5 AI questions for your suppliers
Your suppliers use AI in the work they do for you — the ones you know about and the ones you don't. The difference is between using it with a method and using it in the dark, and five questions tell the two apart in five minutes.
Who this is for: whoever hires suppliers — procurement, legal, IT, or the owner. Time: five minutes to add it; the supplier's answer takes less than that. Free to use: copy, adapt, paste it into your own form. No permission needed, no credit required.
A supplier who uses AI well delivers faster, with fewer errors and for less money. That is good. The one who uses it with a method knows what may go into which tool, has the team aligned, and can answer you. The one who uses it in the dark depends on luck — and the information you handed over is still your responsibility after it leaves your company.
The five questions below fit any vendor-approval process and require no certification at all — they require the supplier to be able to answer.
1. Do you use artificial intelligence tools in the service you provide us? Which ones?
Why it matters: this is the question that reveals whether control exists. Whoever cannot list them is not controlling them.
| Answer | What it tells you |
|---|---|
| ✅ | names the tools one by one, and the list has a review date |
| ⚠️ | "I think some people use them" — there is use, there is no map |
| ⛔ | "we don't use AI", said without checking — in 2026 that almost always means "I didn't ask" |
2. Does the information we send you go into any of those tools? On a company or a personal account?
Why it matters: this is the one that most separates a governed supplier from an ungoverned one. A personal account means your data sits in a service the supplier does not administer, cannot audit, and cannot revoke when someone leaves their team.
| Answer | What it tells you |
|---|---|
| ✅ | company accounts, on plans that do not use the content to train models |
| ⚠️ | company accounts, but nobody knows what the contracted plan says |
| ⛔ | personal accounts, or "I don't know" |
3. Is there a written rule about this, and does the team know about it?
Why it matters: a rule agreed verbally does not survive staff turnover, and holds up nothing if there is an incident.
| Answer | What it tells you |
|---|---|
| ✅ | there is a written policy and a record that the team was told |
| ⚠️ | there is a policy, nobody can say when it was communicated |
| ⛔ | "everyone knows what they can and can't do" |
4. Who is the person responsible for this inside your company?
Why it matters: responsibility assigned to a department is nobody's responsibility. You need a name to call — and the existence of that name is the best sign the subject was taken seriously.
| Answer | What it tells you |
|---|---|
| ✅ | a name, and that person knows they are the one |
| ⚠️ | "IT takes care of that" |
| ⛔ | nobody can say |
5. If there is an incident involving our data in an AI tool, how long until you tell us?
Why it matters: it is the only one of the five that deals with the bad day. And it reveals whether the supplier has thought about it or is improvising in front of you.
| Answer | What it tells you |
|---|---|
| ✅ | a stated deadline, and a defined channel to warn you |
| ⚠️ | "we'd tell you right away", with nothing written down |
| ⛔ | they have never thought about it |
Two more, if the supplier is critical
Use these when they handle your customers' personal data, financial information or trade secrets:
6. When someone leaves your team, is their access to AI tools holding our information cut off the same day?
7. Can you tell us, if we ask, what was processed by AI under our contract in the last 90 days?
To copy and paste into your form
1. Do you use artificial intelligence tools in the service you provide us? Which ones?
2. Does the information we send you go into any of those tools? On a company or a
personal account?
3. Is there a written rule about this, and does the team know about it?
4. Who is the person responsible for this inside your company?
5. If there is an incident involving our data in an AI tool, how long until you tell us?
If the supplier is critical:
6. When someone leaves your team, is their access to tools holding our information cut
off the same day?
7. Can you tell us, if we ask, what was processed by AI under our contract in the last
90 days?
What to do with the answers
Do not terminate a contract over this. A supplier who answers badly is not a dishonest supplier — it is most companies today, and switching probably brings the same problem without the relationship history. In practice they usually want to sort this out and don't know where to start.
What works:
- Ask for a plan with a date, not a promise. Sixty or ninety days for questions 2, 3 and 4 is realistic.
- Put the answers in the contract at the next renewal — what they stated becomes a commitment.
- Ask again once a year. The list of tools ages fast: what was true in January may not be in July, because software you already pay for switches on an AI feature in an update.
And the most important part: whoever answers the five well deserves preference, and it is worth telling them so. An organised supplier makes fewer mistakes, delivers faster and gives you less work — the question is not about distrust, it is about quality. That is how the practice spreads down the chain: not by demand, by advantage.
Free to use, no catch
This piece is free to use, commercially included: copy it, adapt it, paste it into your procurement form, send it to whoever you like, print it, translate it. No permission needed, no credit required, and no sign-up to download it. If it travels without our name on it, fine — what matters is the practice, not the paper.
If your supplier cannot answer these questions, they probably want to know where to start — and that is what the AI Governance Protocol is for.