GLACIS·AI security frameworks·Vendor questionnaire·Updated April 2026

The AI security questionnaire, sentence-by-sentence for 2026.

80+ questions for AI vendor assessment, organized around NIST AI RMF and its Generative AI Profile, MITRE ATLAS, the OWASP Top 10 for LLM Applications 2026, and role-specific legal review under the EU AI Act.

By Joe Braidwood, CEO GLACIS·20 min read·Updated 24 April 2026

Jul 2025
CSA AI Controls Matrix v1.0 — 243 controls, 18 domains
Aug 2025
AICM ↔ ISO/IEC 42001 mapping; AICM ↔ EU AI Act mapping
Status note · reviewed 26 Aug 2026

The primary references cited on this page support using the NIST AI RMF to structure risk questions, the OWASP Top 10 for LLM Applications to surface application-security concerns, and MITRE ATLAS to inform adversarial testing. They are complementary inputs, not evidence that one questionnaire, registry or assurance tier is universally required.

Choose the depth of review according to the vendor’s access, autonomy, data handling and potential impact, and verify any framework version or vendor assurance status directly before relying on it.

Executive summary

Standard security questionnaires remain useful, but consequential AI workflows add questions about model and data provenance, prompt injection, tool permissions, generated output, human review, testing, monitoring, and evidence preservation.

This questionnaire organizes more than 80 questions across eight categories using NIST AI RMF, MITRE ATLAS, the current OWASP Top 10 for LLM Applications, and relevant EU AI Act concepts as distinct inputs. It is a review aid, not a certification or a universally required questionnaire.

Scope
Map the workflow boundary
Data, models, tools, people, and actions
Risk
Prioritize consequence
Access, autonomy, and potential impact
Test
Verify operational behavior
Defined scenarios and expected outcomes
Proof
Inspect the evidence set
Architecture, tests, records, and coverage
Operational review

Use the questionnaire where AI already acts

Bring the buyer’s questions, system boundary, and the evidence you can produce today. We’ll discuss which answers need architecture, testing, contracts, or bounded operational records.

Talk to us
80+ questions 8 categories Scoring rubric
ai-security-questionnaire.xlsx
MS-1 Prompt injection defenses OWASP
DG-1 Training data provenance NIST
SC-1 Model supply chain ATLAS
BF-1 Bias testing methodology EU AI Act
+ 76 more questions...

Why AI-specific questionnaires matter

Traditional security questionnaires like SIG, CAIQ, or custom forms focus on IT infrastructure: network security, access controls, encryption, incident response. These remain essential, but AI systems introduce entirely new risk categories that standard assessments don’t cover.

The evidence gap

A vendor answer can describe a policy without showing how a covered workflow behaved. Ask for a bounded evidence set: architecture and contracts for design, scenario results for effectiveness, and signed operational records plus coverage analysis for selected events.

Standard vs. AI-specific assessment

Traditional Security
AI-Specific Security
Framework
Input validation (SQL injection)
Prompt injection defenses
OWASP #1
Data encryption at rest
Training data governance
ATLAS
Access control policies
Model capability restrictions
NIST
Output sanitization
Hallucination detection
NIST 600-1
Software SBOM
ML-BOM / AI-BOM
CycloneDX
SOC 2 / ISO 27001
EU AI Act / ISO 42001
EU AI Act
Penetration testing
AI red teaming
ATLAS

SOC 2 alone does not answer every AI-workflow question. Scope the review to the model, data, tools, actions, people, and controls that make the use case consequential.

Framework alignment

Use frameworks for different jobs: NIST AI RMF to organize risk management, MITRE ATLAS to inform adversarial scenarios, and OWASP’s current LLM list to surface application-security failure paths. None establishes compliance or control effectiveness by itself.

SCOPE

Procurement baseline

Keep the existing security and privacy review, then add questions for models, training and retrieval data, tools, actions, human review, testing, and evidence.

Workflow-specific review
ATLAS

MITRE ATLAS

Adversarial Threat Landscape for AI Systems. Knowledge base of tactics and techniques from real-world attacks and AI red teams.[5]

MITRE Corporation
OWASP

OWASP LLM Top 10

The August 2026 list covers ten application risks, with Prompt Injection at LLM01 and Excessive Agency at LLM03.[6]

OWASP Foundation
NIST

NIST AI RMF + 600-1

AI Risk Management Framework with Generative AI Profile. 72 subcategories across GOVERN, MAP, MEASURE, MANAGE functions.[7]

US Government

Framework boundary

A framework can organize questions, but the answer still needs evidence matched to its claim: architecture for design, tests for scenario behavior, contracts for allocation, and operational records plus coverage analysis for selected events.

Question categories

The GLACIS AI Security Questionnaire covers eight categories, each mapped to the relevant frameworks:

MS

Model Security

Prompt injection, jailbreaking, output filtering, adversarial robustness

OWASP ATLAS
DG

Data Governance

Training data, customer data handling, retention, PII/PHI protection

NIST EU AI Act
CR

Compliance & Regulatory

EU AI Act, NIST AI RMF, ISO 42001, industry-specific requirements

EU AI Act NIST
SC

Supply Chain

Model provenance, ML-BOM, third-party dependencies, attestations

ATLAS OWASP
BF

Bias & Fairness

Bias testing, discrimination audits, fairness metrics, documentation

EU AI Act NYC LL144
TR

Transparency

Model cards, system documentation, disclosure requirements

EU AI Act NIST GOVERN
OS

Operational Security

Monitoring, incident response, human oversight, model updates

NIST SIG
RT

Red Teaming

Adversarial testing, vulnerability assessment, remediation tracking

ATLAS EU AI Act

Model security questions

These questions assess defenses against attacks targeting the AI model itself, aligned with OWASP LLM Top 10 and MITRE ATLAS.

MS

Model Security

10 questions • OWASP LLM Top 10 • MITRE ATLAS

MS-1: What defenses are in place against prompt injection attacks? Describe both direct and indirect injection protections.

OWASP LLM01 Evidence: Input validation docs, filtering rules

MS-2: How are jailbreaking attempts detected and prevented? What testing has been performed against known jailbreak techniques?

ATLAS AML.T0054 Evidence: Red team report, jailbreak test results

MS-3: What output filtering is applied before responses are returned to users? Are outputs scanned for harmful content, PII, and policy violations?

OWASP LLM02 Evidence: Output filter config, content policy

MS-4: How is the system prompt protected from extraction? What evidence demonstrates its effectiveness?

ATLAS AML.T0051 Evidence: Extraction tests, prompt protection config

MS-5: What controls prevent the model from taking unauthorized actions (tools, APIs, system access)? How are capabilities restricted?

OWASP LLM08 Evidence: Tool access policies, capability matrix

MS-6: How is the model protected against adversarial inputs designed to cause incorrect outputs (adversarial examples)?

ATLAS AML.T0015 Evidence: Robustness testing results

MS-7: What rate limiting, abuse prevention, and anomaly detection measures are implemented?

NIST MANAGE Evidence: Rate limit config, abuse detection rules

MS-8: Has the system undergone AI red teaming? Provide summary findings and remediation status.

EU AI Act Art. 55 Evidence: Red team report, remediation log

MS-9: How are multi-turn attacks and conversation manipulation detected and prevented?

ATLAS Evidence: Multi-turn tests, conversation monitoring

MS-10: What safeguards prevent the model from generating hallucinated or fabricated information?

NIST 600-1 Evidence: Grounding mechanisms, citation requirements

Data governance questions

These questions assess how data is handled throughout the AI lifecycle, from training to inference.

DG

Data Governance

9 questions • NIST AI RMF • EU AI Act

DG-1: What data is used for training/fine-tuning? Is any customer data used? Provide complete data provenance documentation.

NIST MAP 1.5 Evidence: Training data catalog, provenance records

DG-2: How is customer data isolated from other customers (multi-tenancy controls)? What prevents cross-tenant data leakage?

OWASP LLM06 Evidence: Isolation architecture, tenant separation tests

DG-3: What is the data retention policy for user prompts and model outputs? How is deletion enforced?

EU AI Act Art. 12 Evidence: Retention policy, deletion procedures

DG-4: Can customers opt out of data being used for training? How is this enforced and audited?

GDPR Art. 21 Evidence: Opt-out mechanism, compliance audit

DG-5: What PII/PHI detection is performed on inputs and outputs? What redaction or masking is applied?

OWASP LLM06 Evidence: PII detection rules, masking config

DG-6: How is training data provenance documented? Is the origin of all training data known and verified?

ATLAS AML.T0019 Evidence: Data provenance records, source verification

DG-7: What controls prevent training data poisoning attacks?

ATLAS AML.T0020 Evidence: Data validation pipeline, poisoning detection

DG-8: For healthcare: Is there a BAA available? What PHI protections are in place?

HIPAA Evidence: BAA, PHI handling procedures

DG-9: What controls exist to prevent the model from memorizing and reproducing training data (extraction attacks)?

ATLAS AML.T0024 Evidence: Memorization tests, extraction prevention

Supply chain & provenance questions

Supply-chain review should cover model provenance, training and fine-tuning data, libraries, registries, plugins, model-context tools, subprocessors, and update paths. Ask which dependencies can change behavior or reach consequential data and actions.

SC

Supply Chain

7 questions • OWASP LLM Top 10 • MITRE ATLAS

SC-1: What is the provenance of the AI model(s) used? Are they custom-trained, fine-tuned, or third-party?

OWASP LLM05 Evidence: Model provenance docs, vendor contracts

SC-2: Is an ML-BOM (Machine Learning Bill of Materials) maintained? Does it include datasets, models, and code dependencies?

CycloneDX Evidence: ML-BOM artifact, component inventory

SC-3: How are third-party AI models validated before use? What security testing is performed?

ATLAS AML.T0011 Evidence: Model validation reports, security scans

SC-4: What controls protect against backdoored or trojanized models?

ATLAS AML.T0010 Evidence: Trojan detection scans, integrity checks

SC-5: Are cryptographic attestations used to verify model and data integrity (SLSA, Sigstore)?

SLSA Evidence: Attestation records, signature verification

SC-6: How are model updates verified and tested before deployment?

NIST GOVERN Evidence: Update verification procedures, test reports

SC-7: What visibility exists into Nth-party dependencies (your vendor’s vendors)?

OWASP LLM05 Evidence: Dependency map, sub-processor agreements

Bias and fairness questions

NYC Local Law 144 requires an annual bias audit before using a covered automated employment decision tool, along with public-summary and notice requirements. Applicability and enforcement consequences depend on the facts; this questionnaire is not legal advice.[10]

BF

Bias & Fairness

EU AI Act • NYC LL144

BF-1: Has the system undergone independent bias testing? Provide audit results for protected characteristics (gender, race, age, disability).

NYC LL144 Evidence: Bias audit report, impact ratio calculations

BF-2: What fairness metrics are used (demographic parity, equalized odds, individual fairness)? How are thresholds determined?

EU AI Act Evidence: Fairness metric definitions, threshold documentation

BF-3: How is training data evaluated for representativeness and potential bias amplification?

NIST MEASURE Evidence: Training data analysis, demographic breakdown

BF-4: What bias mitigation techniques are applied (pre-processing, in-processing, post-processing)?

NIST MAP Evidence: Mitigation technique documentation

BF-5: Is bias monitoring continuous? How often are bias metrics recalculated in production?

EU AI Act Evidence: Monitoring dashboard, recalculation schedule

BF-6: What tools are used for bias detection (IBM AI Fairness 360, Microsoft Fairlearn, Aequitas)?

Best Practice Evidence: Tool configuration, detection methodology

BF-7: How are bias incidents reported, investigated, and remediated?

NIST MANAGE Evidence: Incident response procedures, remediation log

Transparency and model cards

Transparency duties vary by role, system, audience, and jurisdiction. EU AI Act Article 50 includes disclosure and labeling duties for specified systems and content; determine applicability for the actual deployment rather than treating every model card or public report as universally required.

TR

Transparency

EU AI Act • NIST AI RMF

TR-1: Is a model card available? Does it include intended uses, limitations, training data summary, and evaluation results?

EU AI Act Ann. IV Evidence: Model card, system documentation

TR-2: Is documentation available in machine-readable format (JSON) for programmatic analysis?

Best Practice Evidence: JSON schema, API documentation

TR-3: Are users notified when they are interacting with an AI system (disclosure requirements)?

EU AI Act Art. 50 Evidence: User notification implementation, UI screenshots

TR-4: Is safety evaluation documentation publicly available? What testing methodology is described?

Risk-based review Evidence: Safety evaluation report, testing methodology

TR-5: How is documentation updated when the model is substantially revised?

EU AI Act Evidence: Version control, update procedures

TR-6: What information is disclosed about model capabilities, limitations, and known failure modes?

NIST MAP 3.4 Evidence: Capability documentation, limitation disclosures

Compliance and regulatory questions

These questions help surface potential regulatory and standards dependencies. Applicability varies by jurisdiction, role, sector, data, and use case; verify the current primary text and obtain legal advice for the deployment.

CR

Compliance & Regulatory

EU AI Act • NIST

CR-1: How is the system classified under the EU AI Act? What compliance measures are in place for that risk tier?

EU AI Act Art. 6 Evidence: Risk classification, conformity assessment

CR-2: Is the organization aligned with NIST AI RMF? Describe implementation status across all four functions.

NIST AI RMF Evidence: Function implementation matrix, gap analysis

CR-3: Is the organization ISO 42001 certified or pursuing certification?

ISO 42001 Evidence: Certificate or certification timeline

CR-4: If Colorado SB 26-189 applies, how will the organization support required notices, disclosures, correction, human review, and records from January 1, 2027?

Colorado SB 26-189 Evidence: workflow notices, disclosures, review records, and current legal mapping

CR-5: What documentation is maintained for regulatory compliance (risk assessments, impact assessments, conformity assessments)?

EU AI Act Ann. IV Evidence: Compliance documentation package

CR-6: Are there any pending regulatory actions or findings related to AI systems?

Due Diligence Evidence: Regulatory status attestation

CR-7: What industry-specific AI regulations apply (healthcare, financial services, employment)?

FINRA • HIPAA Evidence: Industry-specific compliance documentation

CR-8: How are regulatory changes monitored and incorporated into the system?

NIST GOVERN Evidence: Regulatory monitoring procedures

Operational security questions

These questions assess ongoing security operations and human oversight.

OS

Operational Security

NIST • SIG

OS-1: What monitoring is in place for AI system behavior? What metrics are tracked and alerted on?

NIST MEASURE Evidence: Monitoring dashboard, alerting rules

OS-2: How are AI-related security incidents detected, triaged, and responded to? Is there an AI-specific incident response plan?

NIST MANAGE Evidence: Incident response plan, runbooks

OS-3: What human oversight exists for AI decisions? When is human review required?

EU AI Act Art. 14 Evidence: Human oversight procedures, escalation matrix

OS-4: How is model drift monitored? What triggers model review or retraining?

NIST MEASURE Evidence: Drift monitoring config, retraining triggers

OS-5: What audit logging is maintained? How long are logs retained? Are they tamper-evident?

EU AI Act Art. 12 Evidence: Logging configuration, retention policy

OS-6: Can customers access logs of AI interactions with their data?

Best Practice Evidence: Customer log access mechanism

OS-7: What is the process for reporting AI safety concerns (internal and external)?

NIST GOVERN Evidence: Reporting procedures, whistleblower protections

OS-8: How are AI model updates tested before deployment? What rollback capabilities exist?

NIST MANAGE Evidence: Deployment procedures, rollback tests

Scoring and evaluation

The following rubric is illustrative, not a generally applicable acceptance standard. Buyers should define question relevance, evidence expectations, decision rights, thresholds, and treatment of compensating controls for the specific workflow, risk appetite, contract, and applicable obligations.

Score Criteria Evidence Required Illustrative interpretation
4 Comprehensive controls with continuous monitoring Documented, tested, audited Potentially sufficient for the buyer’s defined scope
3 Controls in place, some evidence gaps Documented, partially tested Buyer-defined conditions or monitoring may be appropriate
2 Some controls, significant gaps Partial documentation Assess buyer-specific remediation or compensating controls
1 Few controls, major gaps Minimal or no evidence Escalate under the buyer’s risk process
0 No controls or evidence None Buyer decision required; do not infer automatic rejection

Category weights

These percentages are examples only, not defaults or prescribed weights. A buyer should set or omit weights based on the workflow, material risks, mandatory requirements, evidence quality, and its own decision process:

Model Security OWASP, ATLAS
20%
Data Governance NIST, EU AI Act
15%
Supply Chain OWASP LLM05
15%
Bias & Fairness NYC LL144, EU AI Act
15%
Compliance EU AI Act, NIST
15%
Transparency EU AI Act Art. 50
10%
Operations NIST MANAGE
10%

Red Flags

Watch for vendors who claim “we use [major provider] so we inherit their security” without demonstrating application-layer controls. LLM security requires layered defenses. Also flag vendors who can’t answer basic questions about prompt injection or training data governance.

GLACIS·Vendor evidence

Make vendor responses verifiable, not aspirational.

The questionnaire above maps to OWASP, AICM, NIST AI 600-1 and the EU AI Act. Glacis can add scoped records, mappings, and gaps for one configured workflow; timing and reviewer acceptance depend on the engagement.

See Glacis in action    Talk to us

References

Sources & Citations

Primary frameworks and public-authority references

[5] MITRE Corporation. “MITRE ATLAS: Adversarial Threat Landscape for AI Systems.” 2024.
[6] OWASP Foundation. “OWASP Top 10 for LLM Applications 2026.” August 2026.
[7] NIST. “AI Risk Management Framework (AI RMF 1.0).” January 2023.
[10] NYC Department of Consumer and Worker Protection. “Local Law 144.” 2023.

Disclaimer: Framework versions and legal requirements can change. Verify the current primary source and the facts of the deployment before relying on an answer. This guide is for informational purposes only and does not constitute legal advice or certification.

Related guides