Every AI vendor questionnaire answered from your system cards and AI policies, cited and signed
Every customer hears the same, cited answer on training, data location and EU AI Act role.
See one case, screen by screen ↓AI Questionnaire Response answers customers' AI-use questionnaires from your AI policies and model records, each answer cited. Eight agents read any AI vendor questionnaire, work out which AI features this customer uses, draft every answer from the matching system card field and policy clause, and check it against the latest release and what other customers were told. Privacy counsel decides promises and the AI governance lead signs.
How to choose AI solutions for back-office and enterprise work →
Updated
More and more customers add an AI section to their supplier reviews, or send a separate AI questionnaire. They ask whether you train on their data, where the models run, who the sub-processors are, what your role is under the EU AI Act and who oversees the outputs. The answers sit on system cards, in the AI Use Policy, in the AI addendum and in a legal memo on your role, so the sales engineer copies last year's answer instead.
That is where it goes wrong. A model is retrained and its system card still describes the old version. A provider adds a failover region and two customers have already been told “EU only”. One customer was told you are a deployer when the role assessment says provider. And a quick “yes” to 90 days' notice of model changes, in a questionnaire annexed to the contract, can outrank the 30 days in your addendum. Most EU AI Act duties applied from 2 Aug 2026, so customers ask more, and expect the answer to hold.
Estimated split for a typical customer AI questionnaire of about 100 questions, by hand and with the solution.
Eight agents read, scope, draft, check and route every question; the AI governance lead signs only what is new, changed or a promise.
Calder Rail Networks, a rail-infrastructure operator, sends Kestrel & Vane Group its Supplier AI Due Diligence Questionnaire — EU AI Act, v3: 96 questions in an Excel workbook, due 23 Oct, holding up a €3.8M renewal. Here is what happens next, screen by screen, in the working solution.
Maya's home is a conversation, not a hunt. The drafting agent reports that Calder is drafted: 76 of 96 answers are cited, current and consistent; 20 need people — 9 checks, 4 told differently, 3 promises and 4 with no source. The register checker has held 8 answers on an out-of-date card, and the consistency agent has found two customers told “EU only”. Each message carries its next step: open the answers, ask Ravi to re-attest, review the difference.
She can ask too. “What is still blocking Calder?” — “Calder still needs: 9 checks (8 wait on the Fault Predictor card), 4 told differently, 3 promises with Hannah Lindqvist and 4 with no source, due back 16 Oct. 76 are ready for you to approve.”
Luca Brenner forwarded the workbook at 16:05. The questionnaire reader found 96 questions in 8 sections and mapped the answer cells in columns E and F. The scoping agent read Calder's order form: 3 of the 6 customer-facing AI features are in scope — Summarizer, Service Assistant and Fault Predictor. By 16:31 the drafting agent had drafted 92 answers with 241 citations and sent the 4 with no source to their owners. The same steps run on every new file, as they did for Saltire Water's 51-question workbook.
The scoping agent never answers for a feature the customer has not licensed.
“Is Calder's data used to train, fine-tune or improve any model, yours or a provider's?” The draft says no, with 4 sources and confidence 0.97. On the right is the Summarizer v2 system card with its Customer data use field highlighted and labelled “answers B-03”: “No training on customer data. Inference only; zero retention at the provider.” 23 customers were given the same answer, and a chip reads “Fields unchanged in 4.2”: the Fault Predictor card is out of date, but the new release did not change the field this answer uses, so the register checker did not hold it.
The drafting agent's rule: no source, no sentence.
Citation 1 opens AI Use Policy v3.2 §3.1, owner Maya Rao, with the sentence highlighted: customer data is never used to train, fine-tune or evaluate any model unless the customer has opted in in writing for a named purpose. Under the answer, the agents' thread shows who drafted it, who checked the cards and who compared it with past answers. Maya asks “Why this confidence?” and the drafting agent answers with its sources.
“Confidence 0.97: 4 sources agree and none contradict it; 23 customers were given the same answer.”
Only answers that pass every check go into the review: each cites a card field, policy or contract clause, confidence is 0.85 or higher, every card field behind it is current, it is the same as, or new to, what other customers were told, and none is a promise. Maya reads a sample and ticks “I have read the sample and approve all 76”. The other 20 stay with the person who decides them.
The Fault Predictor card describes v4 and was last reviewed on 14 Jul 2025. Release 4.2 went live on 22 Sep 2026, trained on telemetry from 17 opted-in customers, not 14, with recall 0.91 and precision 0.84 instead of 0.88 and 0.81. The register checker shows the field-by-field difference and asks Ravi Menon to re-attest. Once he does, the 8 Calder answers are redrafted from the current card and come back for review.
The register checker never edits a card; it asks the owner to re-attest.
The consistency agent compared the 96 drafts with 2,140 past answers and found 4 that differ. On C-07, where model inputs are processed: Merrow Foods Group and Saltire Water were told “EU only”, but since 18 Aug 2026 Service Assistant can fail over to US-Virginia during an EU outage, under EU SCCs. It proposes the policy answer for Calder and drafts correction notes to both customers, for privacy counsel to approve.
The consistency agent never sends a correction; privacy counsel approves.
The commitment guard flagged 3 answers as promises and matched each against the Standard AI Addendum and Calder's MSA. On H-03, Calder asks for 90 days' notice of any material model change; the addendum gives 30. Hannah sees three options with what each means — hold to 30 days, offer 60 for model changes only, or agree to 90 — and decides with a reason code. She holds H-03 to 30 days, commits to B-15 in the policy's words, and declines H-07 because the MSA governs.
Only privacy counsel can decide a promise. Viewing as Maya, the decision is locked.
E-09 asks for Fault Predictor's false-negative rate on rail switch and point machines. The card gives overall recall only, so the drafting agent wrote nothing and asked Ravi, on a 3-working-day clock that ends Fri 16 Oct. He answers from the 2025–26 held-out faults — 38 missed of 412, a false-negative rate of 9.2% — and ticks “Add it to the register as a new field”, so the next customer's question has a source.
The sign-off packet lists 76 unchanged answers, given to other customers in the last 180 days, attested in one step; 17 new, changed or promises listed one by one; and 3 to follow by 16 Oct, each with an owner. Maya attests, re-authenticates with single sign-on and signs 93 answers; version 1 is locked. The return writer fills Calder's workbook and re-reads it: 192 answer cells written, 0 other cells changed. Luca sends it, about 18 hours after the workbook arrived.
The return writer never submits a portal form, and nothing unsigned leaves.
The same questionnaire, seen by the five people who carry it — what their week looked like, and what it looks like now.
Eight agents read, scope, draft, check and route every question; the AI governance lead signs only what is new, changed or a promise.
Reads the customer's Excel, Word or PDF file, portal page or email and finds every question, its section, the cell or field where the answer goes and limits such as Yes/No or 1,000 characters.
Works out which AI features this customer has switched on, from the order form and the CRM account, and marks every other feature out of scope.
Drafts each answer from the system card fields and policy clauses, cites every sentence and states its confidence.
Checks the system cards behind each answer against release records, deployments and the sub-processor list before an answer is used.
Compares each draft with what every other customer was told and with the policy in force, proposes one answer and drafts correction notes.
Finds answers that would be promises — notice periods, training bans, incident hours, audit rights, data locations, indemnities — and matches them against the Standard AI Addendum and the MSA.
Writes the signed answers into the customer's file or portal, re-reads it and proves only the answer cells changed, and attaches the evidence the NDA allows.
Writes the quarterly report on AI questionnaires — volume, turnaround and what customers ask about — with citations.
Approves and signs. The agents propose; a named person decides.
Ask across every questionnaire in plain words, or tell the agents what to do. Each decision screen ends with a box to ask the agent behind it — why it held an answer, who else could answer, what a clause change would touch. Every answer cites its source, and an instruction goes to the person who decides, never acted on unseen.
Do we train on Calder's data?
No. Customer data is never used to train, fine-tune or evaluate any model without written opt-in (AI Use Policy §3.1). Summarizer v2 and Service Assistant run with zero retention at the model provider, and Calder has not opted in to telemetry sharing (MSA Schedule 3 §2). 23 customers have been given this answer since 1 Mar 2026.
Which customers were told model inputs stay in the EU?
Two: Merrow Foods Group (9 Jun 2026) and Saltire Water (2 Jul 2026) were told “EU only”. Since 18 Aug 2026 Service Assistant can fail over to US-Virginia during an EU outage, and policy says that must be disclosed. Correction notes for both are drafted.
What is still blocking Calder?
Calder still needs: 9 checks (8 wait on the Fault Predictor card), 4 told differently, 3 promises with Hannah Lindqvist and 4 with no source, due back 16 Oct. 76 are ready for you to approve.
Re-check open questionnaires against the new sub-processor list
Done. I re-checked 5 open questionnaires (316 answers) against the sub-processor list of 18 Aug 2026. 3 answers in 2 questionnaires mention data location: Calder C-07 (already flagged), Halberd D-02 and Quillon C-04. I held the two new ones for review and told Noor Haddad and Luca Brenner.
13 screens from the working solution, on its sample data. Pick one to see it large.
What the agents may settle on their own, and what always goes to a person, are settings — each change logged.
| Setting | Default | Choose from |
|---|---|---|
| Confidence floor | 0.85 | Step up or down, 0.01 at a time, with a preview of how many answers would move to “Needs a check” |
| Card-age limit | 12 months | 12 months · 6 months |
| Re-sign limit | 180 days | 180 days · 90 days · 365 days |
| No-source clock | 3 working days | 3 working days · 2 working days · 5 working days |
| Topics that are promises | All six on | Notice periods for changes · Bans on training or use of data · Incident notification hours · Audit rights · Data locations and transfers · Indemnities and liability |
| Reasons for a promise decision | Chosen by privacy counsel | Within the contract · Precedent approved by the General Counsel · Commercial decision · Beyond policy, approved by the AI Council |
| Notifications | Due in 3 days, clock with 1 day left, card out of date, promise waiting | Email · chat · daily digest |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (iso42k directory: 19 publicly announced ISO/IEC 42001 certifications in 2024, 87 in 2025 and 113 in 2026 to 11 Oct, a floor; EU AI Act implementation timeline — most duties from 2 Aug 2026). People, companies, AI features and documents named on this page are fictional — characters and sample data in the working solution.
AI Questionnaire Response answers customers' AI-use questionnaires from your AI policies and model records, each answer cited. Eight agents read any AI vendor questionnaire, work out which AI features this customer uses, draft every answer from the matching system card field and policy clause, and check it against the latest release and what other customers were told. Privacy counsel decides promises and the AI governance lead signs.
The questionnaire reader finds every question and answer cell in the customer's Excel, Word, PDF, portal or email. The scoping agent reads the order form to see which AI features are switched on, and the drafting agent answers only for those, citing the system card field and policy clause behind every sentence. Each answer shows beside the card field that answers it.
Role questions — provider, deployer or general-purpose model provider — are answered from your EU AI Act role assessment and cited to it. If another customer was told something different, the consistency agent shows both answers, says which one the assessment supports and drafts a correction note for privacy counsel to approve.
The register checker compares each system card with its release records, deployments and the sub-processor list. If the card is older than the release, it holds every answer that relies on it and asks the card owner to re-attest the changed fields, with a field-by-field difference. The answers are then redrafted and come back for review.
Not without privacy counsel. The commitment guard matches answers about notice periods, training bans, incident hours, audit rights, data locations and indemnities against your AI addendum and MSA. Anything that would promise more goes to counsel with the options and what each means; only counsel can decide, with a reason code.
Yes. After sign-off, the return writer writes the answers into the customer's workbook or portal, re-reads the file and proves that only the answer cells changed. It attaches public evidence such as the ISO/IEC 42001 certificate and the sub-processor list, adds confidential documents such as impact assessment summaries only when an NDA is on file, and never presses Submit on a portal.
Yes. The agents never approve, sign, send or edit a system card or a policy. The AI governance lead approves every answer and e-signs the questionnaire, privacy counsel decides promises and approves corrections, and every agent step and human decision is on an audit trail that cannot be edited.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your model register, AI policies, AI addendum and a sample of past questionnaires — and it goes live once every quality gate has passed. We will walk you through it on your own questionnaires first.
Questionnaires back in days, not weeks, and every answer matches what customers were told.
1-min demoRFP Response AutomationHigher win rate, no promise you can't keep, and the bid in on time.
1-min demoDue Diligence Questionnaire (DDQ) ResponseEvery DDQ answered from approved sources, and no investor told two different stories.
1-min demoWe'll run AI Questionnaire Response on a sample of your own past AI questionnaires.