X-Unsent: 1
To:
Subject: Security questions for [project name]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Dear [supplier name],

Thank you for your interest in [project name]. Alongside the brief, we are as=
king every supplier the same security questions. Please answer in writing, as=
 specifically as you can: the names of tools, settings, people and steps.

Your data
1. Which other companies' tools will handle our data?
2. Will our data be stored, for how long, and will it be used to train anyone=
's models?
3. What happens to our data when the project ends?
4. How will you handle personal information about our customers or staff?

Access
5. What access will you need to our systems, and for how long?
6. Who on your side will see our information?
7. Do you hold Cyber Essentials or another certification?

How the AI system is built
8. What can the AI do without a person approving it?
9. How have you thought about prompt injection?
10. What is logged, and who reviews the logs?
11. Do you follow any published guidance on AI security?

When things go wrong
12. If there is a security incident, how and when will you tell us?
13. What insurance do you hold?
14. Can we leave, and take our data and configuration with us?

[Delete any questions that do not fit this project.]

Please send your answers by [date].

Thanks,

[Your name]
[Your business]

(These questions come from https://aiconsultancyfinder.com/advice/ai-supplier=
-security-questions/)