What changed · Security questionnaires
Answering the AI section of a client security questionnaire
Security questionnaires from clients have mostly asked about antivirus, backups and multi-factor authentication. More of them now include questions about AI. These are harder to answer from memory, and because your answers are representations to the client, they need to be accurate.
By Dale Harper · Last checked September 2026
Most questions had a standard answer, and evidence was rarely asked for.
AI questions tend to ask which tools are used on the client's data, whether that data is used to train AI models, and who approves new tools. The answers depend on what your firm does in practice, so they need to be backed by records.
Check it yourself
- 1Find the last security questionnaire you completed.
- 2If it had AI questions, check whether you could provide evidence for each answer.
- 3If it didn't, try answering the three questions above for your firm now.
The training question can usually be answered from each vendor's terms. The other two are where records tend to be missing.
Answer template
A template for seven AI questions that appear in client security questionnaires. For each one it explains what the client is asking and which record the answer rests on, then gives a draft answer to adapt. There's separate wording for when you can't back an answer up yet.
It's a plain text file, so you can paste answers into a questionnaire form or a document.
AI questions in client security questionnaires: answer template
Published by Internacious
https://internacious.com/what-changed/client-security-questionnaire-ai
HOW TO USE THIS
Each question below has a note on what the client is asking, the record
your answer should rest on, and a draft answer to adapt. Replace the text
in [square brackets].
Where you don't have the record yet, use the "If you can't back this up
yet" wording instead of the draft answer.
Your answers are representations to the client. Only keep a sentence if
it's true for your firm today.
------------------------------------------------------------------------
1. Do you use AI tools on our data? If so, which ones?
------------------------------------------------------------------------
What they're asking
Whether their material goes into AI tools, and which companies that
passes it to.
Record it rests on
Your list of AI tools used on client work.
Draft answer
We use the following AI tools on client work: [tool name, and what it's
used for]. Staff may not use other AI tools on client material without
approval. This list was last reviewed on [date].
If you can't back this up yet
We are compiling a list of the AI tools used on client work and expect
to complete it by [date]. We can provide it once it's complete.
------------------------------------------------------------------------
2. Is our data used to train AI models?
------------------------------------------------------------------------
What they're asking
Whether their material could become part of a model that other people
use.
Record it rests on
Each tool's terms on whether customer content is used for training.
These are in the vendor's terms of service or data processing terms, and
can differ between free and paid plans of the same tool.
Draft answer
We have checked the terms for each AI tool we use on client work.
[Tool name]: [what the terms say about training on customer content,
and where it says so]. [Repeat for each tool.]
If you can't back this up yet
We are confirming each vendor's terms on the use of customer content for
training and will provide them by [date].
------------------------------------------------------------------------
3. Who approves new AI tools? Do you have a written AI policy?
------------------------------------------------------------------------
What they're asking
Whether new tools reach their material only after someone has decided
they should.
Record it rests on
Your written policy on AI use.
Draft answer
New AI tools must be approved by [role] before they are used on client
work. Our AI use policy was adopted on [date] and last reviewed on
[date]. We can provide a copy on request.
If you can't back this up yet
We are putting a written AI use policy in place and expect to adopt it
by [date]. Until then, [describe who decides now, if anyone does].
------------------------------------------------------------------------
4. Where is our data processed and stored when you use AI tools?
------------------------------------------------------------------------
What they're asking
Which countries their material may be sent to.
Record it rests on
Each tool's terms or admin settings on data location.
Draft answer
[Tool name] processes and stores data in [country or region], according
to [the vendor's terms, or the setting in our admin console].
[Repeat for each tool.]
If you can't back this up yet
We are confirming the processing location for each AI tool we use and
will provide it by [date].
------------------------------------------------------------------------
5. Is AI output checked by a person before it is relied on or sent to us?
------------------------------------------------------------------------
What they're asking
Whether a person takes responsibility for work that an AI tool helped
produce.
Record it rests on
Your policy, or a written procedure.
Draft answer
AI output used in work for clients is reviewed by [role] before it is
relied on or sent. [Describe how, if the questionnaire asks for detail.]
If you can't back this up yet
Our procedure for reviewing AI output is being written. At present,
[describe what happens now].
------------------------------------------------------------------------
6. Do staff receive training on the use of AI tools?
------------------------------------------------------------------------
What they're asking
Whether staff have been taught the rules.
Record it rests on
Training records.
Draft answer
Staff who use AI tools on client work complete [training] when they
join and [how often] after that. [Role] keeps the records.
If you can't back this up yet
Training on AI use is planned for [date].
------------------------------------------------------------------------
7. Can we ask you not to use AI tools on our work?
------------------------------------------------------------------------
What they're asking
Whether they can opt out, and whether you could honour it.
Record it rests on
Your policy, and how your tools are set up.
Draft answer
[Say whether you can, and how. For example, which tools would be
excluded and how staff would be told.] We would confirm the arrangement
in writing.
If you can't back this up yet
We are reviewing whether we can exclude individual clients from AI tools
and will confirm by [date].
------------------------------------------------------------------------
AFTER YOU'VE ANSWERED
------------------------------------------------------------------------
Keep a copy of each completed questionnaire with the date you sent it.
When you add or drop an AI tool, update your answers to questions 1, 2
and 4 before the next questionnaire arrives.
What you need
To answer most AI sections you need three things in writing: each AI tool's terms on whether client data is used for training, a list of which tools are used on client work, and a policy saying who approves new tools.
If you don't have these yet, it's better to say the matter is under review than to give an answer you can't support.
| What you need | Where it comes from |
|---|---|
| Each AI tool's terms on whether client data is used for training | The vendor's terms |
| A list of which tools are used on client work | Your own tool list |
| A policy saying who approves new tools | Your own policy |
Evidence pack
If a questionnaire is due soon, we can put the evidence together on its own, without a full engagement. The Shadow AI Audit and the Copilot Exposure Assessment cover the same ground in more depth.
Ask about the evidence pack