How to Answer AI Questions in an RFP

§1Do you use artificial intelligence?

Avoid yes-or-no answers without context. List the relevant use cases and say what AI does not do. Include embedded features when they affect the client service.

A strong answer is bounded and testable. It does not call ordinary automation AI merely to sound current, and it does not hide assisted drafting because AI does not make the final decision.

Sample languageYes. We use approved AI tools for limited internal assistance such as drafting, summarization, and research. AI does not make final decisions about your users, and we do not use your confidential information in an AI system unless that system and use are specifically approved in writing.

§2Do you have an AI governance policy?

Name the policy, scope, owner, and review cadence. Say when it was last approved if requested. Do not answer with principles alone.

Attach or summarize the relevant portions if the policy is confidential. Keep a version history and proof of rollout so “documented” means more than a file in a folder.

Sample languageYes. Our AI acceptable-use policy applies to employees and contractors, covers approved tools, restricted data, human review, disclosure, vendor approval, security, incidents, and sensitive decisions, and is reviewed at least annually.

§3Is our data used to train models?

Distinguish your own conduct from the vendor’s contractual behavior. “We do not train models” may be technically true while a third-party service retains inputs for improvement.

Check the specific product tier and settings. Consumer and business versions of the same service may have different terms. Preserve the terms or vendor evidence used for your answer.

Sample languageWe do not use client data to train our own models. Client data may enter a third-party AI service only when the service is approved for that data and its applicable terms prohibit model training on our inputs, unless you expressly agree otherwise.

§4What data can enter AI systems?

Describe categories and exceptions. A blanket “no personal data” claim can be false if a transcription tool processes names or voices. A better answer names restricted data and the approved path for a necessary use.

Include deletion, retention, access, and residency where those matter to the buyer.

Sample languageOur policy prohibits entering client-confidential, personal, privileged, credential, payment, health, and other restricted information into general-purpose AI tools. Exceptions require a documented vendor and use-case review.

§5How do you review AI output?

Explain who reviews, what they check, and before what event. “Human in the loop” is an aspiration, not a control.

Match review to consequence. For client-facing factual work, reviewers check source material, calculations, citations, confidentiality, rights, and suitability. For code, use ordinary testing, review, and security processes.

Sample languageA qualified person reviews AI-assisted client work before delivery and remains accountable for it. Review includes factual accuracy, source support, confidentiality, rights, safety, bias where relevant, and fit for the agreed purpose.

§6How do you assess AI vendors?

Name the categories: data use, training, retention, security, subprocessors, access, intellectual property, incident notice, location, deletion, and exit. Explain who approves the vendor.

A completed checklist or decision record is useful evidence. Marketing pages alone are weak evidence for contractual claims.

Sample languageBefore approval, the policy owner reviews the vendor’s data-use and training terms, retention and deletion, security, subprocessors, access controls, intellectual-property terms, incident process, and service exit options.

§7Do you conduct AI risk assessments?

If you use a simple assessment, say so and describe its triggers. Do not imply a formal impact assessment for every autocomplete suggestion.

Assess higher-consequence uses before deployment: the purpose, affected people, data, error impact, bias, oversight, vendor dependency, security, legal duties, and alternatives.

Sample languageWe screen AI uses by data sensitivity and potential consequence. Uses affecting people, legal rights, regulated services, or material client decisions require a documented assessment and approval before use.

§8How do you manage incidents?

Connect AI incidents to the existing security or quality process rather than inventing a parallel system. Include accidental disclosure, harmful or misleading output, unauthorized tools, vendor changes, and unexpected automation.

State the reporting channel, owner, containment steps, client notice process, and lessons-learned review. Do not promise a notification deadline unless contracts and operations support it.

Sample languageSuspected AI-related disclosure, harmful output, unauthorized use, or control failure enters our incident process for containment, assessment, contractual or legal notification, remediation, and documented follow-up.

§9Are you compliant with the EU AI Act or ISO 42001?

Avoid an unqualified yes. The EU AI Act applies by role, system, use, and timing. ISO/IEC 42001 certification requires an accredited audit; alignment is not certification.

State the narrower truth: you have mapped relevant controls, assessed whether a use may fall into a regulated category, or align selected practices with the standard. Get counsel for a legal applicability statement.

Sample languageWe are not ISO/IEC 42001 certified. Our governance approach draws on relevant management-system practices, including ownership, inventory, risk review, documented controls, training, incidents, and periodic improvement.

§10What evidence should accompany the answer?

Offer a policy summary, approved-tool register excerpt, vendor review record, training record, risk assessment, incident procedure, or contract term as appropriate. Remove unrelated confidential details.

Keep an answer library with an owner and review date. Re-check it for each RFP; stale assurance language is a quiet source of misrepresentation.

• Policy name, owner, version, and approval date.
• Scoped tool and use-case inventory.
• Vendor decision records and relevant contract terms.
• Training attendance or acknowledgement.
• Risk assessment and incident templates.

§11Use a consistent answer formula

Write each answer in four parts: scope, current control, evidence, and exception or limitation. This reads more credibly than a page of broad assurances.

For example: “For tools used in delivery to your organization [scope], company accounts and approved use cases are required [control]. We maintain an approved-tool register and review records [evidence]. We do not currently operate a proprietary model or make automated eligibility decisions [limitation].”

§12Review the completed response before it leaves

Give the AI section to the people who own delivery, security, privacy, and the commercial promise—even if that is only two people wearing several hats. Ask whether every statement is true for the service being sold, not merely true somewhere in the company. Check attachments, linked policies, and contractual schedules for contradictory language.

Look especially for absolute words: never, always, all, none, fully, continuous, compliant, and certified. They are sometimes correct, but they need strong evidence and a precise scope. Replace an unsupported absolute with a control you can demonstrate. “All outputs are verified” might become “A qualified employee reviews AI-assisted client deliverables before release under our documented quality process.”

Record the final response, buyer, scope, approver, and date. Feed any new commitment into the policy, vendor register, training, and delivery plan. Otherwise the sales answer becomes an orphan promise that the operating team does not know it made.

Finally, set an expiry for reusable answers. Vendor terms, product features, laws, and your own tools change. A response library is helpful only when every answer has an owner and a next-review date.

§13Push back on impossible questions

Some forms demand a yes where the truthful answer depends on scope, or ask a small service supplier for controls that belong to a model developer. Add a note, request clarification, or attach a scoped response. Silence is usually worse than a concise explanation of why the question does not fit.

If the buyer requires a control you cannot meet, involve the commercial owner before promising remediation. State the gap, compensating control, owner, and feasible date only when the work has been approved. A future-tense answer is a commitment, not decorative reassurance.

§14Frequently asked questions