Have the answer ready before the form arrives
An AI vendor questionnaire asks what you use, who owns it and who checked the output.
No card. No time limit.
How to Answer an AI Vendor Questionnaire
Clients have started sending suppliers an AI vendor questionnaire. Here are the eight questions that keep coming up, what a good answer looks like, and what to attach to it.
An AI vendor questionnaire is a form your client sends you, asking what AI you use, who is responsible for it, and what happens to their data inside it. It rarely arrives on its own. Usually it is stapled to a contract renewal, a security review, or a procurement pack, and it has a return date near the top.
Two years ago almost nobody sent these. Now they are routine, and the companies receiving them are frequently the ones least prepared to answer.
Why your clients send an AI vendor questionnaire
Article 50 of the EU AI Act has applied since 2 August 2026. The European Commission adopted its guidelines on those transparency obligations on 20 July, and national market surveillance authorities now enforce them. Penalties run to €15 million or 3% of worldwide annual turnover, whichever is higher.
One deadline is still ahead. The machine-readable marking requirement, the part that covers watermarking AI-generated output, was given a four-month runway that ends on 2 December 2026.
Here is the part that affects you. A company has to account for AI in what it publishes and what it sells, including the parts produced by somebody else. So the obligation travels down the supply chain, and it travels in the form of a questionnaire. Your client is not auditing you because they distrust you. They are asking because somebody asked them.
The questionnaire is how regulation reaches companies the regulation was never aimed at.
The eight questions on almost every AI vendor questionnaire
The wording differs. The substance does not. Below is each question, why it is being asked, a model answer, and what to attach so the answer stands up.
1. What AI systems do you use, and what for?
This is the opener, and it is the one that catches people out. They answer with the tools they approved, not the tools in use. Those are different lists, and your client will eventually meet the difference.
“We use Claude and ChatGPT for drafting and research, Descript for transcription, and an internal scoring model for prioritising inbound enquiries. Marketing copy, internal documentation and first-draft client deliverables are the only places AI touches your work. It is not used in pricing or in any decision about an individual.”
What to attach: a dated list of systems, what each is used for, and who owns it.
2. Who is responsible for each system?
A named person, with a role. “The team” is not an answer, and neither is “the founder” on its own if the founder cannot say what the tool did last week.
“Each system has a named owner. Content tools sit with our Head of Content, the scoring model sits with our CTO. The owner approves changes to how it is used and is the first point of contact if something goes wrong.”
What to attach: the same list, with a person and a role against every line.
3. Does our data go into AI tools, and which ones?
The most important question on the form, and the one where a vague answer is read as a yes. Be specific about what never goes in, because that is the sentence they are looking for.
“Client data is not pasted into consumer AI accounts. We use business-tier accounts with training disabled, and anything identifying your customers is removed before it reaches a model. Transcripts of calls with your team are processed by Descript under our DPA and deleted after 90 days.”
What to attach: the DPA, and the tool’s data-retention setting as it is configured for you.
4. Do you keep a record of where AI is used, and who maintains it?
When we asked 66 companies this exact question in September, the honest answers were remarkably consistent. Most had no register at all. One founder put it better than any policy document:
“The honest small-company answer is that the record is the founder’s working knowledge. I know every place AI touches our workflow because I approved each one.”
That is true, and it is also not auditable. The moment a second person joins, or the founder goes on holiday, the record stops existing.
“Yes. We keep an inventory of every AI system in use, what it is used for and who is responsible for it. It is versioned, so we can show what we were running on any given date rather than only today. Our Head of Operations maintains it.”
What to attach: an export of the register, with dates.
5. Is there an approval process before you adopt a new AI tool?
They are checking whether tools arrive by decision or by accident. An informal process is fine, as long as it is real and you can describe it.
“Nothing new touches client work without sign-off. The questions we ask before approving are where the input goes, whether it is retained or trained on, and whether the output can be verified. Personal accounts are not permitted for client work.”
What to attach: the one-page policy, or write it today if you don’t have one.
6. Is AI output reviewed by a person before it reaches us?
This is the Article 50 question in disguise, and it is the one where evidence beats assertion by a distance. Everyone says yes. Almost nobody can show it.
“Yes. Nothing AI-assisted is delivered without a named person reviewing it and taking editorial responsibility. We log each review at the time it happens, so the record is contemporaneous rather than reconstructed afterwards.”
What to attach: a sample record showing who reviewed what, and when.
7. Where is the data processed and stored?
A plain geography question, usually with a follow-up about sub-processors. Name countries and companies, not regions.
“All processing and storage is in the EU. Our hosting is with a French provider, our transcription runs on EU infrastructure, and the full sub-processor list is attached. No customer data leaves the EU at any point.”
What to attach: the sub-processor list with locations.
8. How would you evidence any of this if we asked?
The last question, and the one that separates a supplier who gets waved through from one who gets a follow-up call. Everything above is a claim until this is answered.
“Our register exports as a file you can keep. Review records are sealed when they are created and can be verified independently, without an account and without taking our word for it.”
What to attach: an export, plus a link the reviewer can check themselves.
Three bad answers to an AI vendor questionnaire
“We don’t use AI.” Rarely true, and easy to disprove. If one person on your team has a ChatGPT tab open, this answer is a false statement on a procurement document.
“We have an AI policy.” A policy describes intentions. The question was about practice. Attach the policy if you like, but answer the question first.
“We take data security very seriously.” Every supplier writes this, so it carries no information. Replace it with one specific fact and you will be ahead of most of the field.
Before the next AI vendor questionnaire arrives
The reason an AI vendor questionnaire eats a week is that most companies rebuild the answer from scratch each time, chasing colleagues for what tool they used in March. The work is not hard. It is just scattered.
So keep a standing answer. A current list of systems, an owner against each one, the sub-processor list, and the review records. Then the next form becomes a copy-and-paste job and a same-day reply, which is itself a signal to the client about how you run things.
That standing answer is what Art50 keeps: an inventory of the AI you use with a named owner on every line, and sealed records of human review that anyone can verify. The free plan covers an inventory item and twenty records a month, with no card.
And if you have had one of these forms land recently, we would like to hear how it went. We are interviewing companies every week about how they actually handle this, and the honest answers are consistently more useful than the polished ones.
Art50 records human review of AI-assisted work and keeps an inventory of the AI a company uses. It provides evidence, not legal advice. Article 50 of the EU AI Act has applied since 2 August 2026; the full text of the article is here.
