What does a filled-in AI questionnaire look like?

The request

Harbrook is invented. In this example an employer that uses Applicant sorter sends Harbrook its own AI questionnaire as an Excel file. These are the four answers that open a new audit.

• 1 · Who is asking? A fictional customer. They are: Customer.
• 2 · What did they send? Their questionnaire, AI supplier questionnaire.xlsx.
• 3 · Which AI systems does it cover? Applicant sorter and Help chat.
• 4 · Due date: (date). Who owns it: Head of product.

Check the questions we found

Complipath reads the file on its own server and matches each question to the register and the files by fixed rules. Nothing is saved until a person has checked what was read.

A question with no clear match starts as a Gap. The check step says so and adds “Nothing is answered for you: every match shows where it comes from.”

A matched requirement is read in full in Articles 9, 12, 14 and 50 of Regulation (EU) 2024/1689, as amended, and Applicant sorter's risk class under Article 6 and Annex III.

Each question, its status and its answer

Ready means a person confirmed the answer and proof stands behind it. Needs proof means something is there but not both, such as a file found for it or a draft nobody has confirmed. Gap means nothing in the workspace answers it yet.

• The statuses are computed from what the workspace holds each time the audit is read, never stored.
• Confirm answer is the human step: an answer counts as confirmed only once a person presses it. Any later change to the answer removes the confirmation.
• Under an answer nobody has confirmed, the app says whose draft it is, how many sources it rests on and that it is not confirmed.
• Question 6 matched nothing, and its page says “We matched this question to no requirement and no record in your workspace. Answer it yourself and add proof; it stays a Gap until then.”
• An AI draft is optional, and it may cite only the workspace's own sources. A sentence that names no source, names one it was not given, says what is missing or carries a figure its sources do not is moved out of the answer to Not proven yet. Rules decide. AI only drafts. A person confirms.

Lock and send

• Locking freezes exactly what is sent. Later changes go into a new version, so Harbrook can always show what the customer received and when.
• Questions 3, 4 and 6 are not Ready, so they are sent as open, with the date Harbrook expects them.
• What goes in the version is ticked part by part, and only the cover page is fixed: the cover page; the answers to their questions, each with its source; each system's risk class, article and who confirmed it; the evidence files, with the passage that proves each requirement; the AI literacy record; the audit log for the period, which starts unticked.
• The fingerprint is printed on the last page of the PDF. If one file or one answer changes, the fingerprint changes.

Back in the customer's own file

Under the locked version, Download in their format asks for the customer's file again, because Complipath does not keep it. Only confirmed answers are written; every other question reads Not answered yet.

• Before the download the app says where the answers go: “Sheet "Questions": answers in column C ("Supplier response"), sources in column D ("Source").”
• Their own answer column is used because its header reads Supplier response. Where a file has no answer column, a new column headed Answer is added.
• A stamp two rows below the last row reads “Answered with Complipath · version 1 · fingerprint”, followed by the start of the fingerprint. This example prints none.
• The file comes back as AI supplier questionnaire (answered).xlsx, with every other part of it copied as it came.
• A Word questionnaire gets each answer under its question in the document's own style. A PDF cannot be written into, so it comes back as a Word file.

What this example leaves out

• Real data. Harbrook, its customer, the file names and the roles named here are invented, and no number on the page is a measurement.
• The passages. A real source line quotes the passage of the file, or the words of the statement, that the answer rests on. This example names the file or the role and stops there.
• Names and dates. Where the app prints who confirmed an answer and when, this example prints a role and (date).
• The customer's file. Complipath reads it and lets it go: what stays is its name, where in it the questions stood, a fingerprint of it and the questions as the person checked them.