AI questions in supplier questionnaires: what customers ask and how to answer

Over the past year, a new section has appeared in many supplier security questionnaires: artificial intelligence. Customers want to know which AI tools you use, what data goes into them and who checks what comes out. Here is what the questions usually cover, and how to answer them well.

What customers ask

Most AI sections cover the same handful of topics:

• Use: do you use AI tools or services, and for what?
• Data: is customer data or personal data processed by AI systems, and under which terms?
• Classification: have you assessed your AI systems under the EU AI Act?
• Oversight: does a person review AI output before it affects people?
• Transparency: do you tell people when they interact with an AI system?
• Training: are staff trained to use AI responsibly?
• Vendors: which AI providers do you rely on, and how did you assess them?

The questions are rarely hard. What makes them slow is that nobody has the facts in one place.

Start from an inventory

You can't answer "which AI tools do you use?" honestly without a list. Tools arrive bottom-up: a writing assistant here, a meeting summariser there, an AI feature switched on inside an existing product. A short staff survey and a look at recent expenses usually find most of them.

For each tool, record its purpose, the data it uses, who its output affects and where that output goes. Those four facts answer most of the questionnaire on their own.

Answer what you know, flag what you don't

Some AI questions can't be answered from an inventory, for example whether a vendor trains its models on your inputs. Don't guess. Ask the vendor for its documentation, record the answer and cite it.

Keep it current

AI use changes faster than most security measures. Review the inventory when teams adopt new tools, and when the rules change. In TrustDesk, the AI Register keeps the inventory, and AI questions in questionnaires are drafted from it, citing the entries they rely on.