Suppliers
Questions to ask your AI suppliers about data
Most organisations use AI through a supplier, so a supplier's weakness becomes yours. The NCSC tells leaders to understand their supply chains and ask the right questions.
Last reviewed against legislation.gov.uk, National Cyber Security Centre and OWASP GenAI Security Project. Sources
Why it matters
Your data, their systems
The NCSC says leaders should understand their data, model and machine learning software supply chains, and that developers of AI models and systems should take responsibility for the security outcomes their customers rely on, because customers usually lack the expertise to address AI-specific risks [3]. The ChatGPT incident began in an open-source library the service depended on [7].
The questions
Group them by topic
Storage and retention
Where is our data stored, for how long, and can we delete it? Samsung's memo described data on external AI servers as hard to retrieve or delete [8].
Training use
Is our data used to train models, and can we opt out? OWASP lists the ability to opt out of training as good practice [4].
Access
Who at the supplier can read our prompts and outputs, and how is access controlled and logged?
Incident notification
How and how fast will you tell us about an incident? UK GDPR's 72 hour clock runs from the controller's awareness [1], so late notice from a supplier shortens your window.
Secure development
Do you follow recognised guidance? The NCSC's guidelines, developed with CISA and agencies from other countries, cover secure design, development, deployment and operation [2].
Contract points
What to look for
Check these as well:
- Whether the supplier acts as your processor for personal data
- Notification terms for incidents and sub-processor changes
- Deletion on request and at the end of the contract
- Whether your data is used for training by default
- Where the data is processed
Next
Put it into practice
Send the questions to each AI supplier and file the answers with your incident plan. Use what to do this week to track the rest.
Keep reading
Read next
Data protection
What the ICO's AI and data protection guidance says about impact assessments, transparency and lawfulness, and how it links to breach duties.
Read the guide
AI use policy
How to write a short AI use policy that stops sensitive data going into AI tools, using OWASP, NCSC and IBM findings as the basis.
Read the guide
Questions
Sourced answers on what counts as an AI data breach, the 72 hour reporting rule, shadow AI, exposed databases and what UK organisations should do.
Read the guideHow CyPro can help
Need a hand working through this?
Finding out whether an incident reaches you is one job. Checking your own systems, tightening access and briefing the board are several more. CyPro's responders and consultants can take any of them on.
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Talk to a specialist
Worried this affects you?
If data has leaked through an AI tool or an exposed AI database, the first hours decide how much is lost and what you must report. An incident response team helps you contain it, work out what was exposed and meet your notification duties.