Before you let an AI supplier or consultant near your systems, you want to know how they will look after your information. You do not need to be a security expert to ask. You need the right questions and a sense of what a good answer sounds like. This page gives you both.
Key takeaways
- Ask in writing and ask every supplier the same questions, so you can compare.
- Good answers are specific: names of tools, settings, people and steps.
- Vague reassurance ("we take security very seriously") is not an answer.
- For anything about personal information, ask the supplier and check the reply with your data protection adviser.
How to use these questions
Pick the ones that fit your project. A small chatbot on your website needs fewer than a system that reads your customer records. Send them with your brief (our AI project brief template has a section for them) and ask for written replies.
Nobody gets every answer perfect. What you are testing is whether the supplier has thought about it.
Download: security questions with space for answers (Word) · email sending the questions (email template, .eml)
Your data
Which other companies' tools will handle our data? Good: a list of the AI models and cloud services involved, and where each is based. Worrying: "it's all secure" with no names.
Will our data be stored, for how long, and will it be used to train anyone's models? Good: a clear answer for each tool, with the setting or plan that controls it and a link to the terms. Worrying: they have not checked, or say "the AI forgets everything".
What happens to our data when the project ends? Good: it is returned or deleted, and they confirm it in writing. Worrying: no plan.
How will you handle personal information about our customers or staff? Ask, and check the reply with your data protection adviser. A good supplier expects the question and is ready to work with your adviser.
Access
What access will you need to our systems, and for how long? Good: the least access needed, through accounts you control, removed at the end. Worrying: asking for an admin password, or using a shared login.
Who on your side will see our information? Good: named people or roles. Worrying: "the team", with subcontractors unmentioned.
Do you hold Cyber Essentials or another certification? Cyber Essentials is the UK government-backed baseline scheme covering five basic technical controls.1 Good: they hold it, or explain what they do instead and why. Worrying: they have not heard of it. Neither answer settles things alone, but it tells you how seriously they take the basics.
How the AI system is built
What can the AI do without a person approving it? Good: a short list, with approval steps for anything involving money, customers or deleting data. Worrying: "it's fully automated" for tasks that matter.
How have you thought about prompt injection? Prompt injection is when hidden text in an email or document tricks an AI into following it. The National Cyber Security Centre (NCSC) says it may never be fully mitigated and advises caution about products that claim to "stop" it.2 Good: they limit what the tool can reach and do, and log its actions. Worrying: "our model ignores that" or "we have a filter that blocks it". See our prompt injection explainer.
What is logged, and who reviews the logs? Good: inputs, outputs and actions are recorded and someone checks them. Worrying: nothing is kept.
Do you follow any published guidance on AI security? The government's AI Cyber Security Code of Practice, published 31 January 2025, sets out baseline security principles for AI systems, with an implementation guide.3 Good: they know it, or similar guidance from the NCSC, and can say how they apply it. Worrying: they see security as someone else's job.
When things go wrong
If there is a security incident, how and when will you tell us? Good: a named contact and a time frame written into the contract. Worrying: "that won't happen".
What insurance do you hold? Good: they tell you the types of cover. Ask your own broker whether it is enough for your project.
Can we leave, and take our data and configuration with us? Good: yes, in a usable format. Worrying: everything lives in their own account and cannot be moved. Our red flags guide covers lock-in in more detail.
Larger organisations
If you have an IT or security team, they will have their own supplier questionnaire. Use it, and add the AI-specific questions above: training on your data, what the system can do unsupervised, prompt injection and logging. Standard questionnaires often miss them.
What to do with the answers
Put the replies side by side. Lean towards the supplier whose answers are plain, specific and honest about limits. If a reply is hard to follow, ask them to explain it, and if it still is, treat that as an answer. For the wider selection process, see questions to ask an AI consultant and how to choose an AI consultant.
Sources
-
National Cyber Security Centre, "Cyber Essentials: overview", undated, https://www.ncsc.gov.uk/cyberessentials/overview, accessed 2026-11-14. ↩
-
National Cyber Security Centre, "Prompt injection is not SQL injection (it may be worse)", published 8 December 2025, https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection, accessed 2026-11-14. ↩
-
Department for Science, Innovation and Technology, "AI Cyber Security Code of Practice", published 31 January 2025, https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice, accessed 2026-11-14. ↩