What should we ask any AI vendor before we send it documents?

A vendor that runs AI on your documents ends up holding more than the files you sent: the text it pulled from each page, the drafts it wrote, your reviewer's corrections and a log of every request. Each carries the same details as the original, so each belongs in your questions.

In May 2025 the NSA's AI Security Center, CISA, the FBI and partner agencies in Australia, New Zealand and the UK published a joint sheet on securing the data used to train and operate AI systems. One of its ten practices: an AI system's output should generally be classified at the same level as its input. A draft built from a customer's PO deserves the care the PO gets.

Handing over files doesn't hand over the risk. NIST's control catalog, SP 800-53, opens its control for outside services, SA-9, by requiring providers to meet the customer's own security and privacy requirements, and its discussion keeps responsibility for that risk on the customer's side.

Start with places. SP 800-53 gives location its own enhancement, SA-9(5), because when a provider chooses where processing and storage happen, the laws there can get in the way of investigating an incident. Ask for an answer per copy: uploads, extracted text, drafts, logs and backups don't always sit together. The joint sheet calls for encryption at rest, in transit and during processing, so ask whether that covers every copy.

Then people. Where European data protection law applies, a processor's contract must require everyone authorized to handle the personal data to have committed to confidentiality or to be under a legal duty of it. The habit works anywhere. Ask by role:

• Staff who can open a file. Which roles, approved by whom, and whether each opening is logged in a record you could ask to see.
• People who check the AI's output. Some services route samples of drafts to people who grade or label them. Ask whether yours would, and whether they are employees or contractors.
• Support. What an engineer can see when you report a problem, and whether you must allow it first.

Buyers ask this first, so take the answer from a contract, not a marketing page. In January 2024 the FTC's technology office wrote that companies hosting models for others have a continuous appetite for data to build new models or refine existing ones, and must keep their commitments to customers, including those made in promotional materials and terms of service. A month later FTC staff warned that moving to looser data practices through a quiet, retroactive change to the terms or privacy policy may be unfair or deceptive. An answer lasts only as long as the document it sits in.

Ask it in parts, because one line saying a vendor doesn't train on customer data can promise less than it sounds:

• Which material. The files, extracted text, drafts, your reviewer's corrections and the logs, each named.
• Which models. The vendor's own, the model provider's behind it, and any model tuned for all of the vendor's customers. Adjusting your own setup from your corrections is different from adding them to a shared model.
• Changes. How you will be told before the terms change, and whether a change can reach files already sent.

Few AI vendors run every piece themselves. Hosting, the model, storage and support tools often come from other companies, and any of them may touch your files. The usual name, subprocessors, comes from European data protection law, which bars a processor from bringing in another without the customer's prior written authorization, specific or general, and under a general one requires notice of any planned addition or replacement so the customer can object.

NIST's supplier review control, SR-6, counts a supplier's ability to assess its own second-tier and third-tier suppliers as part of judging it. Ask for the list that covers the service you would use: each company, what it does with your files and where. Then ask how much notice you get before one is added, and whether the vendor's contract with each carries the limits it promises you.

The same European rule has a processor delete or return personal data when the service ends, as the customer chooses, and delete existing copies unless a law requires keeping them. The joint sheet names secure methods for drives that held AI data (cryptographic erase, block erase or overwriting) and points to NIST's media sanitization guide, SP 800-88. NIST's control MP-6 sets the bar: information removed so it can't be retrieved or reconstructed, whether it sat on a workstation, in a copier's memory or on paper.

On notice, Florida's breach law gives a company contracted to maintain, store or process personal information for another business no more than 10 days, once it determines a breach happened or has reason to believe one did, to tell that business; European law asks a processor to tell its customer without undue delay. Both reach personal information only. A price list or a customer's drawing may fall outside every breach statute, so for those the contract sets the only deadline. NIST's SR-8 puts the same ground into supplier agreements: notice of a compromise, and the results of assessments or audits.

• Can we ask for deletion at any time, and does it also happen on its own at a set point after the work ends?
• Does it reach extracted text, drafts, logs, backups and every subprocessor's copy, and will we get written confirmation?
• How many hours or days after discovery will you tell us of an incident, including one at a subprocessor, and what will the notice say?

A SOC 2 report is a CPA's examination of a service organization's description of its system and its controls relevant to security, availability, processing integrity, confidentiality or privacy, and the AICPA notes that customers often ask for one. A SOC 3 covers the same subjects in less detail, which is why the AICPA calls it a general-use report that can be freely distributed; a SOC 2 is not, so expect to request it. Today's criteria date from 2017, with points of focus revised in 2022, and in October 2026 the AICPA put proposed 2027 criteria out for comment.

Read a SOC 2 for its edges: which of the five subjects it covers; whether it looks at control design on one date or tests whether controls worked across months, and which dates; which services, locations and outside companies are inside the system it describes and which are carved out; what exceptions the auditor found; and which controls it expects the customer to run.

ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection: Information security management systems: Requirements, sets requirements for establishing, running and continually improving an information security management system, including how the organization assesses and treats its security risks, and an organization claiming conformity may not leave out any requirement in clauses 4 to 10. A certificate shows such a system runs; ask for its scope to learn which products and offices it covers.

Neither says whether your files train a model or how long drafts are kept, and neither tests the AI's drafts against your documents. Missing a report is not a no on its own, and holding one is not a yes.

An answer carries the weight of where it is written. A sales call carries none, a help page can change next month, and a signed agreement holds until both sides change it. The discussion under SA-9 calls service-level agreements the place where expectations are set, outcomes made measurable and remedies named.

That goes for us too. We offer a free AI proof of concept on one job: copies of 20 to 30 documents your team already finished, sent only after an NDA, with no login to your systems and nothing posted anywhere, judged by your reviewer, the person on your team who knows the job best. That describes the test, not the answers to the seven questions, so ask them of us in writing too. None of this is legal advice; what your contracts and the laws that reach your files require is for your counsel.

• Send one list to every vendor, in the same order, so the answers line up side by side.
• Ask for signed answers, in the agreement, a data processing addendum or a questionnaire attached to the NDA.
• Keep the version: dated copies of the terms, privacy policy and subprocessor list as they stood when you agreed.
• Ask again after a change: a new model provider, a new subprocessor, new terms or a renewal.