Ready for your first AI questionnaire?

Work through it in order: each section builds on the one before. If you can confirm every item, you will have a document behind each of the questions these questionnaires commonly ask. Where you cannot, you have a list of what to fix first.

1. 01Know what AI you use

   Every later answer depends on this list.

   • A list of AI features in your product, and the models or APIs behind each one.
   • A list of AI tools staff use for work, including free or personal accounts and assistants built into email, documents, browsers and meeting software.
   • An owner named for each item on both lists.
   • For each item, what it is used for and whether it informs decisions about people, such as hiring, credit, pricing or access to a service.
   • Whether users are told when they are dealing with AI or reading AI-generated content.

2. 02Know where the data goes

   Expect detailed questions about data sent to AI vendors.

   • For each tool or feature: what categories of data it receives, and whether that includes personal or customer data.
   • Each vendor's terms on training with your inputs, the retention setting you chose, and where data is stored.
   • A data processing agreement in force with each vendor that receives personal data (often part of its terms of service), its subprocessor list, and the transfer mechanism if data leaves the EU or UK.
   • Whether you use customer data to train or improve your own models, and whether customers can opt out.
   • Every AI vendor on your own subprocessor list, and a way to tell customers before you add one.
   • Whether your customers' contracts allow their data to be processed by these vendors at all.

3. 03Have written rules

   A short policy people follow beats a long one nobody reads.

   • An AI use policy: approved tools, data that must never go into them, and who approves a new tool.
   • A record of who has read the policy and been trained on it, and when.
   • A named person accountable for AI risk, even if it is part of their job rather than all of it.

4. 04Classify the risk

   Expect to be asked how you rate the risk of each AI use, and why.

   • A risk rating for each AI system, with the reason for it.
   • If you offer an AI system in the EU, or its output is used there: your role under the EU AI Act (provider or deployer) and the category each system may fall into, for your counsel to confirm.
   • Any framework you use, such as the NIST AI Risk Management Framework or ISO/IEC 42001, and how far you have applied it. The NIST framework has no certification; for ISO/IEC 42001, say whether you are certified, and by whom, or only aligned.

5. 05Show oversight and testing

   The follow-up questions are about what happens when the AI is wrong.

   • Who reviews AI output before it reaches a customer or affects a decision, and how.
   • How each system is tested before release and after changes, with the results kept.
   • Where outputs inform decisions about people, how you check for unfair differences between groups, and what data you used to do it (that data may itself be sensitive).
   • How each AI feature is protected from misuse: who can reach it, prompt injection, and one customer's data reaching another.
   • How you learn that a vendor has changed or retired a model, and how you retest afterwards.
   • How to switch each system off, who decides, and who is told when something goes wrong.

6. 06Keep the evidence in one place

   A questionnaire answer is only as good as the document behind it.

   • One folder with the policy, both lists, vendor agreements, risk ratings, test results and incident records, each dated.
   • A library of approved answers, so the same question gets the same answer every time.
   • One person who owns questionnaire responses and checks them against that folder.

7. 07Answer honestly

   Questionnaire answers are often attached to the contract, so an overstated answer can become a commitment.

   • Where something is not in place yet, say so and give the date you plan to have it.
   • Do not claim compliance with a framework or regulation you have not assessed against.
   • Send questions that ask for a legal position to your counsel before you answer them.

This checklist is general guidance, not legal advice, and covers what questionnaires commonly ask rather than any one regulation. How Touchstone Data applies the same rules to its own use of AI is on How we work.