Questions to ask a new supplier, sized to what they'll actually have access to

A standard supplier questionnaire has sixty questions. The cleaner who needs a key doesn't need to answer all of them, and the cloud service that will hold your customers' records needs more than sixty.

Size the questions to what they'll touch. That's the one thing to give the AI before it writes anything.

We're thinking of buying [WHAT] from [TYPE OF SUPPLIER].
They will: [e.g. store our staff records, have a login to our systems,
visit our sites, only invoice us].
They'll have access to: [DATA OR PLACES, OR "NOTHING SENSITIVE"].
The contract would be worth about [£ PER YEAR].
Write a due diligence question list proportionate to that risk.
- Group by: company and finances, security and data, insurance,
  continuity (what happens if they fail), and exit (how we get our data
  and our people out).
- Mark each question MUST HAVE or NICE TO HAVE.
- For every MUST HAVE, say what evidence to ask for (a certificate, a
  policy, a named document), not just a yes or no.
- Leave out anything that doesn't fit what they'll have access to.

Ask for evidence, not assurances. "Do you have a security certification?" gets a yes. "Send the certificate and say which services and sites it covers" gets an answer you can check. A certified data centre isn't the same as a certified product running in it, and a good supplier won't mind the question.

Read the exit questions twice. Contracts are often easier to start than to leave, so ask before you sign, not when you want out.

The AI can't check any of the answers. Look at the certificates yourself, and for anything that touches personal data, involve whoever handles data protection in your organisation. This list is a starting point for them, not a replacement.