AI Vendor & Model Provider Security Questionnaire

Assesses AI providers on training-data use, retention, isolation, model supply chain and incident handling.

Available soon

Format: Excel
Size: 72 KB
Length: 11 sheets
Version: 1.0
Updated: 9 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.09 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Send this questionnaire from review depth 2 when an outside provider supplies the model (evidence E-8 of the LLM Application Security Review Procedure). At depth 1 it is not required: read the provider's published security statement instead.
2	Use one workbook for each provider. On the Provider sheet, enter who the provider is, the feature it supplies and the dates. If the company behind the model differs from the provider you contract with, name it, and ask the model questions about both (VQ-04, VQ-18).
3	Procurement sends the Questionnaire sheet's question and evidence columns to the provider (LLM Application Security Review Procedure, stage RP-4). Keep the good-answer columns back. They are for the reviewer.
4	When the provider replies, choose an answer for each row: Answered with evidence, Answered, no evidence, Not answered, Not applicable. Put the reference of the evidence you hold in the evidence column, or the reason a question does not apply. A row you leave blank counts as not answered.
5	The reviewer is the person who reads the answers for security. It is never the owner of the feature. For each answered row, read the evidence against the good answer, then choose Meets or Falls short. Use the ask-more column to decide what to ask next.
6	Read the next-step column. It gives the follow-up for every row: chase the evidence, ask again, or take a gap to the contract. Agree a date with the provider for the open questions and enter it on the Provider sheet.
7	Read the Result sheet: the counts of questions answered with evidence, open and unsatisfactory, in total and by section. Read the Terms sheet to see which questions inform each supplier term (P24) and contract clause (P06).
8	Give the answers to the supplier decision (P06). The decision stays with the supplier process. Keep the completed workbook with the review file for the feature (LLM Application Security Review Procedure, evidence E-8, and GS-17 and GS-29).
9	Ask again when the provider changes a model, a sub-processor or a term. A provider's change of model is a trigger for review (GS-18).

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps you secure the generative AI your organisation builds, configures or buys. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. A test that finds no problem does not show that a feature is secure. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts: confirm it with counsel.

The idea behind it. An LLM application puts instructions and data in one channel. The model reads the organisation's instructions and an attacker's words as the same kind of thing, so the checks that work for ordinary input, such as matching a field against a pattern, cannot tell them apart. The national cyber centres and OWASP both say the defence lies in the system around the model, because the model will sometimes be fooled. Everything the organisation already does for access, logging, secure development, patching and supplier assurance still applies and is not repeated here. This pack adds what is specific: what the model may read, what its output may reach, what it may do, who approves what it does, and how the organisation tests all of this before release and watches it afterwards. The result is counts of features reviewed, checks verified and findings open. It is never one score.

Counts, not a score. The result is the number of questions answered with evidence, open and unsatisfactory. The workbook never adds them into a score.

Where the rules live. The rules on which AI may be used, with which data, who approves a use and how a use is recorded are P24's (AG-01 to AG-22). This pack does not change them. It sets what a generative AI feature has to do to be secure once a use is approved, and what the organisation checks before the feature goes live and while it runs. The supplier terms ST-1 to ST-8 are in the AI Tool Approval & Data Permission Matrix; the contract clauses are in the supplier pack (P06).

EXAMPLE: the distributor sent this questionnaire on 14 Sep 2026 to SUP-005 (email and office software provider), which supplies the office-suite assistant. The provider returned answers on 25 Sep 2026. The distributor has about 900 staff and is an important entity under NIS2 in its Member State.

Adapting this template

Small organisation: a provider's trust centre or security page often answers many rows. Paste the link into the evidence column and check it against the good answer. Ask the provider only for what is missing.

Regulated organisation: if a sector regulator or a customer contract asks questions of your suppliers, add them on a further sheet and count them separately, so that these counts keep their meaning.

Service provider or outsourced IT: if an outsourced IT provider runs the AI tool for you, send the questions through them to the model provider and record who answered. The answers about the model supplier matter most.

This workbook is your own record. Keep it with the evidence it rests on.

Provider

The provider and the feature

Say who the provider is and which feature it supplies. One workbook covers one provider. Yellow cells are yours.

Field	Your answer	Help
Provider's supplier reference (P06)	SUP-005	The supplier's reference in your supplier register (P06). Leave blank if there is none yet.
Provider's name	Email and office software provider	The name as the supplier register gives it.
Company behind the model, if different	[[name, or leave blank]]	Fill in only if the company behind the model differs from the provider you contract with (VQ-04, VQ-13, VQ-18).
Feature the provider supplies	LF-1: Draft and summarise with the office-suite assistant	The feature this provider supplies, as the review describes it.
Use ID in the AI inventory (P24)	AI-001	The use's ID in the AI inventory (P24).
Questions sent on	14 Sep 2026	The date procurement sent the Questionnaire sheet's questions and evidence columns to the provider.
Answers returned on	25 Sep 2026	The date the provider returned answers. Leave blank while you wait.
Answered by at the provider (name and role)	[[name and role]]	The person at the provider who answered. Their name and role go in your record.
Reviewed by (role)	EXAMPLE: Head of Information Security	The person who reads the answers against the good answers. Not the owner of the feature.
First read finished on	[[YYYY-MM-DD]]	The date the reviewer finished the first read.
Date agreed to close the open questions	[[date agreed with the provider for the open items]]	The date the provider agreed to close the open questions.
Supplier's decision under P06	Approve	The supplier's current decision under P06. The answers inform the next one. They do not replace it.

Questionnaire

One row per question. Send columns B to E to the provider; keep the good-answer columns for the reviewer. Yellow columns are yours. EXAMPLE: SUP-005, email and office software provider, answers returned 25 Sep 2026.

Example	ID	Section	Question for the provider	Evidence to ask for	Supplier term (P24)	Clause (P06)	Requirement it informs	A good answer looks like (reviewer)	Ask more if the answer is (reviewer)	Answer	Evidence held, or why not applicable	Open?	What to do next	Check	Open so far (working)
EXAMPLE	VQ-01	Training and use of our data	Do you use our prompts, files or outputs to train or improve your models, or anyone else's?	The contract term or the product terms	ST-1		GS-17	A plain No, written into the contract, for the provider and for any model supplier. A product page alone is weaker.	Yes, or only if you opt in, or a promise in marketing text.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK
EXAMPLE	VQ-02	Training and use of our data	Is that off by default, and can we see and lock the setting?	A screenshot or document of the setting	ST-1		GS-17	Off by default. An administrator can see the setting and lock it for everyone.	On by default, a per-user setting only, or a setting nobody on your side can see.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK
EXAMPLE	VQ-03	Training and use of our data	Do people at the provider read our prompts or outputs, and under what conditions?	The policy on human review			GS-08	Staff read prompts or outputs only for a named reason, with access approved and logged. No routine reading.	Routine review by staff or contractors, or no stated conditions.	Answered, no evidence		Open	Ask the provider for the evidence named in the Evidence column and agree a date. The question is open until it arrives.	OK	VQ-03
EXAMPLE	VQ-04	Training and use of our data	Does the company that supplies the underlying model keep or use our data, and on what terms?	The terms between the provider and its model supplier	ST-3	CL-04	GS-17	The model supplier is named, and its terms say it keeps nothing and uses nothing for its own purposes.	The model supplier keeps prompts, or the provider cannot show its terms.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03
EXAMPLE	VQ-05	Training and use of our data	Do you process personal data in our prompts, files and outputs only on our documented instructions, under processor terms?	The data processing terms	ST-2	CL-06	GS-17	Yes. Processor terms are signed, and the provider handles personal data only on your documented instructions.	The provider acts as a controller for any of your data, or the terms are not signed.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03
EXAMPLE	VQ-06	Retention and deletion	How long are prompts, outputs, files, embeddings and logs kept, and can we set the period?	The retention schedule and the setting			GS-08	A schedule for each kind of data, with the periods stated and a setting you can change.	As long as needed, no periods, or periods you cannot change.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03
EXAMPLE	VQ-07	Retention and deletion	How do we delete our data, and how do you confirm that it is deleted, including indexes and fine-tuned copies?	The deletion procedure and a sample confirmation	ST-6	CL-13	GS-12	A route you can start, and written confirmation that covers indexes, caches and any fine-tuned copy.	Deletion on request only, no confirmation, or fine-tuned copies left out.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03
EXAMPLE	VQ-08	Retention and deletion	Are copies of our data kept in backups, and for how long?	The backup policy	ST-6	CL-13	GS-08	Backups are listed with the period they are kept and how deleted data leaves them.	Backups kept without limit, or no period stated.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03
EXAMPLE	VQ-09	Isolation	How is our data separated from other customers' data in storage, indexes, caches and memory?	An architecture description			GS-12	A description of how each customer's data is kept apart in storage, indexes, caches and memory.	A shared index or cache separated only by a software filter, or a description too vague to check.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03
EXAMPLE	VQ-10	Isolation	Can one customer's prompts, cache or memory affect another customer's answers?	A written statement and the design basis for it			GS-12	A clear No, with the design reason: caches and memory are kept for each customer separately.	Shared caches or memory across customers, or a No with no reason.	Answered, no evidence		Open	Ask the provider for the evidence named in the Evidence column and agree a date. The question is open until it arrives.	OK	VQ-03, VQ-10
EXAMPLE	VQ-11	Isolation	Where are our prompts, outputs and logs stored and processed, and can we choose a region?	The contract schedule and the product page	ST-4	CL-05	GS-17	Locations named for storage and processing, a choice of region, and notice before a change.	Locations not named, global processing, or no choice.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10
EXAMPLE	VQ-12	Isolation	Who at the provider can reach our data, how is that approved, and is it logged?	The access policy and a sample log			GS-19	Named roles only, access approved for a reason, limited in time and logged. You can ask for the log.	Any engineer can reach customer data, or access is not logged.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10
EXAMPLE	VQ-13	Model supply chain	Which models does the service use, from which suppliers, and which versions?	A list of models and versions	ST-3	CL-04	GS-15	A current list of the models, their suppliers and versions for the features you use.	Models not named, or may change without notice.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10
EXAMPLE	VQ-14	Model supply chain	How do you check the integrity and source of models, adapters, datasets and libraries that you take from others?	The procedure and an example			GS-15	A written procedure that checks the publisher, source and file hash of each artefact and loads it without running code, with an example.	No procedure, or artefacts taken from public sources without checks.	Answered, no evidence		Open	Ask the provider for the evidence named in the Evidence column and agree a date. The question is open until it arrives.	OK	VQ-03, VQ-10, VQ-14
EXAMPLE	VQ-15	Model supply chain	How do you test for poisoned data and hidden behaviour in what you use?	A test summary			GS-15	A summary of tests for poisoned data and hidden behaviour, with dates and who ran them.	We trust our suppliers, or no tests.	Not answered		Open	Ask again and agree a date with the provider. The question is open until it is answered.	OK	VQ-03, VQ-10, VQ-14, VQ-15
EXAMPLE	VQ-16	Model supply chain	Do you keep a bill of materials for the service, and can we see it?	The bill of materials or a summary			GS-16	A bill of materials, or a summary of one, listing models, datasets, libraries and services, which the provider shares.	None kept, or not shareable.	Not answered		Open	Ask again and agree a date with the provider. The question is open until it is answered.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16
EXAMPLE	VQ-17	Model supply chain	How much notice do we get before you change a model or its version, and can we delay the change?	The contract term or the change policy	ST-7	CL-20	GS-18	Written notice, with a stated number of days, before a model or version change, and a way to delay it or stay on a version.	Changes at will, or notice only after the change.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16
EXAMPLE	VQ-18	Sub-processors	Which sub-processors do you use, including the model supplier and hosting?	The current list	ST-3	CL-04	GS-17	A current list that names the model supplier and the hosting, and a way to be told of changes.	No list, or the model supplier left out.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16
EXAMPLE	VQ-19	Sub-processors	How do you give notice of a change of sub-processor?	The contract term	ST-3	CL-04	GS-17	Written notice before the change, with time to object or leave.	Notice after the change, or none.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16
EXAMPLE	VQ-20	Security testing and vulnerabilities	What security testing of the AI features have you done, when, and by whom, including testing for prompt injection? Will you share a summary?	A test summary with dates		CL-12	GS-28	A summary with dates that names who tested and what was covered, including prompt injection.	Only general penetration tests that leave out the AI features, or no summary.	Answered, no evidence		Open	Ask the provider for the evidence named in the Evidence column and agree a date. The question is open until it arrives.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20
EXAMPLE	VQ-21	Security testing and vulnerabilities	How do you handle a report of prompt injection or another AI vulnerability, and how do you tell customers?	The disclosure and notice procedure		CL-08	GS-20	A published route for reports, a named team, a way to tell customers and an example of a notice.	No route, or customers are not told.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20
EXAMPLE	VQ-22	Security testing and vulnerabilities	What protections against data leaving through links, images and rendered output are built into the product?	Product documentation			GS-07	The product does not load images or links named in model output on its own, shows full addresses, and says so in its documents.	Links and images load automatically.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20
EXAMPLE	VQ-23	Security testing and vulnerabilities	Which rate limits and spending controls can we set?	Product documentation			GS-21	Limits for each person and each feature, and a spending cap that stops use when it is reached.	Only a billing alert.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20
EXAMPLE	VQ-24	Incident notice	How and how soon do you tell us of a security incident that exposes our prompts, outputs, files or accounts?	The contract term	ST-5	CL-07	GS-20	A stated time and route for notice, in the contract, covering prompts, outputs, files and accounts.	No time and no route.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20
EXAMPLE	VQ-25	Incident notice	What logs can we get for our own investigation: audit events, prompts, tool calls and sign-ins?	Product documentation and a sample		CL-11	GS-19	Audit events, prompts, tool calls and sign-ins can be exported, and the provider shows a sample.	Logs only through a support request, or prompts not included.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20
EXAMPLE	VQ-26	Incident notice	Do you tell us when you find misuse of the service that affects us?	The policy or the contract term	ST-5	CL-07	GS-20	Yes. The provider tells you in writing of misuse that affects you, and says how.	No commitment.	Answered, no evidence		Open	Ask the provider for the evidence named in the Evidence column and agree a date. The question is open until it arrives.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
EXAMPLE	VQ-27	Certifications and assurance	Which certificates or independent assurance reports do you hold? Give the name, the scope and the date of each.	The certificate or report itself		CL-02	GS-15	Each certificate or report is named with its scope and date, and you can read the report.	A logo and no certificate.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
EXAMPLE	VQ-28	Certifications and assurance	Does each certificate or report cover the AI feature we use, or only other parts of the company?	The scope statement		CL-02	GS-15	The scope statement names the AI feature you use and the systems that run it.	The scope covers only other products or sites.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
EXAMPLE	VQ-29	Agents, tools and connectors	What can agents and connectors do by default, and how are their permissions limited?	Product documentation			GS-22	Agents and connectors start with nothing switched on, and permissions are set for each tool and limited to the task.	Broad access by default.	Not applicable	EXAMPLE: the feature (LF-1) has no tools or connectors.		Check that the reason holds. Agree it with the reviewer.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
EXAMPLE	VQ-30	Agents, tools and connectors	Can we require approval before an action, and switch a feature off for the whole organisation?	Product documentation and the setting			GS-25	Yes to both: an administrator can require approval before an action and switch a feature off for everyone.	A setting each user controls.	Not applicable	EXAMPLE: the feature (LF-1) has no tools or connectors.		Check that the reason holds. Agree it with the reviewer.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
EXAMPLE	VQ-31	Agents, tools and connectors	How are third-party tools and connectors vetted before they can be used with your service?	The vetting procedure			GS-16	A written vetting procedure, a list of approved connectors and a way to block the rest.	Anyone can publish a connector that users can switch on.	Not applicable	EXAMPLE: the feature (LF-1) has no tools or connectors.		Check that the reason holds. Agree it with the reviewer.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
EXAMPLE	VQ-32	Changes and exit	On exit, can we export and then have deleted our data, prompts, settings and any model or index built from our data?	The exit procedure and the contract term	ST-6	CL-13	GS-17	A tested route to export your data in a usable form, then deletion confirmed in writing, including anything built from your data.	Export without deletion, or no export.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
EXAMPLE	VQ-33	Changes and exit	How much notice do we get if you withdraw a model or a feature, and what help do you give to move?	The contract term		CL-14	GS-18	A notice period in the contract, and help to move.	No notice, or no help.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
EXAMPLE	VQ-34	Changes and exit	Do you give us in writing the intended purpose and the instructions for use of the AI system?	The documents	ST-8		GS-15	Yes. A written statement of the intended purpose and the instructions for use, which you can keep.	Marketing material only.	Answered with evidence	[[reference of the evidence the provider sent]]		Read the evidence against the good answer, then record your view in the Reviewer's view column.	OK	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26

A row you leave blank counts as not answered. A good answer is a guide for the reviewer, not a pass mark. Add no rows inside the table: the Result sheet counts these rows only.

Result

Result

Counts of questions answered with evidence, open and unsatisfactory, in total and by section, calculated from the Questionnaire sheet. Every figure is a count of questions. There is no score.

EXAMPLE: SUP-005, email and office software provider. Clear the EXAMPLE column and the yellow answers to use your own.

Provider

Provider	Email and office software provider (SUP-005)
Feature	LF-1: Draft and summarise with the office-suite assistant
Date agreed to close the open questions	[[date agreed with the provider for the open items]]

Questions by answer

Answer	Questions	What it means
Answered with evidence	24	The provider answered and gave the document, setting or sample named in the Evidence column, or you saw it yourself.
Answered, no evidence	5	The provider answered in words and has not yet given the evidence. The question stays open.
Not answered	2	The provider has not answered, or the answer does not respond to the question. A row you leave blank counts here. The question stays open.
Not applicable	3	The question does not apply to this feature. Give the reason. A question about agents, tools or connectors applies only when the feature has tools or connectors.
Questions asked	34

The questionnaire in numbers

In one line	24 of 31 applicable questions answered with evidence; 5 answered without evidence, 2 not answered
Applicable questions	31	Questions asked, less those not applicable.
Answered, with or without evidence	29 of 31
Open questions	7	Answered without evidence, or not answered (including blank rows).
Which are open	VQ-03, VQ-10, VQ-14, VQ-15, VQ-16, VQ-20, VQ-26
Answers read and judged by the reviewer	0 of 29
Unsatisfactory answers (falls short)	0	The reviewer chose Falls short for an answered question.
Which fall short	None
Rows with a check to clear	0	See the Check column on the Questionnaire sheet.

By section

Section	Applicable	Answered with evidence	Open
Training and use of our data	5	4	1
Retention and deletion	3	3	0
Isolation	4	3	1
Model supply chain	5	2	3
Sub-processors	2	2	0
Security testing and vulnerabilities	4	3	1
Incident notice	3	2	1
Certifications and assurance	2	2	0
Agents, tools and connectors	0	0	0
Changes and exit	3	3	0

Limitations

An answer is a claim until you have seen the evidence. A question answered without evidence is open.

The good answers on the Questionnaire sheet help a reviewer judge a reply. They are not a pass mark. The supplier decision stays with the supplier process (P06), and these counts go into it.

Unsatisfactory answers are the ones the reviewer records as falling short. The example leaves the reviewer's view empty, so none shows as unsatisfactory there.

The result is counts of questions. Never turn the counts into a percentage, a score or a traffic-light total.

A provider's reply says what the provider does today. Ask again when the provider changes a model or a term (GS-18).

Terms

Supplier terms and contract clauses

The supplier terms ST-1 to ST-8 are P24's and the clauses are P06's. This sheet shows which questions inform each, so that the answers and the contract can be read together (GS-17). It does not change a term or a clause.

Supplier terms (AI Tool Approval & Data Permission Matrix)

Term	What it asks	P06 clause	Questions that inform it	Answered with evidence
ST-1	The supplier does not use our prompts, files or outputs to train or improve its models or anyone else's, and says so in the contract.	No clause in the P06 library	VQ-01, VQ-02	2 of 2
ST-2	The supplier processes personal data only on our documented instructions.	CL-06: Data protection: processor terms	VQ-05	1 of 1
ST-3	The supplier names the sub-processors it uses, including the provider of the underlying model, and gives notice before it changes them.	CL-04: Sub-processors and subcontracting	VQ-04, VQ-13, VQ-18, VQ-19	4 of 4
ST-4	The supplier states where prompts, outputs and logs are stored and processed, and gives notice before it changes the locations.	CL-05: Locations of service and data	VQ-11	1 of 1
ST-5	The supplier notifies us of a security incident that exposes our prompts, outputs, files or accounts.	CL-07: Security incident notification	VQ-24, VQ-26	1 of 2
ST-6	On exit the supplier returns and deletes our prompts, outputs, logs, uploaded files and any model or index built from our data.	CL-13: Data return and deletion	VQ-07, VQ-08, VQ-32	3 of 3
ST-7	The supplier gives notice before it adds or changes an AI feature in a service we already use.	CL-20: Notice of material changes	VQ-17	1 of 1
ST-8	The supplier gives us in writing the intended purpose and instructions for use of the AI system (EU AI Act Articles 3(12) and 3(15)).	No clause in the P06 library	VQ-34	1 of 1

Contract clauses (P06)

Clause	Title	Terms that use it	Questions that inform it	Answered with evidence
CL-02	Certification and independent assurance	None	VQ-27, VQ-28	2 of 2
CL-04	Sub-processors and subcontracting	ST-3	VQ-04, VQ-13, VQ-18, VQ-19	4 of 4
CL-05	Locations of service and data	ST-4	VQ-11	1 of 1
CL-06	Data protection: processor terms	ST-2	VQ-05	1 of 1
CL-07	Security incident notification	ST-5	VQ-24, VQ-26	1 of 2
CL-08	Vulnerability management	None	VQ-21	1 of 1
CL-11	Cooperation in our incident response	None	VQ-25	1 of 1
CL-12	Penetration testing and security testing	None	VQ-20	0 of 1
CL-13	Data return and deletion	ST-6	VQ-07, VQ-08, VQ-32	3 of 3
CL-14	Exit and transition assistance	None	VQ-33	1 of 1
CL-20	Notice of material changes	ST-7	VQ-17	1 of 1

A question can inform a term, a clause, both or neither. A term with no P06 clause (ST-1, ST-8) goes into the contract in the supplier's own words or as a custom clause.

Lists

AnswerState	FollowText	ReviewView	P06Decision
Answered with evidence	Read the evidence against the good answer, then record your view in the Reviewer's view column.	Meets	None yet
Answered, no evidence	Ask the provider for the evidence named in the Evidence column and agree a date. The question is open until it arrives.	Falls short	Approve
Not answered	Ask again and agree a date with the provider. The question is open until it is answered.		Approve with conditions
Not applicable	Check that the reason holds. Agree it with the reviewer.		Escalate

Reject

Definitions

Definitions

Term	Meaning in this workbook
Provider	The organisation you contract with for the AI service. It can be the same as the company that makes the model, or different.
Model provider	The organisation that supplies the model or the service built on it. It can be the same as the tool supplier or different (the tool supplier may use another party's model).
Feature	One LLM capability the organisation uses, builds or has switched on, for one purpose, with one owner. A feature is the technical view of a P24 use.
Answered with evidence	The provider answered and gave the document, setting or sample named in the Evidence column, or you saw it yourself.
Answered, no evidence	The provider answered in words and has not yet given the evidence. The question stays open.
Not answered	The provider has not answered, or the answer does not respond to the question. A row you leave blank counts here. The question stays open.
Not applicable	The question does not apply to this feature. Give the reason. A question about agents, tools or connectors applies only when the feature has tools or connectors.
Open	A question answered without evidence or not answered. Open questions are what you chase.
Reviewer's view	Meets: The answer and its evidence match the good answer, or are as strong. Falls short: The answer, or its evidence, is weaker than the good answer. This is the count of unsatisfactory answers.
Unsatisfactory	An answered question whose reviewer's view is Falls short.
A good answer	What a reviewer hopes to read for the question. A guide to judge a reply. It is not a pass mark, and the supplier decision stays P06's.
VQ-01 to VQ-34	The 34 questions of this workbook.
ST-1 to ST-8	The supplier terms in the AI Tool Approval & Data Permission Matrix (P24).
CL-nn	A clause of the supplier contract clause library (P06).
GS-nn	A requirement of the Generative AI Security Standard.
EXAMPLE	A worked example: SUP-005, as at 30 Sep 2026. Clear the EXAMPLE values and the yellow answers before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.19 — Information security in supplier relationships	The workbook as a whole: information security in the supplier relationship and in the use of a cloud service
ISO/IEC 27001:2022	Annex A 5.23 — Information security for use of cloud services	The workbook as a whole: information security in the supplier relationship and in the use of a cloud service
NIST CSF 2.0	GV.SC-07 — “The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship”	Questionnaire and Result sheets: the risks a supplier brings are understood, recorded, assessed and monitored
ISO/IEC 42001:2023	Clause 6.1.3 — AI risk treatment	Terms sheet and Result sheet: treating the risks a provider brings with terms and follow-up
ISO/IEC 42001:2023	Annex A 10.3 — Suppliers	The workbook as a whole: assessing a supplier of an AI service
EU AI Act — Regulation (EU) 2024/1689	Article 3(3) — “provider” means “a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge”	Provider sheet and VQ-34: who the provider of an AI system is, and so who gives the intended purpose and instructions for use
EU AI Act — Regulation (EU) 2024/1689	Article 3(4) — “deployer” means “a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity”	Provider sheet: the organisation that uses a provider's system under its own authority is a deployer
EU AI Act — Regulation (EU) 2024/1689	Article 25(1) — a distributor, importer, deployer or other third party “shall be considered to be a provider of a high-risk AI system” and subject to the provider’s obligations where it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to a high-risk system that remains high-risk, or modifies the intended purpose of a system that was not high-risk so that it becomes high-risk under Article 6	Provider sheet: whether putting the organisation's name on a provider's system could change roles is for counsel to read
EU AI Act — Regulation (EU) 2024/1689	Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026	The workbook as a whole: the dates from which the Act's duties apply, as amended
EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI)	Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689	The workbook as a whole: the Regulation that amends the Act and moves some dates
GDPR — Regulation (EU) 2016/679	Article 28(1) — use only processors providing sufficient guarantees of appropriate technical and organisational measures	Questionnaire rows VQ-04, VQ-05 and VQ-18: a controller uses only processors that give sufficient guarantees
GDPR — Regulation (EU) 2016/679	Article 28(3) — a binding contract with the processor, covering documented instructions, confidentiality, security, sub-processors, assistance, return or deletion of data, and audits	Questionnaire rows VQ-05, VQ-07, VQ-18 and VQ-19: the points a processor contract covers, including sub-processors and return or deletion of data
GDPR — Regulation (EU) 2016/679	Article 32(1) — appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the likelihood and severity of risk to people's rights and freedoms	Questionnaire rows VQ-09 to VQ-12 and VQ-24: security of processing that is appropriate to the risk
NIS2 — Directive (EU) 2022/2555	Article 21(2)(d) — “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”	The workbook as a whole: security of the supply chain and of the relationship with each supplier
OWASP Top 10 for LLM Applications 2026	LLM02:2026 Sensitive Information Disclosure — “exposes confidential, regulated, privileged, or proprietary data through a channel the data subject, controller, or system owner did not authorize”. The channel is not only the final answer: tool-call arguments, reasoning traces, retrieved chunks, logs, telemetry and embeddings are disclosure surfaces	Questionnaire rows VQ-01 to VQ-12: channels through which a provider could expose your data, such as logs, caches and retained prompts
OWASP Top 10 for LLM Applications 2026	LLM04:2026 Supply Chain — “LLM supply chains are susceptible to vulnerabilities that affect the integrity of training data, models, adapters, conversion pipelines, and deployment platforms”; third-party models, datasets and adapters can be manipulated through tampering, poisoning or malicious artifact replacement	Questionnaire rows VQ-13 to VQ-17 and VQ-31: the integrity of the models, adapters, datasets and connectors the service depends on
OWASP Top 10 for LLM Applications 2026	LLM05:2026 Data and Model Poisoning — “a class of attacks and failures where an adversary (or unsafe process) manipulates data or model artifacts to embed harmful behavior, bias, or exploitable weaknesses”, at pre-training, fine-tuning, embedding, retrieval and distribution	Questionnaire row VQ-15: tests for poisoned data and hidden behaviour
NIST AI 600-1	NIST AI 600-1, section 2.12 Value Chain and Component Integration — “GAI value chains involve many third-party components such as procured datasets, pre-trained models, and software libraries”, which “might be improperly obtained or not properly vetted”, and it may be difficult to attribute an issue to any one source	Questionnaire rows VQ-13, VQ-14, VQ-16 and VQ-18: third-party components in the value chain that may not be properly vetted
NIST AI RMF 1.0	GOVERN 6.1 — “Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.”	The workbook as a whole: a record of how risks from a third party are addressed
NIST AI RMF 1.0	MAP 4.1 — “Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.”	Questionnaire rows VQ-04, VQ-13, VQ-16 and VQ-18: the risks of the components the service uses are mapped
NIST AI RMF 1.0	MANAGE 3.1 — “AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.”	Result sheet and VQ-17, VQ-19 and VQ-26: risks from third-party resources are monitored and the controls recorded
Guidelines for secure AI system development (NCSC, CISA and partners)	Secure development, “Secure your supply chain” — “You assess and monitor the security of your AI supply chains across a system’s life cycle, and require suppliers to adhere to the same standards your own organisation applies to other software.”	Questionnaire rows VQ-13 to VQ-19: assessing and monitoring the AI supply chain over the life of the service

Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR); OWASP Top 10 for LLM Applications, 2026 edition; MITRE ATLAS 2026.09; NIST AI 600-1; NIST AI RMF 1.0; NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); as published and read on 8 October 2026

ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act or the GDPR.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

Regulation (EU) 2024/1689 binds the operators of its Article 2(1). Article 15 sets requirements for high-risk AI systems, and the provider of such a system answers for them. An organisation that uses another party’s AI system under its own authority is a deployer (Article 3(4)), and its duties are those of Article 26 and the other articles that name deployers. This pack cites Article 15 as the Act’s own statement of what security a high-risk system needs, and cites no system as high-risk. Counsel confirms the role and the category of each system.

Regulation (EU) 2016/679 binds controllers and processors. Article 25 asks the controller for data protection by design and by default, and Article 32 for security of processing that is appropriate to the risk. Both apply to an LLM application that processes personal data. Whether an organisation is a controller or a processor for a given application depends on the facts, and counsel confirms it.

OWASP, MITRE ATLAS, NIST AI 600-1, NIST SP 800-218A, the NCSC blog, the NCSC and CISA guidelines and the joint agency guidance on agents are voluntary guidance. They are not law, and none of them says what the AI Act or the GDPR requires. This pack cites them as their publishers state them.

This pack does not say which OWASP, MITRE ATLAS, NIST or ISO/IEC 42001 items meet a requirement of the EU AI Act or the GDPR. Each reference says what its source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.