Answer the AI section of a customer’s questionnaire from records you already keep.
A customer's vendor questionnaire now asks whether you have an AI policy, an inventory, a way to know what staff use. If you run GhostAudit, the answers are already in your workspace. Upload the spreadsheet, and each AI question is drafted from your own records with the record cited. Where your records say nothing, the answer says so.
Example workspace. A questionnaire in review, with a fictional customer and illustrative answers.
Do you maintain an inventory of the AI systems and tools in use?
Yes. Northwind maintains an inventory of AI systems in GhostAudit: 14 systems (12 active) from 9 vendors. Each entry records the vendor, purpose, risk tier, data sensitivity, owner and the controls in place.
AI system inventory · 14 systems, 12 activeFrom your records, by rulesApprovedDo you capture or store the content of prompts employees submit to AI tools?
No. AI usage monitoring records metadata only (tool, time, duration). The content of prompts, responses and pages is not captured, stored or inspected centrally.
AI usage monitoring · metadata onlyFrom your records, by rulesApprovedDoes your incident response plan cover AI incidents?
Partial. An AI incident response plan exists (AI Incident Response Plan v1) and is in review, not yet approved.
AI Incident Response Plan v1 · in review, not yet approvedFrom your records, by rulesDraftedIs customer data used to train or improve AI models?
No evidence in GhostAudit — needs your input
GhostAudit does not record contract terms. State, per AI vendor, whether customer data is used to train or improve models and where that is agreed.
Needs inputAre you certified to ISO/IEC 42001?
No evidence in GhostAudit — needs your input
GhostAudit records self-assessments, not certifications. State your certification status.
Needs input
Answers come from rules applied to your records. Every answer is a draft until a person approves it.
- Input
- XLSX, CSV or pasted questions
- Built-in library
- 66 common AI questions
- Every answer
- A draft until a person approves it
- Plans
- Govern and Enterprise
Start from the file the customer sent.
Questionnaires arrive as spreadsheets, each laid out differently. Upload the .xlsx or .csv file as it is, or paste the questions one per line.
GhostAudit reads the sheet, finds the column that holds the questions and shows you its choice before anything is drafted. If it picked the wrong column, or the workbook has several sheets, you choose. The other columns are kept, so the export can go back to the customer in their own layout.
Files are treated as untrusted input. Formulas are never evaluated, macro-enabled and password-protected workbooks are rejected, and an archive is checked before it is opened.
- Excel and CSV files up to 5 MB, or pasted text
- Up to 500 questions per questionnaire
- The question column is suggested, and you confirm it
An example upload. The column check appears before any answer is drafted.
We picked the column that reads most like questions. Check it before answers are drafted.
- RefAI-010 of 16 cells read like questions
- QuestionSuggestedDoes your organization have a documented policy governing the use of AI and generative AI?15 of 16 cells read like questions
- ResponseNo text in this column0 of 0 cells read like questions
Each answer is built from your records, and names the record.
Drafting is done by a built-in rule engine. It recognises 66 questions that vendor questionnaires commonly ask about AI governance, matching on the subject of a question and not its exact wording, and answers each one from what your workspace holds:
- the AI inventory: how many systems, from which vendors, with which risk tiers, owners and controls;
- documents and their state: a policy that was approved on a date reads differently from one still in review, and the answer says which it is;
- assessments: which frameworks you have assessed against, and what the responses to specific controls were;
- monitoring and policy settings: whether sensors are deployed, the identity mode, which tools are sanctioned or blocked, whether sensitive-data warnings are on;
- the regulation tracker, connected discovery sources, single sign-on and log export.
A closed question gets a yes, no or partial first, then one or two sentences of fact, then the citation: the inventory, a named document and its version, a named assessment. A reviewer at your customer can ask for exactly that item.
The same records always produce the same answer. You can draft an answer again after your records change.
The topics the built-in library covers. The wording of the questions is our own.
| Topic | Questions | |
|---|---|---|
| Policy, accountability and trainingDo you have a documented policy governing the use of AI? | Do you have a documented policy governing the use of AI? | 7 |
| Inventory and scopeDo you maintain an inventory of the AI systems and tools in use? | Do you maintain an inventory of the AI systems and tools in use? | 6 |
| Risk, frameworks and regulationDo you perform risk assessments of AI systems? | Do you perform risk assessments of AI systems? | 14 |
| Monitoring and acceptable useHow do you detect unapproved (shadow) AI use? | How do you detect unapproved (shadow) AI use? | 8 |
| Data protection and legalIs customer data used to train or improve AI models? | Is customer data used to train or improve AI models? | 10 |
| Third partiesDo you assess AI vendors before use? | Do you assess AI vendors before use? | 4 |
| Oversight and assuranceIs there human oversight of AI outputs and decisions? | Is there human oversight of AI outputs and decisions? | 6 |
| Security, operations and incidentsDoes your incident response plan cover AI incidents? | Does your incident response plan cover AI incidents? | 11 |
Where there is no evidence, the answer is “needs your input”.
The fastest way to lose a customer's trust is a confident yes that falls apart at the first follow-up. So the rules never state a control your records do not show.
When your workspace cannot support an answer, the question is marked “No evidence in GhostAudit — needs your input”, with a note on what to supply. That happens in three situations:
- The record is missing. You are asked about an incident response plan and none is on file. The note says to generate or upload one.
- GhostAudit cannot know. Contract terms with your AI vendors, certifications you hold, your incident history. These always ask for your input and are never guessed.
- The question is outside the library. A question about business continuity or encryption at rest is not an AI governance question, and GhostAudit does not pretend to answer it.
You write those answers yourself. Our guide to answering AI questions in security questionnaires covers what a credible one looks like, including when the truthful answer is “not yet”.
Example workspace. Names and figures are illustrative.
Is customer data used to train or improve AI models?
No evidence in GhostAudit — needs your input
GhostAudit does not record contract terms. State, per AI vendor, whether customer data is used to train or improve models and where that is agreed.
Needs inputAre you certified to ISO/IEC 42001?
No evidence in GhostAudit — needs your input
GhostAudit records self-assessments, not certifications. State your certification status.
Needs inputDescribe your business continuity arrangements for the customer support desk.
No evidence in GhostAudit — needs your input
This question is not in the built-in library and no approved answer covers it.
Needs input
Approve, reuse, export.
Nothing leaves GhostAudit as final without a person. Each answer can be edited, drafted again or approved; an admin, owner or compliance manager approves, one answer at a time or all drafted answers together. Approvals are written to the audit log.
An approved answer is saved to your answer library. When a later questionnaire asks a closely matching question, the draft comes from the answer you already approved, labelled as such. That includes the answers you wrote by hand, so the questions GhostAudit could not answer the first time are answered the second time.
Export when you are done: an Excel or CSV file with the customer's original columns and the answers beside them, or a Word document of questions and answers. Evidence and confidence columns are optional, for when you want the answers without your internal references. Unapproved answers are marked as drafts in the export.
- Members draft and edit; admins, owners and compliance managers approve
- Approved answers are reused for similar questions
- Export to Excel, CSV or Word
Example workspace. Names and figures are illustrative.
- Do you maintain an inventory of the AI systems and tools in use?Approved 4 weeks ago · reused 3 times
- Do you monitor employee use of AI tools?Approved 4 weeks ago · reused 2 times
- Is customer data used to train or improve AI models?Approved 12 days ago · reused 1 time
- Excel (.xlsx)Original columns plus answers
- Word (.docx)Questions and answers
- CSVOriginal columns plus answers
Optional, and not enabled on the hosted service today.
Everything above works without a language model, and that is how it runs on the hosted GhostAudit service today. No language-model provider is among our subprocessors, and none will be used before it is listed there with notice.
The product does contain an optional AI drafting mode, which a self-hosted customer can switch on by configuring their own Anthropic API key. With it, a model drafts the answers the rules cannot, from the same records, and each draft is labelled “Drafted by AI from your records — review before sending”. If you are evaluating that mode, these are its limits:
- What can be sent: your questionnaire's questions and a fixed list of governance records: organization profile, inventory and vendors, assessments, document titles and headings, tracked regulations, and which controls are switched on.
- What is never sent: usage events and totals, employees, devices, licence seat lists, discovery evidence about who authorised an app, console users and the audit log. Email addresses and people's names are removed from the text that is sent. GhostAudit holds no prompt or page content, so there is none to send.
- What is checked: a model answer whose citations do not resolve to a real record is discarded and the question is marked as needing your input. Nothing is approved automatically.
- Who controls it: the deployment decides whether a key exists; within it, an owner or admin can turn AI assistance off for the workspace.
What it is not.
It is not a general questionnaire tool. The library covers AI governance. The rest of a security questionnaire, such as network security, encryption or business continuity, is yours to answer; once you have approved an answer it is reused, but GhostAudit does not draft it.
It is only as current as your records. An answer that cites a policy approved last year is true about last year. Keeping the inventory, documents and assessments current is what keeps the answers true.
It is not a certification or a legal opinion. The answers describe what your organization has recorded. When a question asks whether you are certified to ISO/IEC 42001, the product asks you; it does not infer a certificate from a self-assessment.
Questionnaire details
- Input
- Excel (.xlsx) and CSV files up to 5 MB, or questions pasted one per line. Up to 500 questions per questionnaire. Older .xls files, macro-enabled and password-protected workbooks are not accepted.
- Question detection
- The sheet and column that read most like questions are suggested; you confirm or change them before drafting.
- Drafting order
- Your answer library first, then the built-in rules for 66 common AI governance questions. Anything else is marked as needing your input.
- Evidence
- Each drafted answer lists the records it used: the inventory, named documents with version and approval state, named assessments, monitoring and policy settings.
- Statuses
- Not drafted, drafted, edited, approved, needs input.
- Roles
- Members, compliance managers and admins upload, draft and edit. Admins, owners and compliance managers approve. Viewers read.
- Export
- Excel and CSV with the original columns plus Answer, Yes / No and Review status, and optionally Evidence and Confidence; or Word. Exported cells are never formulas.
- Language models
- Not used on the hosted service. Optional in self-hosted deployments with the customer's own Anthropic API key.
- Related template
- The AI governance fact sheet, one of the document templates, is a one-page summary to attach to a questionnaire.
- Plans
- Govern and Enterprise, and during the trial. See pricing.
Questions
- Does it answer the whole questionnaire?
No. It drafts the questions about AI governance that your records can support. General security questions, and anything your workspace holds no evidence for, are marked as needing your input.
- Are the answers written by a language model?
Not on the hosted service. Answers are produced by fixed rules from your records, so the same records give the same answer. The product has an optional AI drafting mode that a self-hosted customer can enable with their own API key; it is not enabled on the hosted service, and no language-model provider is among our subprocessors.
- Could it claim something we cannot back up?
The rules only state what a record shows, and cite the record. They cannot know whether the record itself is right or current, which is why every answer is a draft until one of your people approves it.
- Does the customer see our internal evidence references?
Only if you include them. The evidence and confidence columns can be left out of the export.
- Which questionnaires does the library follow?
It covers the themes that widely used vendor questionnaires ask about AI: policy, inventory, risk assessment, training on customer data, vendors, oversight, monitoring and incidents. The wording is our own; no licensed questionnaire text is included, and you upload the customer’s actual file.
- Is the uploaded file kept?
The questions and the table they came in are stored in your workspace so the export can reproduce the layout. An admin, owner or compliance manager can delete a questionnaire.
- Answering AI questions in security questionnairesThe six themes, what a credible answer looks like, and the evidence for each.
- DocumentsThe policy, incident plan and fact sheet the answers cite.
- AI inventoryThe record behind the inventory answer.
- AI usage reportDated evidence of which AI tools are in use.
- SecurityHow the product handles your data, and what is not there yet.
Bring the next questionnaire with you.
Start a 14-day trial with every Govern feature. Record your AI systems, generate the policy, then upload a questionnaire and see which answers your records already support. No card is needed to start.