What should we ask vendors about AI and quantum readiness?
CyberRank Research
Add two short blocks to your vendor questionnaire. For AI, ask where the vendor uses AI, which AI Act risk level it believes applies, whose model it relies on and what evidence it holds. For quantum, ask for its cryptographic inventory and its dates for post-quantum key exchange and certificates. CyberRank (Beta) checks vendors' AI use and quantum-crypto exposure from outside.
TL;DR
- AI questions find new risk levels and legal duties that arrive through vendors' products, often without a new contract.
- Quantum questions find vendors whose key exchange could expose long-life data to harvest-now-decrypt-later.
- Send both blocks by tier: critical services, AI in decisions about people, or data that must stay secret beyond 2030.
- CyberRank checks the outside-in evidence for both (Beta), so you can test what vendors tell you.
The answer, piece by piece
| Part of the question | Short answer | Read more | How CyberRank helps |
|---|---|---|---|
| Why ask about AI | Short answerEach AI feature can add a risk level, data flows and legal duties | Read morethe EU AI Act and your vendors | How CyberRank helpsDetects AI use from public evidence and gives a candidate level (Beta) |
| Why ask about quantum | Short answerClassical-only key exchange exposes long-life data to later decryption | Read morequantum security and post-quantum cryptography | How CyberRank helpsFlags classical-only key exchange and quantum-vulnerable certificates (Beta) |
| Who gets the questions | Short answerTier vendors by impact and data first, then scale the questionnaire | Read morethird-party risk management guide | How CyberRank helpsCombines your impact tier with breach likelihood in a heat map |
Which four AI questions should you ask?
Ask for full high-risk evidence only where your use is a high-risk candidate. Why each answer matters is explained in detail in our article about the AI Act as a third-party risk.
- Where do you use AI in the service you provide to us, including features added since the contract?
- Which AI Act risk level do you believe applies, and are you the provider or a deployer?
- Does your AI rely on a general-purpose model from another provider, and which one?
- What evidence can you share: instructions for use, conformity information, logging, human oversight measures and ISO/IEC 42001 certification in your own name?
Which four quantum questions should you ask?
Measure the answers against NIST's lines: quantum-vulnerable algorithms deprecated after 2030 and disallowed after 2035. The dates and the order of work are explained in detail in our guide to post-quantum deadlines for vendors.
- Which of your public services already use hybrid or post-quantum key exchange, such as ML-KEM?
- Do you have a cryptographic inventory covering TLS, SSH, VPN and code signing?
- By when will you move key exchange, and then certificate signatures, to post-quantum algorithms?
- Which of your own suppliers carry our data, and what cryptography do they use?
Which vendors should get these questions?
Not every vendor. Tier vendors first by what stops if they fail and what data they hold. Then send the AI and quantum blocks to Critical and High vendors, and to any vendor with AI in decisions about people or data that must stay confidential beyond 2030. Tiering before assessment is explained in detail in our guide to the TPRM lifecycle.
How CyberRank checks the answers
CyberRank compares answers with what it can observe. Its AI-use signal (Beta) records AI use from public evidence and reports governance checks only when evidence exists. Its quantum-crypto check (Beta) gives each vendor's public TLS and SSH services a posture. Where an answer and the evidence disagree, ask the vendor before you accept the answer.
Where CyberRank does not help
CyberRank cannot see AI or cryptography that leaves no public trace: internal models, training data, databases, backups or a code-signing pipeline. It does not classify AI legally, certify a vendor as quantum-safe or confirm a migration plan. Those answers come from the vendor, your contract and your legal team.
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating