AI questions in security questionnaires: how to answer them when you've shipped an AI feature

You added an AI feature: a summary button, a chat assistant, smart search. The next security questionnaire from an enterprise prospect has a new section at the bottom called “Artificial Intelligence” with fifteen questions you have never seen before.

This is now common. Buyers have learned that a standard SaaS questionnaire doesn’t tell them where their data goes once it reaches a model, so they add questions. The good news: most of them come down to a handful of facts about your product that you can write down once and reuse. This guide covers the questions that come up most, example answers you can adapt, and the mistakes that send a review back for another round.

Where these questions come from

Some buyers write their own AI section. Others borrow from published frameworks, and it helps to know the names when you see them:

• The Cloud Security Alliance’s [AI Controls Matrix (AICM)](https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1). Version 1.1 has 247 control objectives across 18 domains, and it comes with a questionnaire, the AI-CAIQ, that buyers can use to assess vendors. It builds on CSA’s Cloud Controls Matrix, the same family as the CAIQ. It is a free download.
• NIST’s [AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) (AI RMF 1.0, January 2023) and its Generative AI Profile, NIST AI 600-1 (July 2024). Both are voluntary. Questions influenced by them tend to ask about governance: who owns AI risk, how you measure it, how you manage it.
• The [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/) (2025 edition). Technical reviewers use it to ask about specific risks: prompt injection is number one, followed by sensitive information disclosure, supply chain, and data and model poisoning.
• [ISO/IEC 42001](https://www.iso.org/standard/42001), the international standard for an AI management system. A questionnaire may ask whether you are certified against it. Most small vendors are not, and “No” is a fine answer if it’s true.

You don’t need to adopt any of these to answer a questionnaire. But recognizing the source tells you what the reviewer is looking for.

First, write down six facts about your AI feature

Almost every AI question can be answered from this short list. Write it once, have your engineer check it, and keep it next to your other approved answers.

1. Which AI providers you use, and for which feature (for example, a model provider for drafting and another service for search).
2. What customer data is sent to them: the whole document, a snippet, the user’s typed question, metadata only.
3. Whether that data is used to train any model, yours or the provider’s, and where that is written down (the provider’s commercial terms, your contract).
4. How long prompts and outputs are kept, by you and by the provider, and where.
5. Whether a human reviews or approves the output before it has any effect, or whether the feature can act on its own.
6. Whether customers can turn the feature off.

If you can’t answer one of these yet, that is the most useful thing you will learn from this exercise. Find out before the questionnaire is due, not while writing the answer.

The common questions, with example answers

These are written for a fictional company. Replace the brackets with your real details, and delete any sentence that isn’t true for you.

• Q: Do you use AI or machine learning in your product? A: “Yes. Our [summary feature] uses a large language model from [provider] through its commercial API. Other parts of the product do not use AI.”
• Q: Is customer data used to train AI models? A: “No. We don’t train models on customer data. [Provider]’s commercial API terms state that API inputs and outputs are not used to train its models.” (Only name providers whose terms you have actually read.)
• Q: What customer data is shared with AI providers? A: “When a user runs [feature], the relevant [document text / question] is sent to [provider] to generate the result. We don’t send [account details, billing data].”
• Q: Are AI providers listed as subprocessors? A: “Yes. [Provider] is on our public subprocessor list at [URL].”
• Q: How long are prompts and outputs retained? A: “Outputs are stored in the customer’s workspace until the customer deletes them. [Provider] retains API data for [period stated in its terms].”
• Q: How do you prevent the AI from producing inaccurate output? A: “The feature only uses the customer’s own content as its source and shows which source each result came from. Users review results before using them.”
• Q: How do you protect against prompt injection? A: “Uploaded content is treated as data, not instructions. Our system instructions are kept separate from customer content, and the model has no ability to [send email / change settings / access other customers’ data].”
• Q: Is there human oversight of AI output? A: “Yes. Nothing the model produces takes effect until a user reviews and accepts it.”
• Q: Can customers opt out of AI features? A: “Yes. Workspace admins can turn off [feature] in settings.” (Or: “Not currently. AI drafting is a core part of the product.”)
• Q: Do you have an AI policy or AI governance program? A: “Our [CTO] is responsible for AI use in the product. Our [acceptable use / AI] policy covers which AI services staff may use with company and customer data.”
• Q: Are you certified against ISO/IEC 42001? A: “No.”

For the wider set of questions that sit around this section (encryption, access control, incident response), see 50 common security questionnaire questions with example answers.

The traps

• Saying “no AI providers ever train on our data” when you have only read one provider’s terms. If you use two AI services, check both. Write the answer per provider if their terms differ.
• Forgetting the internal side. Many questionnaires ask whether staff paste customer data into AI chat tools. If you don’t have a rule about it, the honest answer is that you don’t, and it’s a good reason to write one.
• Answering “No” to “Do you use AI?” because the AI is “just a feature”. If a model touches customer data, the answer is yes. Reviewers often find out from your own marketing site.
• Claiming accuracy you haven’t measured. “Our AI is 99% accurate” invites a request for the methodology. Describe the safeguards instead: sources shown, human review, unsupported results flagged.
• Overstating prompt injection defenses. OWASP lists it as the top risk for LLM applications, and no one can promise it never happens. Describe what you limit: what the model can see and what it can do.
• Leaving the AI provider off your subprocessor list. Buyers cross-check. If the questionnaire names a provider your list doesn’t, expect a follow-up.

Our guide to answers that invite follow-up questions has more on why vague or inflated wording slows reviews down.

If the honest answer is “not yet”

Small vendors often don’t have an AI policy, a model inventory or an AI risk assessment. Say so plainly, then give the reviewer the specific facts you do have: providers, data flow, training terms, retention, human review. A clear data flow description usually does more for a reviewer than a policy document with nothing behind it.

If you plan to write a policy, say that only if you will. The same rule applies here as for the SOC 2 question: answer what was asked, then add context that’s true.

A short checklist

• List every AI provider and what each one receives.
• Read each provider’s terms on training and retention, and save the links.
• Make sure every AI provider is on your subprocessor list.
• Write down whether a human approves AI output before it takes effect.
• Decide whether customers can turn AI features off, and say so.
• Write a one-paragraph rule for staff use of AI tools with customer data.
• Save the approved answers so the next AI section is a copy, not a rewrite. See how to build a security answer library.

Answering it with Rendro

Rendro drafts questionnaire answers, including AI sections, only from your own documents, shows the source for each answer, and marks anything your documents don’t support as Needs review instead of guessing. If your six facts are written down, it will use them. There is a 14-day free trial, no card needed, on rendro.net.