Back to the CIO and CSO starting point Security and GRC hub
AI Security Questionnaire Templates (Buyer and Vendor)
AI security questionnaire templates are reusable question sets. A buyer sends one to an AI vendor, or a vendor prepares answers to one in advance. Lightbridge publishes two free CSV versions with 56 original questions each, plus the evidence to request or prepare and standards identifiers. They are generic education, not a compliance attestation.
Each row has an ID, a theme, a question, why it matters, the evidence to request (buyer) or prepare (vendor), and standards identifiers. Standards sources were reviewed between 2024 and 2026-11-03; each source below shows its own date. This page is part of Lightbridge's security and GRC advisory hub, and it pairs with the guide to the questions AI vendors are asked.
What the Lightbridge templates are, and what they are not.
The questions are Lightbridge's own wording, written by Lightbridge around themes drawn from the public standards cited below. They cover customer data use, retention, subprocessors, incidents, logging, testing, identity, agents, contracts, exit, and the shadow AI topics. Five themes carry two questions each, where one is not enough.
They are generic education. Answering them is not a compliance attestation, and Lightbridge makes no certification claim of any kind. A completed template shows what a vendor states, and it does not show that the statement is true. Ask for the evidence in the last column, and check it.
The files have no red-flag column and no pass or fail thresholds. We did not find verified thresholds in the sources we reviewed, so the files set none. Set your own bar by data class and by the access path you choose, which the AI access paths comparison explains.
Free downloads from Lightbridge: buyer and vendor CSV files.
Both files are plain CSV, open in any spreadsheet, and need no form or email address. Question IDs run B-01 to B-56 in the buyer file and V-01 to V-56 in the vendor file, and the same number is the same theme in both.
- Buyer version: 56 questions to send to an AI vendor, with the evidence to request.
- Vendor version: the same themes, worded for the vendor, with the evidence to prepare.
If you only want to collect other publishers' instruments, the questionnaire resources page lists them with their stated reuse terms.
A sample of 12 questions from the Lightbridge buyer template.
The full file has 56 rows. These twelve show the format. Scroll sideways on a small screen. The vendor file words the same rows for the vendor and swaps the last evidence column to "evidence to prepare".
| ID | Theme | Question | Why it matters | Evidence to request | Standards identifiers |
|---|---|---|---|---|---|
| B-01 | Training on customer data | For each product and plan we will use, are prompts, files, outputs or feedback used to train, fine-tune or evaluate any model? | Defaults differ by plan and route, and a setting an admin can flip is weaker than a contract clause. | Per-plan table of default training use, the contract clause that prohibits it, and who can change the setting. | NIST AI 600-1 risk 2.4 Data Privacy; GDPR Art. 28(3) |
| B-03 | Retention and zero data retention | What is retained, for how long, and where, for prompts, outputs, embeddings and logs, and can retention be set to zero for our plan? | Retention by data type and route is an answer that can be left blank, so ask for it by name. | Retention schedule by data type and hosting route, and the documented steps to request zero retention. | NIST AI 600-1 risk 2.4 Data Privacy; GDPR Art. 28(3)(g) |
| B-05 | Subprocessors and model providers | List every subprocessor and model provider that can touch our content, including sub-subprocessors, and say how we are told of changes. | The model provider behind a product can be a subprocessor in practice, and notice terms vary. | Current subprocessor list, change-notice terms, and a flow-down statement. | GDPR Art. 28(2); GDPR Art. 28(3)(d); GV-6.1-007 |
| B-07 | Incident definition and notification | How do you define an AI incident, and what is the notification time for incidents involving our data? | A security incident definition written for breaches may not cover prompt leakage or model misuse. | Incident definition, notification clock, contact route, and a sample notice format. | GV-6.2-002; NIST AI RMF MANAGE |
| B-10 | AI audit logging | Can we export AI audit logs to our own SIEM, and is content redaction configurable? | Central review needs the logs in your tools, and redaction limits secondary exposure. | Export format, delivery method, and redaction settings documentation. | NIST AI RMF MANAGE |
| B-14 | Shadow AI discovery and inventory | Do you maintain an inventory of AI tools in use, including embedded features, and who owns it? | You cannot answer other questions about AI use without a current list. | Inventory extract with owner, data class and last review date. | GV-1.6-003; GV-6.1-007 |
| B-20 | Accountable owner for AI risk | Who is the accountable owner for AI risk at the vendor, and what is the escalation route? | Named accountability makes every other answer easier to verify. | Role title, reporting line and escalation contact. | NIST AI RMF GOVERN |
| B-23 | Data residency and location | Where is our data stored and processed for each AI feature, including inference, logs and support access? | Location can differ between the model, the logs and the support team. | Region list by data type and route, and the contract commitment. | None cited |
| B-25 | Liability, indemnity and insurance | What liability, indemnity and insurance terms apply to AI-specific harms, and what are the caps? | General caps may sit below the exposure an AI failure creates. | Contract extract and certificate of insurance. | GV-6.1-004; GV-6.1-006 |
| B-28 | Agent permissions and approval gates | What can an AI agent do on its own, which actions need human approval, and how are its permissions scoped? | Agents act, so permission scope is the control that limits damage. | Permission model, approval-gate list and a sample audit trail. | OWASP LLM06:2025 Excessive Agency |
| B-35 | Provider staff access | Can your staff or the model provider's staff read our content, under what conditions, and is access logged? | Human review for abuse monitoring can be an exception to privacy commitments. | Access policy, conditions, and log availability. | GDPR Art. 28(3)(b); NIST AI 600-1 risk 2.4 Data Privacy |
| B-41 | Supply chain integrity | How do you vet models, libraries and datasets you bring into the system, and how do you track their provenance? | Components in the AI supply chain can carry the same risks as software dependencies. | Vetting process and a bill of materials or equivalent. | OWASP LLM03:2025; NIST AI 600-1 risk 2.12 Value Chain and Component Integration |
Rows are Lightbridge's original wording. Identifiers point to published standards and are not quotations. Generic education, not an attestation.
How Lightbridge suggests using the buyer and vendor templates.
For a buyer
- Decide the data class and the access path first. The answer to many rows changes with the route.
- Cut the file to the rows that apply. A short list that gets read beats a long one that gets skimmed.
- Ask for the evidence column, with a date, instead of a yes or no.
- File the answers with the approved-tool record, so the next review starts from them. The shadow AI guide covers that inventory.
For a vendor
- Answer each row once, in writing, and keep the answer under version control.
- Attach a document and a clause for every commitment. Link to a public page where one exists.
- Mark gaps plainly. State a gap in one plain sentence rather than leaving a vague answer.
- Check that your logging and audit evidence matches what you say. The observability and audit logging page and the contracts and legal page cover two common sources of mismatch.
Standards the Lightbridge templates cite by identifier, and what we verified.
Each source is linked with the date shown on it; sources were read in November 2026. The templates cite identifiers only.
- NIST AI 600-1, Generative AI Profile, published 26 July 2024 (NIST page updated 8 April 2026). Section 2 names 12 risks. Action IDs follow the pattern FUNCTION-category.subcategory-NNN. Vendor and third-party actions cluster under GOVERN 6.1 and 6.2, for example GV-6.1-004 for contracts and SLAs, GV-6.1-007 for third-party inventory, and GV-6.1-009 for procurement due diligence. The PDF states it is free of charge. The licence text itself was not retrieved, so exact reuse terms are unconfirmed.
- NIST AI RMF 1.0, released 26 January 2023 for voluntary use, with four functions: GOVERN, MAP, MEASURE and MANAGE. The NIST page (modified 13 August 2026) says it is being revised as part of the White House AI Action Plan.
- OWASP Top 10 for LLM Applications 2025, entries LLM01 to LLM10 (page modified 17 April 2025). OWASP states a Creative Commons Attribution-ShareAlike 4.0 licence for site content, which is why the templates cite identifiers and do not reuse its text.
- MITRE ATLAS, which shows 16 tactics and 221 techniques (atlas-data release v2026.10). The templates cite AML.T0051.000, AML.T0051.001 and AML.T0054, as OWASP cites them. We did not retrieve the ATLAS terms of use.
- GDPR Article 28, on processors, including the contract items in 28(3). The EU AI Act articles cited are 16, 25, 26 and 50. Regulation (EU) 2026/1744 of 8 July 2026 amends the Act, so check each article against the consolidated text. No reuse licence was found for either.
- ISO/IEC 42001:2023, published December 2023, which the ISO catalog describes as specifying requirements for an AI management system. For help with ISO/IEC 42001 readiness, see Lightbridge Automation. The full text is paid. We reviewed only the catalog page, so the templates cite the standard as a reference and make no claim about its controls.
Two public instruments were reviewed for context and deliberately not copied. The CSA AI Controls Matrix v1.1 (released 22 June 2026) states 247 control objectives across 18 domains and includes the AI-CAIQ, a question set for self-assessment or vendor evaluation. We could not read its domain or question IDs from the public page, so the templates do not map to them. The HECVAT, current version 4.1.6 per EDUCAUSE, added AI questions in version 4. Its terms limit free use to college and university business.
How Lightbridge advises on AI security questionnaires.
Lightbridge is an independent advisory and program-management firm. We help buyers decide which rows matter for their data and route, and help vendors build an evidence pack that answers them once. Where hands-on configuration is needed, vetted partners deliver under Lightbridge's program management. This page recommends no vendor.
Lightbridge Automation, a sibling practice in the Lightbridge group, offers AI governance consulting and publishes explainers on zero data retention, LLM gateways, the NIST AI RMF, ISO/IEC 42001 and the EU AI Act. If a recommendation here points to work a sibling practice would deliver, Lightbridge discloses that upfront and you remain free to take the work elsewhere.
Lightbridge FAQ: AI security questionnaire templates
Are these templates a standard or a certification?
No. They are original questions written by Lightbridge as generic education. Answering them does not certify anything, and Lightbridge makes no certification claim. Standards appear only as identifiers, so you can look up the source text yourself.
Why do the templates not copy HECVAT or AI-CAIQ questions?
EDUCAUSE states that it owns the HECVAT copyright and that colleges and vendors may use it for college and university business at no cost, while other parties need specific permission. The Cloud Security Alliance page for the AICM states the matrix is freely available to download but states no reuse terms. Lightbridge wrote its own questions and did not copy either. If you need those instruments, download them from their publishers.
How should a buyer use the buyer version?
Pick the rows that match the data and the access path involved, send them, and ask for the evidence in the last column instead of a yes or no. Cut the list to the rows that apply. The templates set no pass or fail thresholds.
How should a vendor use the vendor version?
Use it as a preparation checklist. For each row, write the answer once, attach the evidence, and note the date. Name the document and clause behind each answer. Where you have nothing to show, say so plainly rather than answering vaguely.
Which standards do the identifiers point to?
NIST AI 600-1 action IDs and risk numbers, NIST AI RMF function names, OWASP Top 10 for LLM Applications 2025 entries, MITRE ATLAS technique IDs, GDPR Article 28 paragraphs, EU AI Act article numbers, and ISO/IEC 42001:2023 as a catalog reference. Each is linked in the standards section on this page with its source date. Readiness work for that AI management system standard, and AI policy and risk-program work, sits with Lightbridge Automation, the sibling practice described at the foot of this page.
Is the EU AI Act reference current?
Check it. Regulation (EU) 2024/1689 has been amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI) of 8 July 2026, and application dates for some chapters changed, so older summaries may be out of date. The consolidated text is on EUR-Lex (CELEX 32024R1689). The templates cite article numbers only. Confirm each against the consolidated text, and take legal advice for your situation.
Can we reuse and edit the files?
Yes. The CSV files are free to download with no form. Edit them for your own review process. Use them freely inside your organization. If you share a copy outside it, link back to this page, which carries the note that the templates are not an attestation. No reuse licence is granted beyond that.
Put the templates to work with a Lightbridge advisor.
Bring a questionnaire you have received or one you need to send. Lightbridge will help you cut it to what matters and plan the evidence.