A security questionnaire for AI vendors
A security review of an AI vendor needs questions that generic IT questionnaires miss: where prompts and retrieved documents go, whether retrieval respects user permissions, how prompt injection is tested, and what the audit trail records. Thirty questions, grouped by the risk each one covers.