Twelve questions to ask before you buy an AI tool
What to ask any AI supplier about your data, security and exit, and what a good answer sounds like.
Choosing an AI product is partly a security decision. Before you sign or enter any business data, a few direct questions will tell you a lot about how a supplier works.
About your data
- Where is our data processed and stored, and in which countries?
- Is our data used to train your models? A good answer is a clear “no” by default, written into the contract.
- How long do you keep prompts and outputs, and can we delete them?
- Which sub-processors do you use, and how will you tell us about changes?
About security and control
- What independent assurance do you hold, such as ISO 27001 or SOC 2 reports, or Cyber Essentials?
- How do access control and single sign-on work?
- What logs and audit trails do we get?
- How do you test for prompt injection and misuse?
About the relationship
- Do you offer a UK GDPR data processing agreement before we sign?
- What happens to our data if we leave, and can we export it?
- How quickly will you tell us about a security incident?
- What are your limits, uptime commitments and notice of model changes?
Red flags
Vague answers about training on your data, no contract available before purchase, no named data location, or a free consumer tool being used for business data. If a supplier cannot answer clearly, that is useful information too.
Our free guide, AI Security for Business, includes this checklist along with what a good answer looks like.