A few years ago the security questionnaire your customer sent you asked about passwords, backups and office access. Today it often has a new section: do you use artificial intelligence, which tools, with which data, and who is responsible when something goes wrong. If you sell to larger companies, or to regulated ones, you will meet this section sooner or later.
For a small company this can feel like an exam. It does not have to be. This article is about the seller's side: how to answer honestly, quickly and without making promises you cannot keep. It is not legal advice, and it does not tell you what any specific customer or regulation requires.
What customers are really asking
Behind the long list of questions there are usually four worries.
- Where does our data go? Does it leave your systems, which provider receives it, and is it used to train someone else's model?
- Who is accountable? Is there a named person who approves AI use, and a person who reviews what the AI produces before it reaches us?
- What can go wrong, and what do you do then? Wrong output, a leak, an outage at the vendor.
- Can you prove it? Policies, logs and contracts, not just assurances.
If your answers address these four worries directly, you will answer most questionnaires correctly even when the wording is unusual.
Prepare once, answer many times
The slowest way to handle questionnaires is to start from zero each time. The fastest is to keep one internal page, a page of facts that every answer is built from. It should contain:
- A list of AI tools in use. Name, vendor, purpose, and whether it is used for customer work or only internally. Include the quiet ones, such as the assistant built into your office suite. If staff use tools nobody approved, shadow AI is the first thing to fix, because you cannot describe what you do not know.
- What data each tool can see. Customer data, personal data, internal documents, or none. This is the answer to most "where does our data go" questions. Our article on data handling and retention for AI agents shows how to write it down.
- Vendor terms that matter. Whether the vendor trains on your inputs, how long it keeps them, where it processes them, and what the contract says about incidents. Keep a link to the actual terms you agreed, not a memory of them.
- An owner and a reviewer. One person who approves new tools, and a description of the human check on anything that reaches a customer. The approval and audit trail article describes a simple version.
- An incident plan. Who can stop a tool, who informs the customer, and how fast. A short kill-switch and response plan is enough.
This page takes an afternoon to write. After that, a questionnaire becomes a matter of copying facts into the customer's format.
How to answer well
Answer the question that was asked. If the question is whether customer data is sent to a third-party AI provider, the answer begins with yes or no. Explanations come after. Questionnaires are often read by people who check boxes first and prose later.
Be specific. "We use AI responsibly" tells the reader nothing. "We use one AI drafting tool for internal summaries; customer files are not uploaded to it; the vendor does not train on our inputs under our agreement; the Operations Manager approves any new tool" can be checked, and it sounds like a company that knows what it is doing.
Say "not applicable" or "not yet" when that is true. If you have no formal AI policy yet, say so and say what you do have: a short rule, a list, a date by which the policy will exist. Customers generally accept an honest gap with a plan. They react badly to a claim that later turns out to be false, because it makes them doubt every other answer.
Do not claim what you cannot show. If a question asks whether you are certified to a standard such as ISO/IEC 42001, and you are not, the answer is no. You can add that you follow some of its practices, if that is true. The same applies to alignment with frameworks: saying you "use the NIST AI Risk Management Framework as a reference" is different from saying you are compliant with it. Be careful with words such as compliant, certified, audited and guaranteed.
Do not describe a vendor's controls as your own. If the AI provider has a security certification, say that the provider holds it and link to its evidence. The certification does not automatically cover how you configure and use the tool.
Name the limits. An answer such as "the tool drafts replies; a person reads each one before it is sent" is better than "the AI is fully secure". It shows you understand that the risk is managed by process, not by a slogan.
A short example
Imagine a question: "Do you use AI systems to process our data? If so, describe safeguards."
A weak answer: "Yes, we use industry-leading AI with enterprise-grade security."
A stronger answer: "Yes, in one case. We use a third-party assistant to draft summaries of support tickets. Ticket text can include customer names and contact details. Under our agreement the provider does not use our inputs to train its models and deletes them after 30 days. Access is limited to the support team, and a team member reviews every summary before it is stored. We can provide the vendor terms on request."
The second answer is longer, but the reader needs no follow-up call. Only include details like retention periods if they come from your actual contract.
Keep the process boring
Questionnaires return, often yearly, and from many customers. A few habits prevent trouble.
- One owner. One person collects questionnaires, writes answers from the internal page and asks the right colleague when facts are missing.
- A log of answers. Save what you told each customer and when. If a tool changes, you can see which customers were told something that is no longer true and update them.
- Update the page when tools change. Adding a new AI tool should include a line on the page. If it does not, the next questionnaire will be answered from an out-of-date picture.
- Ask for the customer's own wording of requirements. If a customer attaches an AI clause to the contract, have it reviewed by someone qualified before you agree to it.
- Escalate unusual requests. Demands for on-site audits, specific liability terms or guarantees about model behaviour are business and legal decisions, not form-filling.
When the questionnaire shows a gap
Sometimes, while answering, you discover that you cannot say who approved a tool, or that a vendor's retention period is unknown. That is a useful finding. Do not hide it in the answer; fix it, or write the honest answer and a date. A questionnaire is one of the cheapest audits you will ever get, and it is free.
If you want to see where AI is used in your company before the next questionnaire arrives, the AI audit is a practical starting point.
Conclusion
Customers ask about your AI use because they want to know whether they can trust you with their data. You do not need a large compliance department to answer. You need a short, accurate internal page, an owner, plain answers to the questions that were asked, and the discipline not to claim more than you can show. Do that, and the questionnaire stops being a threat and becomes a chance to look like the careful company you are.
