Which AI questions come up in security questionnaires, and how do you answer them?

Download it, with no email asked

• AI security questionnaire answer bank, Markdown

What is in it

How each answer is built

• Direct answer: yes, no or partly, first, for the systems asked about.
• Control: what you actually do, as a practice, not a policy title.
• Scope: which systems the answer covers, and which it does not.
• Evidence: the record or screenshot that proves it, with its date.
• Exceptions: where the control does not apply or is not in place yet.
• Status: Implemented, Partially implemented, Planned or Not applicable. Not applicable carries its reason.
• Every pattern below is a form to fill with your own facts. Nothing in it is a statement about your company.

Answer per system

• Article 6 classifies systems, not companies: answer for named systems.
• The questions on training data, logs, human oversight, instructions for use, accuracy and robustness, security and monitoring in use apply only to high-risk systems. For any other system they are Not applicable, with the classification as the reason.

Provision: Article 6

Do you have an AI policy?

• Direct answer: [Yes / Partly / No]. Our rules for using AI cover [systems or teams].
• Control: [What happens before an AI tool is used: registered, classified, owner named].
• Scope: [The systems and teams the rules cover, and those they do not].
• Evidence: [The policy and its approval date, and the inventory or record that shows it is followed].
• Exceptions: [Teams or tools not yet covered, and who is closing the gap].
• Note: No article names an AI policy. Article 17(1) requires providers of high-risk systems to document a quality management system.
• Also asked as: Who in your company is accountable for AI? / Do you keep an inventory of the AI systems you build and use?

Provision: Article 4(1), as replaced by Regulation (EU) 2026/1744; Article 17(1) for high-risk providers

Are the people who build or use your AI trained for it?

• Direct answer: [Yes / Partly]. People who work with [systems] receive [measure] before first use.
• Control: [The measure, and when it is repeated].
• Scope: [Staff, contractors and others using AI on your behalf, by system].
• Evidence: [The AI literacy record: who, on what, when].
• Exceptions: [People or systems not yet covered].
• Note: Article 4(1) asks for measures to support AI literacy, not a guaranteed level for any individual.
• Also asked as: How do you train staff who work with AI?

Provision: Article 4(1), as replaced by Regulation (EU) 2026/1744

Do you use AI for any practice the AI Act prohibits?

• Direct answer: [No / Under review for (system)].
• Control: [Each system is checked against Article 5 when it is classified, and a named person confirms it].
• Scope: [All systems in the inventory].
• Evidence: [Each system's classification record, with its Article 5 answers and the date it was confirmed].
• Exceptions: [Systems not yet classified].
• Note: Article 5 has applied since 2 February 2025. Article 5(1a) and (1b) and Article 5(1), first subparagraph, points (ba) and (bb), inserted by Regulation (EU) 2026/1744, apply from 2 December 2026 (Article 113, third paragraph, point (a), as replaced).
• Also asked as: Do any of your AI systems fall under a prohibited practice?

Provision: Article 5; Article 113, third paragraph, point (a)

Is any AI system you provide or use high-risk?

• Direct answer: [No / Yes: (systems)].
• Control: [Each system is classified under Article 6 with Annex I and Annex III, and a named person confirms it].
• Scope: [All systems you provide or use].
• Evidence: [Each classification, with the provision it rests on and the date it was confirmed].
• Exceptions: [Systems with a documented Article 6(3) assessment, or with the classification still open].
• Note: Per system, with the route it rests on or the reason none applies.
• Also asked as: Are any of your AI systems high-risk?

Provision: Article 6, Annex I and Annex III

Do you tell people when they are interacting with an AI system?

• Direct answer: [Yes, for (systems that interact with people) / Not applicable].
• Control: [How and when the person is told, at the latest at the first interaction].
• Scope: [The systems that interact with people, and those that do not].
• Evidence: [A screenshot of the notice, with its date].
• Exceptions: [Systems where the duty is not met yet].
• Note: A provider duty in paragraph 1, a deployer duty in paragraph 3. Each has its exceptions.
• Also asked as: Do you tell users when they are interacting with AI? / Do you disclose to users when they interact with AI?

Provision: Article 50(1) and (3)

Do you label content your AI generates?

• Direct answer: [Yes, for (systems that generate content) / Not applicable].
• Control: [How outputs are marked, and how deep fakes or published text are disclosed].
• Scope: [The systems that generate content].
• Evidence: [An example output with its marking, and its date].
• Exceptions: [Systems where marking is not in place yet].
• Note: Systems placed on the market before 2 August 2026 have until 2 December 2026 for paragraph 2.
• Also asked as: Do you label AI-generated content?

Provision: Article 50(2) and (4); Article 111(4)

Is our data used to train your models?

• Direct answer: [Yes / No].
• Control: [What your contract and your model providers' terms say about training].
• Scope: [The features that send data to a model].
• Evidence: [The clause in your terms and the model provider's terms, with the date you read them].
• Exceptions: [Any data used for other purposes, and which].
• Note: Not an AI Act question. Answer from your contract and your model providers' terms.
• Also asked as: Is our data used to train AI models?

How do you govern training data and check it for bias?

• Direct answer: [Yes / Partly / Not applicable], for [systems].
• Control: [How data sets are chosen, examined and corrected].
• Scope: [The systems that train on data].
• Evidence: [The data governance record, with its date].
• Exceptions: [Data sets not yet examined].
• Note: Bias is Article 10(2), points (f) and (g). Applies only to high-risk systems: for any other system the status is Not applicable, with the classification as the reason.
• Also asked as: How do you govern training data? / How do you check data for bias?

Provision: Article 10

Do you log what your AI systems do?

• Direct answer: [Yes / Partly / Not applicable], for [systems].
• Control: [What is logged, and how long it is kept].
• Scope: [The systems whose logs you control].
• Evidence: [A log extract and the retention setting, with its date].
• Exceptions: [Systems or events not logged yet].
• Note: Under Article 26(6), deployers keep the logs under their control for a period appropriate to the intended purpose, at least six months, unless Union or national law provides otherwise; financial institutions keep them with their financial services documentation. Applies only to high-risk systems: for any other system the status is Not applicable, with the classification as the reason.
• Also asked as: What do you log for the AI features? / How long do you keep the AI system's logs?

Provision: Article 12(1); Article 26(6)

Can a person review or override the AI's output?

• Direct answer: [Yes / Partly / Not applicable], for [systems].
• Control: [Who reviews, and how they can override or stop the system].
• Scope: [The systems with a review step, and those without].
• Evidence: [A screenshot of the review step and one logged decision, with its date].
• Exceptions: [Systems that act without review, and why].
• Note: The provider designs for oversight; the deployer assigns people with the necessary competence, training and authority, as well as the necessary support. Applies only to high-risk systems: for any other system the status is Not applicable, with the classification as the reason.
• Also asked as: Who oversees the AI system in use? / Can the system be stopped?

Provision: Article 14(1); Article 26(2)

Do you document how the AI works and where its limits are?

• Direct answer: [Yes / Partly / Not applicable], for [systems].
• Control: [The instructions for use, and who keeps them current].
• Scope: [The systems they cover].
• Evidence: [The instructions for use and their version].
• Exceptions: [Systems not yet documented].
• Note: Instructions for use with concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers. Applies only to high-risk systems: for any other system the status is Not applicable, with the classification as the reason.
• Also asked as: Do you document how your AI works and where its limits are?

Provision: Article 13(1) and (2)

How do you test accuracy and robustness?

• Direct answer: [Yes / Partly / Not applicable], for [systems].
• Control: [What is tested, against which metrics and thresholds, and when].
• Scope: [The systems tested before release].
• Evidence: [The latest test report, with its thresholds, its results and its date].
• Exceptions: [Systems tested by their vendor, not by you].
• Note: Tested against prior defined metrics and probabilistic thresholds, as appropriate throughout development and in any event before it is placed on the market or put into service. Applies only to high-risk systems: for any other system the status is Not applicable, with the classification as the reason.
• Also asked as: How do you test your AI before release? / How do you measure accuracy?

Provision: Article 9(6) and (8); Article 15(1)

How do you protect the AI against attacks?

• Direct answer: [Yes / Partly / Not applicable], for [systems].
• Control: [The measures against attacks on the data, the model and its inputs].
• Scope: [The systems they cover].
• Evidence: [The security assessment or test, with its date].
• Exceptions: [Attacks you do not yet test for].
• Note: Names, where appropriate, measures against data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and model flaws. The Act does not use the term prompt injection. Applies only to high-risk systems: for any other system the status is Not applicable, with the classification as the reason.
• Also asked as: How do you handle prompt injection? / How robust is the system to errors and unexpected input?

Provision: Article 15(5)

Do you monitor AI in use and act on problems?

• Direct answer: [Yes / Partly / Not applicable], for [systems].
• Control: [Who monitors, what triggers action and who is told].
• Scope: [The high-risk systems you deploy].
• Evidence: [The monitoring record and one handled case, with its date].
• Exceptions: [Systems not monitored yet].
• Note: Reason to consider that use in accordance with the instructions may result in a risk within the meaning of Article 79(1) means informing the provider or distributor and the market surveillance authority without undue delay, and suspending use; a serious incident means immediately informing first the provider, and then the importer or distributor and the market surveillance authorities. Applies only to high-risk systems: for any other system the status is Not applicable, with the classification as the reason.
• Also asked as: Who monitors the AI system in operation? / How do you monitor performance after release? / Who do you notify about a serious incident with an AI system?

Provision: Article 26(5)

Which AI providers and models do you rely on?

• Direct answer: [The providers and models], for [features].
• Control: [How a provider or model is approved, and how a change is announced].
• Scope: [All features that call a model].
• Evidence: [The list of providers and models, with the date it was last checked].
• Exceptions: [Providers under review].
• Note: In part an AI Act question. If you integrate a general-purpose model into your own AI system, its provider owes you information on its capabilities and limitations, unless Article 53(2) exempts an open-source model without systemic risk.
• Also asked as: Which third-party AI models or services does your product use? / Is the AI model hosted by you or by a third party?

Provision: Article 53(1), point (b)

The same work, in the app

Upload a customer's questionnaire to Audits and Complipath reads each question on its own server, matches it to your register and files and marks it Ready, Needs proof or Gap; an answer is Ready only once a person has confirmed it with proof behind it. Audit room.

The provisions it names

Article 4(1), as replaced by Regulation (EU) 2026/1744; Article 5; Article 6; Article 9(6) and (8); Article 10; Article 12(1); Article 13(1) and (2); Article 14(1); Article 15(1) and (5); Article 17(1); Article 26(2), (5) and (6); Article 50; Article 53(1), point (b); Article 53(2); Article 111(4), added by Regulation (EU) 2026/1744; Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744; Annex I; Annex III. Each is in Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.