Security questionnaire answers › AI
Do you have an AI governance or acceptable use policy? How to answer it in a security questionnaire
Why buyers ask this
As AI features spread, buyers ask how you control risk, accuracy and misuse, and the EU AI Act adds legal pressure.
What a strong answer includes
- Say a written AI policy exists, who owns it and when it was last reviewed.
- Cover human review of outputs, testing for accuracy and bias, and an inventory of AI systems.
- Mention how you classify AI uses by risk.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. We maintain an AI policy owned by [role] covering approved use, data handling, human oversight, testing and risk classification. We keep an inventory of AI systems in use and review it [quarterly].
Evidence to attach
- AI policy
- AI system inventory
- Model cards or testing records
Common mistakes
- A policy with no inventory behind it.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.