How to answer an enterprise AI security questionnaire

What the questionnaire is actually testing

An enterprise AI questionnaire is not a form. It is the buyer's risk team building a file they must defend internally: to their security function, their legal team, and increasingly their board. Every answer you give becomes part of that file, and many of your answers will be attached to the contract as representations. The reviewer is testing two things at once: whether your AI is governed, and whether your answers can be trusted. A vendor can pass the first test and fail the second, and the second failure is worse, because it is unrecoverable.

The five question types, and who should answer each

Almost every AI questionnaire, whatever its length, is built from five question families. Security posture questions (access control, encryption, tenancy, incident response) belong to whoever owns your security programme. Data questions (training data provenance, retention, sub-processors, customer data separation) belong to engineering, with legal review where personal data is involved. Model questions (evaluations, monitoring, drift, known limitations, human oversight) belong to your ML or product lead. Governance questions (ownership, policies, risk process, incident history) belong to a founder or operations lead until a dedicated owner exists. Regulatory questions (EU AI Act exposure, GDPR Article 22, sector rules) belong to counsel or your compliance adviser. Routing by family, before anyone writes a word, prevents the single most common failure: four teams answering the same question in four contradictory ways.

Citation is the difference between an answer and a claim

A bare "yes" is a claim. "Yes: all AI systems are inventoried in our registry, owner assigned, reviewed quarterly, evidence available on request" is an answer, because it points at something the reviewer can check. Attach each answer to its source: the policy, the control, the log, the named owner. Reviewers spot-check; when the three answers they verify hold up, the remaining hundred inherit that trust. When one collapses, every other answer becomes suspect and the review restarts with hostility.

Hold open what you cannot ground

Every vendor has gaps. The move that wins is stating them: "Not yet in place. Planned for Q4 with the following interim control." Reviewers are professionals who see hundreds of these; a mapped gap with a date reads as maturity, while a confident answer that later proves invented reads as fraud, ends the deal, and follows you to the buyer's peer network. As a rule: never let anyone answer outside their ownership, and never let optimism write an answer that evidence cannot back.

Consistency across every surface

Your questionnaire answers will be read next to your website, your trust page, your sales deck, and your contract. If the questionnaire says twelve controls and the trust page says nine, the reviewer notices, and the discrepancy costs more than either number. Before submission, one person reads the full set against your public claims. One voice, one set of facts, every surface.

Key terms

Security questionnaire

The structured request an enterprise buyer sends before contract to test whether a vendor's AI is governed and whether its answers can be trusted.

Representation

A statement of fact the vendor makes to the buyer; questionnaire answers are frequently attached to the contract as binding representations.

Evidence citation

The policy, control, log, or named owner each answer points to, so the buyer's reviewer can verify it rather than take it on trust.

Held open

An honest disposition used when an answer cannot be grounded in evidence yet, paired with an interim control and a date.

Consistency review

The final pass, by one person, that reads the questionnaire against the website, trust page, deck, and contract before submission.