AI Questionnaire Readiness Checklist
Before an enterprise buyer sends a 100-row spreadsheet, make sure the underlying evidence exists. Score one point for each item you can prove with a current document, system record or approved owner response.
Evidence readiness: 24-point check
Named owner for AI governance or product risk.
Current internal policy covering approved AI use.
List of AI features, models and third-party providers.
Documented process for assessing AI use-case risk.
Process for reviewing material model/provider changes.
Clear explanation of what customer data AI features process.
Documented statement on whether customer data trains shared models.
Known retention period for prompts, outputs and AI logs.
Documented deletion behavior for AI-related customer data.
Known processing/storage regions for relevant AI data.
Current list of AI and data subprocessors.
Contractual/privacy language aligned with actual AI processing.
Documented access model for prompts, logs and AI configuration.
Current evidence for encryption in transit and at rest.
Process for protecting model-provider credentials and API keys.
Audit/operational logging for material AI activity.
AI/provider incidents covered by response procedures.
AI-enabled features included in development/security review.
Documented quality/safety evaluation before material release.
Defined monitoring for reliability or unsafe behavior where relevant.
Clear points where humans review, override or escalate.
Known AI limitations and prohibited uses documented.
Named owners for security, privacy, legal and product questions.
Current prior answers that can be verified and reused.
How to interpret your score
High questionnaire risk
Expect significant manual research and escalation. Focus first on data use, provider inventory, privacy and core security evidence.
Partially prepared
You can answer many questions, but gaps are likely to create back-and-forth. Convert the missing items into explicit documentation tasks.
Strong evidence base
Your team should be able to shift from writing answers to reviewing evidence-backed drafts—assuming the documents are current and accurate.
This scoring model is a ProcureDeal planning framework, not a certification or compliance assessment.