AI security · Buyer’s guide · Reviewed 6 October 2026
Seven questions to ask anyone selling you AI services
Before you connect AI to your customer records, inbox or business systems, ask for evidence of the controls that protect them.
Start with your dataAsk the question. Inspect the evidence. Agree the limits. A supplier’s answer should describe the service you are buying, including the surrounding application, integrations and people responsible for it.
These questions apply to us as well as any other supplier. They are our practical synthesis of the sources below, rather than an official seven-question standard. They focus on generative AI assistants and agents; other AI systems need questions suited to their design.
All seven scenarios and amounts below are fictional worked examples. They show possible consequences and transparent arithmetic, not measured incidents, forecasts or the probability of a failure. The amounts are separate examples and must not be added together.
What happens to our data?
An AI service can copy information into model requests, document indexes, logs and backups. A privacy promise needs to cover that whole route.
If the control is missing
A sales assistant reveals one customer's negotiated prices to another. The team must establish what was exposed, restrict access and notify the right people.
Fictional worked example
£1,440 of response work
3 people × 8 hours × £60 per hour. Illustrative staff-time value only; excludes compensation, external advice and lost business.
Evidence to request and answers to challenge
Ask to see
A data-flow map; named model providers and other processors; access and retention settings; contractual terms for training use; and access-control design and tests showing restricted records remain inaccessible across representative users and roles, with coverage and limitations documented.
Challenge this answer
“It is private because it runs in the cloud, runs locally, or has an instruction telling the model not to disclose anything.”
Research basis: OWASP · Sensitive information disclosure. Scenario and arithmetic are our illustrative examples.
Can an email or document trick the AI into breaking the rules?
A model may treat instructions inside material it reads as commands. This is called prompt injection. It can redirect a workflow even when the original user asked for something harmless.
If the control is missing
A supplier invoice contains instructions that cause an accounts assistant to propose altered payment details. A £10,000 payment is released without a separate, trusted verification step.
Fictional worked example
£10,000 payment exposed
One fictional £10,000 transfer. This is gross exposure if the transfer occurs, before any recovery; it is not an observed incident or a probability estimate.
Evidence to request and answers to challenge
Ask to see
Tests using untrusted emails, documents and web content; controls separating that content from instructions; restricted tools; and a clear account of what the tests failed to prevent.
Challenge this answer
“Our system prompt says to ignore malicious instructions, so the problem is solved.”
Research basis: OWASP · Prompt injection. Scenario and arithmetic are our illustrative examples.
What can the AI do without a person approving it?
Drafting a reply and sending it have different consequences. Reading customer records and changing them need different permissions.
If the control is missing
A support agent issues 20 unauthorised refunds before anyone notices. The AI had permission to issue refunds when it only needed to prepare recommendations.
Fictional worked example
£3,000 refunded without approval
20 refunds × £150. Fictional gross payments before recovery, plus any investigation or reconciliation work.
Evidence to request and answers to challenge
Ask to see
A list of permitted tools and actions; minimum access for each user; approval enforced in the connected system for high-impact actions; transaction limits; and a demonstration that an unapproved action is refused.
Challenge this answer
“We give the agent administrator access so it can get everything done. A human can watch the dashboard.”
Research basis: OWASP · Excessive agency. Scenario and arithmetic are our illustrative examples.
What have you tested for our use case—and what failed?
A polished demonstration shows one successful path. Buyers also need evidence about difficult inputs, denied access, unsafe actions and unsupported answers.
If the control is missing
An assistant produces 100 customer quotes using an outdated discount policy. Staff must check and rebuild them. An incorrect output is an assurance failure; it is not automatically a cyber breach.
Fictional worked example
£1,000 of checking and rework
100 quotes × 15 minutes ÷ 60 × £40 per hour. Illustrative staff-time value; excludes any discounts already promised or lost margin.
Evidence to request and answers to challenge
Ask to see
Dated results for the actual model, application and configuration; representative and adverse cases; a failure log; agreed acceptance rules; and retests showing that important fixes work. Ask what any independent review actually covered.
Challenge this answer
“The model scores well on a leaderboard, our demo worked, or the provider has a security certificate.”
Research basis: NCSC · Secure deployment. Scenario and arithmetic are our illustrative examples.
How will we spot a problem and stop it?
A system needs useful records of its activity, alerts someone owns and a way to remove its access. An alert after hundreds of actions may arrive too late.
If the control is missing
Unexpected agent activity forces a customer-service workflow offline for four hours. Twenty employees cannot carry out their usual work during the outage.
Fictional worked example
£3,200 of unavailable staff time
20 people × 4 hours × £40 per hour. Illustrative economic value of unavailable time, not necessarily an extra cash payment or lost revenue.
Evidence to request and answers to challenge
Ask to see
An example audit trail with sensitive content protected; alerts and a named responder; tested rate and spending limits; a demonstrated way to suspend actions or revoke access; and an incident exercise.
Challenge this answer
“The model normally behaves, or someone will look at its conversations if a customer complains.”
Research basis: NCSC · Secure operation and maintenance. Scenario and arithmetic are our illustrative examples.
Who keeps it secure when the model or its suppliers change?
A tested service can change when a model, document index, integration or dependency changes. The supplier needs a controlled update process and a way back to the last working release.
If the control is missing
An untested model update changes tool behaviour. Two engineers spend a day isolating the problem, restoring the previous release and checking access controls again.
Fictional worked example
£960 of engineering work
2 engineers × 8 hours × £60 per hour. Illustrative effort; excludes downtime, specialist support and supplier charges.
Evidence to request and answers to challenge
Ask to see
A current component and provider inventory; named maintenance owners; patch and change-notification arrangements; tests before material updates; and a demonstrated rollback process.
Challenge this answer
“We always use the latest model, so it will keep improving automatically.”
Research basis: NCSC · Secure development. Scenario and arithmetic are our illustrative examples.
Who is responsible when something goes wrong—and can we recover or leave?
The application supplier, model provider and your own team may each own different controls. Those responsibilities need to be settled before real data and systems are connected.
If the control is missing
An integration damages 1,000 CRM records. The restore has never been tested, the contract leaves recovery ownership unclear and staff rebuild the records manually.
Fictional worked example
£2,000 of manual reconstruction
1,000 records × 3 minutes ÷ 60 × £40 per hour. Fictional rebuilding effort; it assumes reconstruction is possible and excludes missing history or lost business.
Evidence to request and answers to challenge
Ask to see
Named owners for security and incident response; written notification and support commitments; an agreed allocation of responsibilities and liability; a tested backup restore; and a usable export and exit process with clear data-handling terms.
Challenge this answer
“The model provider handles all security, or we will work out responsibility if an incident happens.”
Research basis: UK Government · AI Playbook, Buying AI. Scenario and arithmetic are our illustrative examples.
Put a value on the disruption
Small gaps can create real work.
The immediate cost may be a payment, recovery work, service downtime or lost staff capacity. Lost business, legal advice and damage to trust can add costs that these examples do not quantify.
For UK businesses reporting a cyber breach or attack with an outcome such as lost assets or data, the 2025/2026 government survey recorded a £560 median perceived cost and £15,000 at the 95th percentile for their most disruptive incident. This subgroup included 169 businesses.
Across all 952 businesses providing costs after identifying an attack or breach, including incidents without such an outcome, the median was £0. These are recalled, self-reported costs, not AI-specific losses or a forecast for your company. Inspect the survey and definitions.
Why we do not use one headline breach cost
The UK survey stopped publishing mean costs because the distribution is highly skewed and subject to high sampling error. IBM’s separate 2026 study reported a US$4.99 million average across 602 breached organisations globally, covering March 2025–February 2026. Ponemon conducted that study; IBM sponsored and analysed it. The populations and methods differ, so the figures cannot be treated as comparable forecasts or as average AI-service losses. Inspect IBM’s study announcement.
What would downtime mean for your team?
Adjust the assumptions to value staff time unavailable during an outage.
20 people × 4 hours × £40 per hour
Illustrative economic value, not automatically extra cash spending or lost revenue. Avoid counting the same time again in other losses. Inputs stay in this page and are not saved or transmitted.
Make a defensible decision
When is it reasonable to proceed?
Proceed to a bounded pilot
The supplier has supplied relevant evidence; responsibilities and limits are agreed; important gaps have been addressed; and your security, business and procurement owners accept the remaining risk. Use limited access and agreed success, stop and recovery conditions.
Pause access to live systems
Data handling is unclear, high-impact actions lack enforced controls, material failures remain unexplained, or nobody can demonstrate how to stop and recover the service. Give the supplier specific gaps to resolve before granting that access.
Seven satisfactory answers support a decision; they do not certify a system or guarantee safety. A pilot is not approval for unrestricted production use. Sensitive data and high-impact decisions need a fuller review appropriate to their consequences. NCSC guidance on bounded adoption and accountability.
Research and scope
Follow the evidence.
Primary guidance and cost evidence inspected on 6 October 2026. The framework, supplier questions and fictional business examples are original editorial material. Source guidance supports the risks and controls; it does not validate these examples or demonstrate our delivery capability.
- OWASP · Sensitive information disclosure
- OWASP · Prompt injection
- OWASP · Excessive agency
- NCSC · Secure deployment
- NCSC · Secure operation and maintenance
- NCSC · Secure development
- UK Government · AI Playbook, Buying AI
- NCSC · Thinking carefully before adopting agentic AI15 May 2026 · Boundaries, accountability, monitoring and controlled pilots.
- UK Government · Cyber Security Breaches Survey 2025/202630 April 2026 · Tables 4.1a and 4.1b; reported costs for one most disruptive incident.
- IBM · 2026 Cost of a Data Breach study announcement29 July 2026 · Separate global sample; not a UK SME or AI-service cost forecast.
A provider’s certification or model access does not establish the security of your particular deployment. This guide offers supplier due-diligence questions; it is not a security certification or legal advice.