A vendor questionnaire built for AI procurement.
Four guided steps produce a tailored due-diligence questionnaire: data handling, evaluation, security, incident response, regulatory posture. Each question tagged with the framework it maps to.
Four steps · Up to 40 curated questions · Reviewer-ready Markdown
Eight modules · 39 curated questions
- 01Data handling6
- 02Model & training5
- 03Evaluation & safety6
- 04Security5
- 05IP & licensing4
- 06Incident response4
- 07Exit & portability4
- 08Regulatory posture5
Who's the questionnaire for?
Header information that appears at the top of the generated document so the vendor knows what they're responding to and by when.
Common questions
What the tool does, how it maps to AI procurement practice, and where its boundaries are.
Who is this questionnaire for?
Procurement, governance, and security teams evaluating a third-party AI vendor. The output is a Markdown document you send to the vendor; their answers feed your assessment. Use it as the starting point. Trim, expand, and adapt before sending.
How is this different from a generic vendor security questionnaire?
AI vendors carry risks a SIG or CAIQ doesn't cover well: training-data licensing, model versioning, hallucination controls, prompt-injection defences, AI Act readiness. This tool ships modules for those specifically, so you're not bolting AI questions onto an SOC 2-shaped form.
Which frameworks does it map to?
Each question tags the regulatory references it supports: EU AI Act (especially Article 14 human oversight, Article 73 incident reporting, Annex IV §2(c) training data), GDPR (Articles 28, 33, 35), NIST AI RMF (Govern, Map, Measure, Manage), and ISO/IEC 42001. Selecting an emphasis framework in Step 4 marks matching questions with a ★ so the vendor answers the regulatory-critical items first.
Does the tool send anything anywhere?
No. Everything runs in your browser: your inputs stay in component state, the Markdown is generated locally, nothing is transmitted or logged server-side.
What does the export contain?
A Markdown document with: engagement context (vendor / product / contact / deadline), system profile (purpose / criticality / data sensitivity / deployment model), response instructions, your selected modules with their questions (each tagged Required or Recommended + framework references), and a sign-off section.
How does this connect to AIGP exam preparation?
The IAPP AIGP exam covers AI procurement and vendor management as part of Domain F: implementing responsible AI governance. Working through this questionnaire mirrors the kind of vendor-risk reasoning the exam tests, and Startege's full AIGP track maps procurement patterns to flashcards and practice scenarios.