That email is landing in SME inboxes every week. The old supplier questionnaire, with its SOC 2 report, GDPR clauses and page on uptime, no longer covers what the software is doing.
If a vendor is embedding a model into a product you depend on, your due diligence needs a new section. Here is what to ask, by scenario, before you sign.
The Vendor Who Bolted a Chatbot Onto an Existing Product
This is the most common case and the easiest to under-scrutinize. The product you already use has sprouted a conversational assistant, a “draft with AI” button, or a summarization pane. The vendor calls it a feature. For your risk register it’s a new data flow.
Ask who built the model, who hosts it, and what leaves your tenant when a user clicks the button. If the vendor is routing prompts to a third-party API, that provider is now a subprocessor you inherited without signing anything. A credible software partner, whether an in-house team or an outside software development company, will sketch the request path on a whiteboard without flinching.
Data in the prompt. Which fields from your records are sent to the model, and are customer identifiers stripped before they leave?
Training reuse. Get it in writing that your inputs and outputs are not used to train the vendor’s models or any upstream provider’s.
Opt-out at the tenant level. You want a switch you control, not a support ticket you have to raise.
The Vendor Whose Product Is the Model
Different conversation entirely. Here the software is the AI: a document classifier, a forecasting tool, a voice agent. The questionnaire needs to go deeper than security and into how the thing behaves.
Ask for a model card or equivalent documentation: what it was trained on, what it is and isn’t designed to do, how often it’s retrained, and how changes get communicated to you. An Atlas Systems walkthrough recommends treating a vendor’s inability to explain how its model works as a red flag rather than a technicality. The point isn’t to make the supplier write a thesis. It’s to see whether anyone on their side can answer the question at all.
Push on evaluation too. What accuracy or error rates does the vendor publish, measured against what benchmark, and when were they last reviewed? A headline accuracy number with no definition behind it is marketing, not evidence.
The Vendor Selling You an Agent That Takes Actions
Agentic features are the fastest-moving part of the 2026 vendor pitch. The software doesn’t just suggest. It books, emails, refunds, posts and files. That changes the risk shape entirely, because an agent that is wrong can now do something before anyone sees it.
Blast radius. Which actions can the agent take without human approval, and what is the maximum financial, reputational or data impact of a single bad call?
Human-in-the-loop controls. Can you require a review step for defined categories, such as payments over a threshold, customer messages or record deletions, and is that enforced by the product or by policy?
Audit log. Every agent action, with the prompt and the inputs that produced it, retained long enough to investigate a complaint months later.
Kill switch. A single, documented way to pause the agent across your tenant without taking the whole product down.
You Inherit the Vendor’s Compliance Posture
Buy AI software and you buy a share of the vendor’s regulatory story. When your customers or auditors ask what framework governs the model, “the vendor handles it” is not an answer that holds up. Ask which recognized framework the supplier maps to, and ask to see the mapping.
The NIST AI Risk Management Framework is the common reference point for a reason: it gives both sides a shared vocabulary for governance, measurement and oversight without locking you into one jurisdiction. If you or your customers operate in Europe, you’ll also want to know how the vendor positions itself under the EU AI Act’s provider-versus-deployer split, because some obligations flow to you as the buyer regardless of what the contract says.
Certifications are a starting point, not a finish line. SOC 2 and ISO 27001 cover the plumbing. They say nothing about how the model behaves.
Read the Evidence, Not the Answers
A questionnaire is only as good as what you do with the responses. If a vendor says yes to a control, ask for the artefact: the policy, the log sample, the architecture diagram, the subprocessor list with dates. Senior engineers on either side can tell within ten minutes whether the evidence is real or whether someone pasted the right words into the right boxes.
The point of the new section is not to turn every SME into an AI auditor. It’s to make sure the person on the other end of the sales call can answer the questions a reasonable buyer should be asking in 2026. If they can’t, that is the finding.
