QuestionAI GovernanceVendor RiskInformation Security

How to ask an AI supplier about its own vendor onboarding

23 October 2026

Answered by Rohit Parmar-Mistry

Short answer

You cannot tell from the available evidence whether a particular AI supplier formally reviews its own AI vendors and subcontractors. Ask how it assesses them, who approves them, what data and contract controls apply, and what evidence it can share.

Detailed answer

The available evidence does not establish whether any named supplier has a formal process for onboarding its own AI vendors or subcontractors. Ask the supplier to describe its approach and provide evidence relevant to the service your firm plans to use. Then assess the answers against your intended use, the information involved and any system access.

What to ask the supplier

Ask how the supplier identifies the other organisations involved in delivering its AI service, including subcontractors that may handle your information. The supplier may not be able to disclose every detail, so ask what information it can provide about relevant parties, their roles and any data they receive.

Ask how it assesses those organisations for security, privacy, data use and other third-party risks. Find out who reviews and approves them, and whether the supplier reassesses them when the service or the parties involved change.

For parties that may handle your data, ask what terms govern access, use, retention, sharing and deletion. Ask how the supplier manages the end of a subcontractor relationship, and how it would notify customers about relevant incidents or changes. Where the AI use makes it relevant, ask how responsibilities for monitoring and responding to problems are handled.

Request evidence that fits your use

Ask for material that helps verify the answers, such as a description of the supplier's review process, information about relevant subcontractors, security or privacy documents, and the terms that govern data sharing. Ask what service, data and period each document covers. A document's existence does not by itself establish that a control applies to your proposed use.

Compare the answers with your own intended use. Consider whether the service will receive client or staff information, connect to firm systems, or support work where inaccurate output could matter. If an answer or document leaves a material question unresolved, record the gap and decide whether to seek clarification, narrow the proposed use or defer approval.

Keep a short record of the supplier's answers, evidence reviewed, remaining questions and your decision. Assign someone in the firm to own that decision and revisit it if the use, data access or supplier arrangements change. These are practical due-diligence steps, not a conclusion about UK legal or regulatory duties.

Source and scope

Vanta's vendor-authored guide, published 22 October 2025, includes questions about whether an AI supplier has a formal process for onboarding its own vendors. It also discusses supply-chain mapping, security and privacy review, data use, contractual terms, offboarding and breach reporting. The guide is general due-diligence material, not UK legal or regulatory authority, and does not verify any particular supplier's practices: Vanta, questions to ask AI vendors during a security review.

Discuss a supplier decision

If you are weighing a tool or have questions about client data, book a 30-minute discovery call with Pattrn Data to discuss the decision and possible next steps. The call may conclude that no project is suitable.

Frequently asked questions

Does a supplier have to disclose every subcontractor?

The available source does not establish a universal disclosure requirement. Ask which parties may handle information relevant to your use, what roles they perform and what details the supplier can share. Review the applicable service terms as well.

What if the supplier will not share its review documents?

Ask for a summary of the process, the scope of the review and alternative evidence it can provide. Consider whether the remaining uncertainty matters for your intended use and data. You can seek clarification, limit the use or defer the decision.

Is a security certificate enough to assess the supplier's supply chain?

Not on its own. Check which service, controls and period the certificate covers, then consider whether it addresses the parties and data involved in your proposed use. Ask separately about subcontractors and data-sharing terms where those affect your decision.

Should we ask how the supplier handles changes or incidents?

Yes, as a practical due-diligence question. Ask what notices it provides about relevant service or subcontractor changes and incidents, and how it expects customers to raise concerns. Check the answer against the terms for the service.

Discuss your next step

Talk through your situation with Rohit, or take the assessment if you need a first read.

Book a Discovery Call Take the AI Readiness Assessment

Back to all questions