool register, use-case risk assessment, incident report, employee acknowledgement, Excel governance workbook with 30 starter risks and dashboard, implementation guide, and lifetime BrandQuill publishing.