AI Security Questionnaires: What Is Asked and How to Answer

An AI security questionnaire is a vendor-assessment form that asks how an AI system or AI feature handles customer data, models, access, and incidents. Buyers send it through procurement, a risk platform, or a spreadsheet. Lightbridge sorts the recurring questions into about 45 themes. Ten of them show up most often across the sources we read.

This page covers how questionnaires arrive, the themes by cluster, what a strong answer to the ten most common themes needs, and two distinctions that trip people up. It belongs to Lightbridge's security and GRC advisory hub. Each standard and vendor statement is linked, with the source's own date shown where the source has one. Lightbridge does not recommend a vendor here.

Talk to an advisor Questionnaire templates

How AI security questionnaires reach a vendor, according to Lightbridge's review.

They arrive in four forms. A published standard questionnaire. A public-sector form. A form built into a third-party risk platform. A custom spreadsheet from the buyer's security team. The same topics repeat across all four, with different wording and different depth.

EDUCAUSE HECVAT: lists version 4.1.6 as current at review and says version 4 added privacy and AI questions. The page is undated.
CSA AI Controls Matrix: CSA states v1.1 (page dated 2026-06-22) has 247 control objectives across 18 domains, and that the download includes the AI-CAIQ, a question set intended for self-assessment or third-party vendor evaluation.
Shared Assessments SIG: a paid product. Shared Assessments states it covers 21 risk domains, including artificial intelligence (page last modified 2026-06-04; that is a vendor statement, not independently checked). Question text is not public, so Lightbridge has not read it.
GovAI Coalition: offers an AI FactSheet for service providers and a buyer's guide, aligned with NIST AI RMF. The page is undated.
Washington State WaTech: initial procurement guidelines from September 2024 with a sample questionnaire in Appendix A.

Lightbridge read about 60 public sources across standards, public-sector forms, vendor trust documentation, risk-platform templates, and contract checklists. That produced about 770 question items, an estimate and not an exact count. Wording varies, so we group by what is being asked.

The recurring themes Lightbridge sees, grouped by cluster.

The questions fall into about 45 themes. Lightbridge groups them here into ten clusters.

Customer data, retention, and training. Training use, retention, zero data retention, human review, caching, deletion, and keeping sensitive data out of models.
Third parties. Model providers, subprocessors, and the supply chain behind the model.
Hosting route and residency. Where processing happens, and whether the same model carries the same guarantees on every access route. Lightbridge covers that on AI access paths and AI hosting options.
Identity and agents. Single sign-on, role-based access, non-human identities, agent permissions, tool access, approval gates, and injection defenses.
Observability. Audit logging and log access, covered on AI observability and audit logging.
Incidents. Definition, notice window, and the ability to switch an AI feature off quickly.
Frameworks and oversight. Certification scope, human oversight, an accountable owner, and regulatory classification.
Legal and contracts. Data processing terms, liability, output ownership, audit rights, government access requests, and exit. See AI contracts and legal.
Model lifecycle. Version pinning, change notice, evaluation, bias, and training data provenance.
Shadow AI. Discovery, acceptable use, embedded AI, default-on features, personal accounts, and evidence. See below and shadow AI.

What a strong answer needs for the ten most common themes, in Lightbridge's reading.

The ten below appear most often across the sources. The order is approximate: several themes sit within one source of each other, so do not read it as a ranking. The right column is Lightbridge's synthesis of what the reviewed sources ask for. It sets no pass mark. Whether an answer is acceptable is the buyer's call.

Theme	What the buyer is asking	What a good answer and artifact contain
Training on customer data and opt-out	Whether prompts, files, outputs, or feedback train or tune any model, and whether the commitment is contractual or a setting an admin can flip.	A per-product, per-plan table showing the default, the contract clause that governs it, who can change it, and how the vendor defines customer data. Attach the policy page with its effective date and the DPA section.
Retention and zero data retention	How long prompts, outputs, and embeddings are kept, and whether retention can be set to zero.	Retention by data type and by access route, which models require retention or human review as a condition of use, and how a zero-retention arrangement is obtained and verified. Attach the retention policy and the contract language.
AI subprocessors and model providers	Every model provider and AI subprocessor in the path of the buyer's data, and how changes are announced.	A current list naming the model provider, the host, and any safety or search vendor, with location, function, data categories, notice period, and objection rights. Attach the subprocessor list. Lists change, so date it.
Incident definition and notification	Whether model-behavior events such as output leakage or a successful injection count as security incidents, and how fast the buyer is told.	A written taxonomy of AI incidents, when the clock starts, the notice window, named contacts, and the responsibility split. Attach the incident response plan. Lightbridge found no shared definition in the sources it read, so expect to negotiate this one.
Certifications and attestations over AI features	Which attestations cover the AI features specifically, not just the platform around them.	A scope matrix: report by product by access route, with audit period and system boundary. Say plainly where an attestation predates the AI feature. Attach the report or a letter describing its scope.
AI-specific audit logging	Whether AI actions are logged with user, time, and action, and who can read the logs.	The event schema, whether content or only metadata is kept, retention, who can read the logs, and the export path. The buyer's own gateway decides much of this, so describe both sides.
Red teaming and independent testing	Whether the AI features were independently tested for misuse, injection, and leakage, and when.	Test date, tester independence, scope (models, prompts, tools, retrieval), the framework used, findings and remediation, and retest after model changes. Attach a summary under NDA.
Bias, accuracy, and evaluation	How the vendor measures errors, hallucination, and drift, and what happens when results degrade.	Named evaluation sets and metrics, results close to the buyer's task, drift triggers, and what the buyer must evaluate on its own data.
Shadow AI discovery and inventory	How unapproved AI use is found, inventoried, and blocked or brought into an approved path.	The discovery signals in use, an approved-tool list with a request workflow, how embedded AI in licensed software is tracked, and the owner and review cadence. Attach the inventory format and the acceptable-use policy.
Human oversight and explainability	Whether people review high-stakes output, can override it, and can challenge a decision.	Which outputs are advisory and which are automated, named reviewers for high-stakes output, how overrides are logged, and the appeal path. Attach the review procedure.

Two of these depend on how the model is reached. Retention answers differ by access route, which Lightbridge explains in its guide to zero data retention from Lightbridge Automation. Logging answers depend on whether the buyer runs a gateway, covered in the LLM gateway explainer. NIST AI 600-1 groups third-party and vendor actions under GOVERN 6.1 and 6.2 and lists GV-6.1-007 for third-party inventory and GV-6.1-009 for procurement due diligence (NIST AI 600-1, published July 2024).

For wording you can adapt, see the questionnaire templates. For the public standards and where to find them, see the questionnaire resources.

AI in the product versus AI as an internal tool: the distinction Lightbridge asks every vendor to make.

One question can mean two things. AI in the product means a customer-facing feature that processes the buyer's data. AI as an internal tool means your own staff using assistants while they deliver a service. Evidence differs. The first needs product documentation, model route, and data handling terms. The second needs an acceptable-use rule, approved tools, and a statement of what client data may be entered.

Lightbridge advises writing both answers, labeling each, and defining the term in the first line of the response. A services firm with no AI product can still owe a full answer on internal use. A software vendor can owe both.

Where shadow AI shows up in questionnaires, as Lightbridge reads them.

In the standard questionnaires we reviewed (HECVAT, AI-CAIQ, WaTech, GovAI), the literal phrase "shadow AI" does not appear. It shows up in practitioner guides and in the K-12 readiness checklist from CoSN, which asks about identifying and blocking non-compliant tools (CoSN checklist v1.3, February 2026). In standard forms the topic usually arrives rephrased: approved applications, acceptable use, unauthorized software. Shared Assessments does not publish SIG question text, so we make no claim there.

Lightbridge treats shadow AI as six related themes: discovery and inventory, acceptable use, default-on features, embedded AI in licensed software, personal accounts and extensions, and evidence. Expect the question in one of those forms. Lightbridge's guide to finding shadow AI covers discovery signals, and the questionnaire templates show how to word the answer.

How Lightbridge helps with AI security questionnaires.

Lightbridge is an independent advisory and program-management firm. We help a CIO or CSO assemble one evidence pack, assign owners to each theme, and run the response process through delivery. Where hands-on work is needed, vetted partners deliver under Lightbridge's program management.

For the policy side of these answers, Lightbridge Automation, a sibling practice, publishes an explainer on the NIST AI RMF and offers consulting on policy and risk programs. If a recommendation points to work a sibling practice would deliver, Lightbridge discloses that upfront and you remain free to take the work elsewhere.

AI security questionnaires: frequently asked questions answered by Lightbridge

Which AI security questionnaire will a buyer send?

It depends on the buyer. EDUCAUSE publishes the HECVAT for higher education, and version 4 added privacy and AI questions. The Cloud Security Alliance publishes the AI-CAIQ with its AI Controls Matrix, intended for self-assessment or third-party vendor evaluation. Shared Assessments sells the SIG, which includes an AI domain. Public agencies publish their own, such as the GovAI Coalition AI FactSheet and the WaTech sample procurement questionnaire. A buyer's security team may also send its own custom form. Lightbridge advises building one evidence pack that serves all of them.

Do we have to answer every question?

Not always. Some questions do not apply to your product, and some forms mark items optional. Lightbridge advises answering every applicable item, marking the rest as not applicable with a one-line reason, and never leaving a question blank. A blank reads as a gap. A reasoned not-applicable reads as a decision.

Can we reuse HECVAT or other questionnaire text in our own templates?

Check the terms first. EDUCAUSE states that it owns the HECVAT copyright and that colleges and vendors may use it for college and university business at no cost, while other parties, including third-party risk platforms, need specific permission and a licence. The GovAI Coalition invites agencies to borrow and adopt its templates but states no formal licence. Lightbridge cites question identifiers and themes and writes its own wording.

Does the answer change if AI is only an internal tool?

Often, yes. Some forms ask whether AI is integrated into the products or services you offer. Others ask how your staff use AI tools while delivering the service. Those are different questions with different evidence. Lightbridge advises answering the product question and the internal-use question separately, and stating which one a given answer covers.

Do standard questionnaires ask about shadow AI?

In the standard questionnaires we reviewed (HECVAT, AI-CAIQ, WaTech, GovAI), the literal phrase does not appear. Practitioner guides and a K-12 readiness checklist do ask about it, and the topic usually arrives rephrased as an approved-applications, acceptable-use, or unauthorized-software control. SIG question text is not public, so we make no claim about it. Lightbridge treats shadow AI as a question to be ready for.

How current are these numbers?

The theme count and the question volume are Lightbridge estimates from public sources, last updated on this page 2026-11-03. Each source carries its own date, shown beside its link. We use the word about on purpose. The assignment of individual questions to themes is a judgment call, and several themes sit within one source of each other.

Answer once, reuse everywhere: talk to a Lightbridge advisor.

Bring the questionnaire you are stuck on. Lightbridge will help you build the evidence pack behind the answers.

Talk to an advisor Questionnaire resources