AI questions in client security questionnaires: answer template Published by Internacious https://internacious.com/what-changed/client-security-questionnaire-ai HOW TO USE THIS Each question below has a note on what the client is asking, the record your answer should rest on, and a draft answer to adapt. Replace the text in [square brackets]. Where you don't have the record yet, use the "If you can't back this up yet" wording instead of the draft answer. Your answers are representations to the client. Only keep a sentence if it's true for your firm today. ------------------------------------------------------------------------ 1. Do you use AI tools on our data? If so, which ones? ------------------------------------------------------------------------ What they're asking Whether their material goes into AI tools, and which companies that passes it to. Record it rests on Your list of AI tools used on client work. Draft answer We use the following AI tools on client work: [tool name, and what it's used for]. Staff may not use other AI tools on client material without approval. This list was last reviewed on [date]. If you can't back this up yet We are compiling a list of the AI tools used on client work and expect to complete it by [date]. We can provide it once it's complete. ------------------------------------------------------------------------ 2. Is our data used to train AI models? ------------------------------------------------------------------------ What they're asking Whether their material could become part of a model that other people use. Record it rests on Each tool's terms on whether customer content is used for training. These are in the vendor's terms of service or data processing terms, and can differ between free and paid plans of the same tool. Draft answer We have checked the terms for each AI tool we use on client work. [Tool name]: [what the terms say about training on customer content, and where it says so]. [Repeat for each tool.] If you can't back this up yet We are confirming each vendor's terms on the use of customer content for training and will provide them by [date]. ------------------------------------------------------------------------ 3. Who approves new AI tools? Do you have a written AI policy? ------------------------------------------------------------------------ What they're asking Whether new tools reach their material only after someone has decided they should. Record it rests on Your written policy on AI use. Draft answer New AI tools must be approved by [role] before they are used on client work. Our AI use policy was adopted on [date] and last reviewed on [date]. We can provide a copy on request. If you can't back this up yet We are putting a written AI use policy in place and expect to adopt it by [date]. Until then, [describe who decides now, if anyone does]. ------------------------------------------------------------------------ 4. Where is our data processed and stored when you use AI tools? ------------------------------------------------------------------------ What they're asking Which countries their material may be sent to. Record it rests on Each tool's terms or admin settings on data location. Draft answer [Tool name] processes and stores data in [country or region], according to [the vendor's terms, or the setting in our admin console]. [Repeat for each tool.] If you can't back this up yet We are confirming the processing location for each AI tool we use and will provide it by [date]. ------------------------------------------------------------------------ 5. Is AI output checked by a person before it is relied on or sent to us? ------------------------------------------------------------------------ What they're asking Whether a person takes responsibility for work that an AI tool helped produce. Record it rests on Your policy, or a written procedure. Draft answer AI output used in work for clients is reviewed by [role] before it is relied on or sent. [Describe how, if the questionnaire asks for detail.] If you can't back this up yet Our procedure for reviewing AI output is being written. At present, [describe what happens now]. ------------------------------------------------------------------------ 6. Do staff receive training on the use of AI tools? ------------------------------------------------------------------------ What they're asking Whether staff have been taught the rules. Record it rests on Training records. Draft answer Staff who use AI tools on client work complete [training] when they join and [how often] after that. [Role] keeps the records. If you can't back this up yet Training on AI use is planned for [date]. ------------------------------------------------------------------------ 7. Can we ask you not to use AI tools on our work? ------------------------------------------------------------------------ What they're asking Whether they can opt out, and whether you could honour it. Record it rests on Your policy, and how your tools are set up. Draft answer [Say whether you can, and how. For example, which tools would be excluded and how staff would be told.] We would confirm the arrangement in writing. If you can't back this up yet We are reviewing whether we can exclude individual clients from AI tools and will confirm by [date]. ------------------------------------------------------------------------ AFTER YOU'VE ANSWERED ------------------------------------------------------------------------ Keep a copy of each completed questionnaire with the date you sent it. When you add or drop an AI tool, update your answers to questions 1, 2 and 4 before the next questionnaire arrives.