Nine questions to ask any AI vendor about security

Owners are being sold AI systems every week: a receptionist that never sleeps, a follow up engine for quotes, a booking agent. Most of the pitches talk about what the system does. Almost none talk about what happens when it goes wrong, who can get into it, or what it does with your customers' information. Those are the questions that decide whether a system is an asset or a liability, and you do not need a technical background to ask them.

Here are nine. Each one maps to a control Millwright applies to every system it builds, so you can hold us to the same standard.

1. What can the system access, and under what identity?

A good answer names the specific systems the AI can reach (your calendar, your phone line, your customer list) and says that each automation runs under its own identity with only the access it needs. A bad answer is "it integrates with everything" or an admin login shared across the vendor's clients. Ask where the passwords and keys are kept. If the answer is "in the prompt" or "in the code," walk away.

2. What needs a person's approval before it happens?

Some actions should never run on their own: sending money, signing anything, deleting records, changing what the system is allowed to do. Ask which actions require a human to approve them, and what happens if nobody does. The right answer is that an unapproved action expires. The wrong answer is that it goes ahead by default.

3. How was it tested before it reached customers?

AI systems can be talked into things. A caller can try to make the agent reveal another customer's details, ignore its instructions, or take an action it should not. Ask whether the vendor tests for this before launch, and against what. The OWASP Top 10 lists for language model and agentic applications are the published baseline; a vendor who has never heard of them has not tested for it.

4. How do I turn it off?

Not "how do I cancel." How do I stop it, right now, if it is saying the wrong thing to my customers. There should be a stop switch you or the vendor can hit at once, and it should be tested on a schedule, not discovered in an emergency.

5. Whose data is it, and is it used to train anything?

Your call records, your customer names, your quotes. Ask three things: is the data isolated from the vendor's other clients, is it ever used to train a model, and do you get it back when you leave. The answers should be yes, no, and yes, in writing.

6. Which rules apply to this system, and who checked?

A system that calls or texts your customers is covered by consent rules under federal law. A system that handles payments has card data rules. Some states now require that people be told they are dealing with AI. Ask the vendor which rules apply to your deployment and whether a lawyer reviewed the design. "We are compliant" is not an answer. "Here is what applies, and here is what we did about it" is.

7. What records does it keep of what it did?

When a customer says the system promised them something, you need to know what was said. Ask whether every action is logged, whether the log says which identity took the action, and whether you can read it. A vendor who cannot show you a decision record cannot tell you what their system did on your behalf.

8. What do I get each month?

A live system is not finished. Ask what ongoing checks the vendor runs (access reviews, security checks, failure rates) and what you receive: a report, a summary of open risks, a list of things that need your decision. If the answer is "you will hear from us if something breaks," the vendor is not maintaining the system; you are.

9. Will my customers know it is AI?

This one is simple. The agent should say it is an AI assistant at the start of every interaction, whether or not a law requires it where you operate. A vendor who treats disclosure as optional is making a decision about your customers' trust on your behalf.

What a good vendor sounds like

A vendor who has thought about security answers these quickly and specifically, and is comfortable putting the answers in the contract. A vendor who has not will reach for words like "enterprise grade" and "bank level" and move the conversation back to features. The difference is not the size of the company. It is whether anyone asked these questions before you did.

Millwright's answers to all nine are on the security page.