Private AI for vendor risk assessment

A vendor risk assessment lists every third party with access to your systems or data, what each one can reach, and where your controls around them are weakest. That's exactly the kind of document you don't want to hand to another unvetted third party just to get help drafting it, which is what happens by default if the drafting tool is a public AI chat service.

What this work actually involves

Security and procurement teams write vendor questionnaires for two audiences: vendors filling them out, and internal reviewers reading the responses. Both directions are drafting-heavy. A new vendor questionnaire needs to be tailored to what the vendor actually does (a payment processor gets different questions than a marketing analytics tool), and a completed questionnaire needs to be read against an internal risk checklist to flag gaps, contradictions, or answers that don't match what the vendor's own documentation says elsewhere. Doing this by hand for every vendor in a company's stack is slow, which is exactly why teams reach for an AI assistant to speed it up.

The risk decision itself, whether a given vendor's answers are good enough to proceed, should stay with a person who understands the company's actual risk tolerance. What a model helps with is getting from a blank questionnaire to a complete draft, and from a completed questionnaire to a structured summary of what to look at closely.

Why the vendor list itself is sensitive

The list of vendors a company relies on, and what each one can access, is close to a map of where a breach would start. Adding "and here's where I think our own controls are weak" (which is the point of a risk assessment) turns that list into a document that would meaningfully help an attacker planning a supply-chain compromise. Pasting that into a cloud AI tool's chat window means it's now sitting in a third party's infrastructure and chat history, a fact that gets more uncomfortable the more you think about what that document is actually for.

There's also a specific version of this problem worth naming directly: assessing whether to trust a cloud AI vendor is itself a common reason to write a vendor risk assessment. Running that evaluation through a different cloud AI vendor's public tool means describing the first vendor's weaknesses to a second, equally unvetted party, which defeats a good part of the point. For background on the compliance angle specifically, our post on the EU AI Act and self-hosted LLMs covers where regulatory obligations intersect with vendor and processor choices, and this piece on shadow AI covers the broader pattern of internal teams routing sensitive work through unsanctioned tools.

How to set this up privately

A general-purpose model with retrieval over your existing risk framework (past assessments, your standard questionnaire template, internal policy docs) can draft a tailored questionnaire for a new vendor and summarize a completed one against your criteria, using the same retrieval-augmented pattern described in our guide to on-premise RAG for internal documents. Nothing about this task requires a specialized model; a mid-sized open-weight model handles structured document generation and summarization well, and the value is in keeping the vendor list and the risk findings off any infrastructure outside the company's own.

This is typically a low-volume, bursty workload, active during vendor onboarding or an annual review cycle, idle otherwise, which makes on-demand pricing a natural fit. A single-GPU Spark node at $0.79/hour covers this comfortably, and for teams that also want the same private model available for related internal work, our private LLM hosting page covers running one node across multiple use cases rather than standing up separate infrastructure for each.

FAQ