How do I answer “list every AI sub-processor”?

By AI vendor, and under each the companies that vendor publishes, with the address and the date you read it. Our sub-processor questionnaire guide walks through that one question in full.

How long is that list?

The median vendor list we've read names 21 companies and the largest names 121, so five vendors is about 105 entries before overlap. Of 1,680 distinct company names across 128 lists, 1,362 are on only one vendor's list.

Can I say we do not train on customer data?

Only about yourself. That sentence is your vendor's promise unless it's in your own contract, and unless the model provider underneath them has committed the same thing. Say whose promise it is.

Is it enough to link to the vendor's trust page?

No. A link shows the page as it is today, and the question is what it said when you relied on it. Attach a dated copy of the page, with the date you read it.

What do I say about being notified of vendor changes?

The honest answer. A change shows up as an edit to the vendor's page, and some vendors also email subscribers; we quote a notice clause with a stated window for 81 vendors. Describe how you spot a change, and how often.

Free guide · Security questionnaires

A customer sent a security questionnaire. How do you answer the AI questions?

Enterprise customers now ask about the AI vendors in your product. These are eight questions their security teams ask.

For each one: a good answer, what to attach, and where to stop.

The first question

“List every AI sub-processor.”

It reads like a one-line request. A sub-processor is a company your vendor hands your data to, and each vendor has its own list.

~105

entries for five AI vendors, before overlap.

companies on the median vendor's list. The largest names 121.

1,362

of 1,680 distinct company names across 128 lists are on only one vendor's list.

So a second AI vendor mostly adds a second list. Lead with how the list is organized, not with the number. A reviewer who can see the structure will accept the length. How to answer this one question, step by step.

The eight questions.

One word past what you can show turns a good answer into a liability. So each one says where to stop.

01
List every AI sub-processor that may process our data.
A good answer
Your AI vendors by name, and under each the companies that vendor publishes on its own list, with the URL and the date you read it. Say which of your products each vendor is used in.
Attach
Your sub-processor register, exported, with a source and read date per row.
Where to stop
You are listing what each vendor publishes, not certifying it is complete. Say so in one sentence: a vendor's published list is the whole of what is disclosed to you.
128 of the 186 vendors we watch publish something we could read on this.
02
Do you use AI to process our data, and which models?
A good answer
The vendors and the model families, per product feature. Name the provider underneath where the vendor discloses one — a company using a model API has two suppliers in that answer, not one.
Attach
The vendor's model documentation, and the page where they name their inference provider.
Where to stop
Where a vendor does not disclose which model it runs, say so. Don't name the one you assume, because then the claim is yours.
No vendor page answers this. It's about your own processing.
03
Is our data used to train models?
A good answer
Quote your vendor's commitment, with its URL and read date, and say whether it covers the model provider underneath them as well as themselves.
Attach
The quoted clause from the vendor's page, or the contractual term where you negotiated one.
Where to stop
“We do not train on customer data” is your vendor's promise unless you have it in your own contract. State whose promise it is.
34 of the 186 vendors we watch publish something we could read on this.
04
Where is our data processed, and can it leave the region?
A good answer
A commitment to a region where the vendor makes one, and a transfer disclosure where that is all they make. The two look alike and mean opposite things.
Attach
The quoted residency clause, and the transfer mechanism named in the DPA.
Where to stop
A page saying data may be transferred with safeguards has not promised a region. Do not report a disclosure as a commitment.
62 of the 186 vendors we watch publish something we could read on this.
05
How long is our data retained after termination?
A good answer
The period per category, because a vendor can have several retention windows: one for your data, another for logs or backups.
Attach
The quoted retention clause, per category, with its source.
Where to stop
Where the vendor states one period for personal data and another for backups, give both. Give one number and you'll get a follow-up question.
36 of the 186 vendors we watch publish something we could read on this.
06
What certifications do your AI vendors hold?
A good answer
What each vendor states, at the level they state it, with the date you read the page. SOC 2 and SOC 2 Type II are different attestations and a reviewer will know.
Attach
The trust page URL and read date; the report itself under NDA where you hold it.
Where to stop
You are reporting what a vendor says it holds, not that it holds it. Say "the vendor states", or you have given a warranty you didn't mean to.
119 of the 186 vendors we watch publish something we could read on this.
07
How are you notified when an AI vendor changes something?
A good answer
The honest mechanic: a change shows up as an edit to the vendor's page, and some vendors also email the addresses that subscribed. Say how you detect it (re-reading on a schedule) and how often.
Attach
Your watch schedule, and the dated readings that show it running.
Where to stop
Don't describe a notification you don't receive. A reviewer who learns that “we are notified” meant “we check the page” will doubt the rest of your answers.
81 of the 186 vendors we watch publish something we could read on this.
08
What happens if a model you depend on is retired?
A good answer
The notice period in your agreement where you have one, the vendor's published deprecation practice where you do not, and your fallback.
Attach
The retirement announcements you have on file for that vendor, with dates.
Where to stop
Some vendors email active users about a retirement; whether you get it depends on your account. If your answer assumes an email, say who has committed to sending it.
37 of the 186 vendors we watch publish something we could read on this.

Five answers that cost you.

“Yes.”
A one-word answer to a supply chain question looks like you didn't read it. It brings a follow-up, and a less patient reviewer.
“Our vendors are SOC 2 compliant.”
SOC 2 is not a compliance standard a company is or is not, and the reviewer asking knows that. Name the vendor, the report type and the period.
“We do not train on your data.”
True of you, but the question is about your vendors too. Unless they have committed the same thing in writing, you've promised something you can't see.
“We are notified of any changes.”
Unless you subscribed to every vendor's notices, what you have is the page. Reviewers check this one, and it costs the most when it's wrong.
A link to the vendor's page.
A link shows the page as it is today. The question is what it said when you relied on it, and only a dated copy of the page answers that.

Take the answers with you.

A Word file with all eight questions, where to stop on each, and the numbers as they stand the day you open it.

Common questions.

How do I answer “list every AI sub-processor”?: By AI vendor, and under each the companies that vendor publishes, with the address and the date you read it. Our sub-processor questionnaire guide walks through that one question in full.
How long is that list?: The median vendor list we've read names 21 companies and the largest names 121, so five vendors is about 105 entries before overlap. Of 1,680 distinct company names across 128 lists, 1,362 are on only one vendor's list.
Can I say we do not train on customer data?: Only about yourself. That sentence is your vendor's promise unless it's in your own contract, and unless the model provider underneath them has committed the same thing. Say whose promise it is.
Is it enough to link to the vendor's trust page?: No. A link shows the page as it is today, and the question is what it said when you relied on it. Attach a dated copy of the page, with the date you read it.
What do I say about being notified of vendor changes?: The honest answer. A change shows up as an edit to the vendor's page, and some vendors also email subscribers; we quote a notice clause with a stated window for 81 vendors. Describe how you spot a change, and how often.

Answer a questionnaire

More for this job.

See every resource

This isn’t legal advice, and the answers are a starting point, not wording anyone has approved for your situation. The figures count published pages, read on the dates we hold. Naming a vendor records what its page said and implies nothing else. A vendor publishing nothing we could read is counted as neither publishing nor refusing. Corrections are free to request.

A customer sent a security questionnaire. How do you answer the AI questions?

“List every AI sub-processor.”

The eight questions.

List every AI sub-processor that may process our data.

Do you use AI to process our data, and which models?

Is our data used to train models?

Where is our data processed, and can it leave the region?

How long is our data retained after termination?

What certifications do your AI vendors hold?

How are you notified when an AI vendor changes something?

What happens if a model you depend on is retired?

Five answers that cost you.

Take the answers with you.

Common questions.

More for this job.