How to answer the AI questions in customer security questionnaires

Why these questions are arriving

Companies that buy software and services assess their suppliers, and the standard instruments for doing so have added artificial intelligence. The Cloud Security Alliance publishes an AI Controls Matrix with a companion questionnaire, the AI-CAIQ, intended for self-assessment and for evaluating third-party vendors. The Shared Assessments SIG questionnaire includes artificial intelligence among its risk domains. Many buyers also write their own section, often a dozen questions added to an existing spreadsheet.

The customer's concern is simple. They are about to give you their data, or rely on your product, and they want to know whether AI changes the risk: whether their information could end up in a model, whether AI makes decisions that affect them, and whether you are in control of how your own staff use AI tools.

You do not need a certified management system to answer well. You need to know the facts about your own organization and be able to show them.

The six themes, with example questions

The wording varies; the themes repeat. The examples below are typical of what buyers ask and are not quoted from any one questionnaire.

1. Governance and policy

Do you have a documented policy governing the use of AI? Who is accountable for AI risk? Is the policy reviewed, and have employees been trained on it?

A credible answer names the policy, its owner, the date it was approved and the date of its next review, and says how employees were told.

Evidence: the AI acceptable use policy, with its approval record; a training or acknowledgment record.

If the answer is no: say that a policy is being drafted, by whom, and by when. Our guide to writing an AI acceptable use policy describes one that fits on a few pages.

2. Inventory

Do you maintain an inventory of the AI systems and tools in use? Does it include third-party AI services and AI features embedded in other products? How is it kept current?

This is the question that separates organizations that have looked from those that have not, because the honest basis for an inventory is a discovery exercise.

A credible answer states the number of systems recorded, the fields held for each (owner, purpose, data, risk level), how new tools are found, and when the inventory was last reviewed.

Evidence: the inventory itself or a summary export, dated; a description of the discovery method. See what auditors expect of an AI inventory.

3. Customer data and AI

Is customer data used to train AI or machine-learning models? Is customer data sent to third-party AI providers? Can a customer opt out of AI features? Where is AI processing performed?

These are the questions the customer cares about most, and the ones where an imprecise yes or no causes trouble later.

A credible answer separates three things: AI in the product you sell them, AI your staff use while serving them, and AI used by your own suppliers. For each, say which data is involved and what the provider's terms allow.

Evidence: for each AI provider that could receive customer data, the contractual terms on training and retention; your subprocessor list; the product documentation for any AI feature and its controls.

Check before answering. "We never send customer data to AI providers" is a statement about every employee's behaviour, not only about your architecture. Unless you have a way to know which AI tools staff use, answer what you can evidence: what your systems do, what your policy requires, and how you monitor it.

4. Employee use of AI tools

How do you prevent employees from entering confidential or customer information into unapproved AI tools? Do you monitor the use of generative AI? Which AI tools are approved?

A credible answer lists the approved tools, states the rule for everything else, and describes the control: how you know what is in use, and what happens when someone opens a tool that is not approved.

Evidence: the approved-tools list from the policy; a recent report of AI tools in use across the company, with counts; a description of any warning or blocking in place.

Be exact about what your control does. A tool that records which AI services are used and warns people away from unapproved ones is a monitoring and guidance control. It is not data loss prevention, and it does not inspect what was typed. Describe it as what it is. A reviewer will respect "we measure which AI tools are used, on every managed device, and review new ones within a week" more than a claim of prevention that falls apart at the first follow-up.

5. Third-party AI vendors

How do you assess AI vendors before use? Do your contracts with AI providers prohibit training on your data? Do you track which of your subprocessors use AI?

A credible answer describes the review a new AI tool goes through, who signs it off, and what is checked: data use and retention terms, where data is processed, security attestations, and the ability to delete.

Evidence: a completed vendor assessment for one of your main AI providers; the relevant contract clauses.

6. Oversight, risk and incidents

Are AI outputs reviewed by a person before they affect customers? Have AI systems been assessed for risk? Do you follow a recognised framework? Does your incident response plan cover AI?

A credible answer says where a person is in the loop, names any framework you actually work to, and points to the part of the incident plan that covers AI.

Evidence: risk or impact assessments for the systems that matter; an incident response plan with an AI section.

On frameworks, precision matters. "Aligned with the NIST AI Risk Management Framework" is a claim you should be able to back with a gap analysis. "Certified to ISO/IEC 42001" is true only if an accredited body has issued a certificate. If you use a framework as a reference and have not been assessed against it, say exactly that. Our comparison of NIST AI RMF and ISO/IEC 42001 explains the difference.

How to write the answers

Answer the question that was asked. If it asks whether you have a policy, the first word is yes or no.

Then give one fact and one pointer. A date, a number or a name, and the document where the reviewer can check it. "Yes. AI Acceptable Use Policy v2, approved by the CISO on 3 March 2026, attached as item 4."

Scope your statements. "On company-managed devices" and "for the hosted product" are honest limits. A reviewer who finds the edge of an unqualified statement stops trusting the rest.

Say "not yet" when it is not yet. With a plan and a date. Many questionnaires are scored for risk rather than graded pass or fail, and a dated plan reads better than silence. A false yes is a misrepresentation to a customer, and it tends to surface during an incident.

Do not volunteer what was not asked, and do not paste marketing copy. Reviewers read dozens of these.

Mark what is confidential. Share an inventory summary, not the full register, unless a non-disclosure agreement is in place.

Build the evidence pack once

Most of the work is assembling six documents and keeping them current. With these to hand, a new questionnaire is a matter of mapping questions to items.

Add a one-page AI fact sheet that states, in plain sentences, your position on each of the six themes. Sales and security can then answer the first-round questions without a meeting.

Common mistakes

Answering for the product and forgetting the people. The questionnaire asks about the organization. A product with no AI in it is still built and supported by staff who use AI assistants.

Claiming more than the control does. A policy is not a technical control. Monitoring is not prevention.

Borrowing a provider's certification. Your cloud or model provider's attestations are theirs. They support your vendor assessment; they are not your certification.

Letting the answers go stale. The answer about approved tools from six months ago is probably wrong now. Date the fact sheet and review it quarterly.

How GhostAudit approaches it

GhostAudit produces most of the evidence pack from one set of records. Discovery and the sensors establish which AI tools are in use, through Google Workspace, Microsoft 365, a browser extension and a desktop agent, which gives you the basis for the inventory answer and a dated AI usage report for the employee-use answer. The documents library drafts the acceptable use policy, vendor assessments, risk assessments, an incident response plan and a one-page AI governance fact sheet from your own data, for review and approval.

For the questionnaire itself there is security questionnaire answers: upload the customer's Excel or CSV file, and the AI questions are drafted from those same records, each with the record it relied on. Where your records hold no evidence, the question is marked as needing your input, which is the "check before answering" rule above applied by default. A person approves every answer, approved answers are reused the next time, and the result exports back into the customer's layout.

Three limits are worth knowing. The drafting covers AI governance questions, not the rest of a security questionnaire, and it is done by fixed rules: no language model is used on the hosted service. GhostAudit records which AI tools are used and for how long; it does not inspect prompts, so describe it as monitoring and guidance, not as data loss prevention. And it is itself a vendor you will be asked about: it has no SOC 2 report or ISO certification, which our security page states. If you want the first pack assembled for you in a month, see the AI Governance Starter.