How to respond to an AI governance due-diligence questionnaire

Why you are getting these questionnaires

The organisation asking has its own accountability. ISO/IEC 42001 asks organisations to manage the AI-related risks of their suppliers, the NIST AI RMF treats third-party AI risk as part of governing AI, and the EU AI Act puts duties on deployers, the organisations using an AI system, that depend on what their providers, the organisations supplying it, tell them. Your customer has to understand your AI to answer for their own, and a questionnaire is how they do that at scale. The quality of your answer feeds their decision to proceed, and a vague answer reads as an absent control, not a busy respondent.

What the customer is really deciding

An enterprise customer is deciding whether your AI is safe to depend on, or whether it will become their risk. A board wants a summary it can act on and a regulator wants the records in detail. A customer sits between the two. It wants confirmation that you know what AI you run, that you assess and own its risk, that you handle incidents and that you can show all of it, usually in the shape of its own questionnaire. A questionnaire answered in prose is a set of claims. A questionnaire answered with dated, attributed records is a set of facts, and that is the difference the reader is looking for.

What the questions are really asking

Behind the wording, most AI governance questionnaires test the same small set of things. They ask whether you know what AI you run, whether each system has an owner, whether you assess and monitor risk, whether a person can intervene, whether you keep records and whether you can show any of it. Those map closely to ISO/IEC 42001 and the NIST AI RMF, so a respondent who has the governance in place is answering questions they already hold the evidence for. A respondent who does not has to write around what is missing, and a careful reader can tell.

Step 1: Answer from records, not intentions

The difference between a strong answer and a weak one is usually tense. “Each AI system has a named owner and a recorded risk decision” is a statement you can back. “We are putting owners in place across our AI systems” is a plan, and a due-diligence reader discounts plans. Answer from what is true and recorded today, and where something is genuinely in progress, say what is done and what is not rather than blurring the two. A reader trusts a precise partial answer more than a confident vague one.

Step 2: Map your answers to a recognised standard

An answer that measures your governance against your own preference asks the reader to accept your judgement of what is enough. An answer that maps to ISO/IEC 42001 or the NIST AI Risk Management Framework measures it against a reference the reader already recognises. Naming the standard you align to, and answering in its terms, does two things. It shortens the reader’s assessment, because they can slot your answer into a framework they know. It also signals that your governance was built to an external bar rather than assembled for the questionnaire.

Step 3: Give evidence the reader can check

The strongest answer points to evidence rather than describing it. A reader weighing your response would rather see the impact assessment itself, dated and attributed, than a paragraph asserting that assessments happen. Where you can, attach or offer records the reader can confirm have not changed since they were captured. Evidence a third party can check is worth far more than a summary in the response document, and it is the difference between passing due diligence and merely completing it.

Step 4: Be precise about what you do and do not do

A due-diligence reader is professionally alert to answers that claim more than the control delivers. If you monitor a system quarterly, say quarterly, not continuously. If a person approves high-consequence actions but not routine ones, describe the line rather than implying every action is reviewed. Overstating a control is the fastest way to lose a careful reader, because the moment one answer is caught reaching, every other answer is reread with suspicion. Precise scope is more persuasive than broad reassurance.

Step 5: Keep a reusable evidence set current

These questionnaires arrive repeatedly, from different customers, in different formats, asking the same underlying questions. Answering each from scratch is slow and drifts out of date, so keep a current set of answers and the evidence behind them, and update it when your governance changes rather than when the next questionnaire lands. A maintained evidence set turns a fortnight of scrambling into an afternoon of mapping, and it keeps every response consistent with the last one you sent. A public page setting out the AI you use and the commitments you make can answer a share of the questions before they are asked.

Common mistakes

• Answering in the future tense about controls that are not yet in place.
• Describing evidence instead of pointing to it.
• Claiming continuous or complete coverage the control does not actually deliver.
• Rebuilding the whole response from scratch each time one arrives.
• Leaving the answers unmapped to any standard the reader recognises.

Where Aicura fits

The questions repeat from customer to customer, and Aicura keeps the material for each one in a single place. The AI register answers what you run and who owns it, with all three owner roles and their history. Risk and impact assessments answer how you assess risk, and Risks and Controls shows each control as applicable, implemented and tested, so you can state scope precisely instead of claiming coverage. Guardrails, monitoring and Incidents answer what runs, how often and what you did when something went wrong.

At Pro, the Trust Centre publishes a public page about the AI you use and the commitments you make, drawn from the register, which answers a share of the questions before they arrive. Reports and evidence packs give a customer the underlying material rather than summaries pasted into a spreadsheet. You still write the response, decide what to disclose and sign it.

Sources

• ISO/IEC 42001:2023, AI management system, International Organization for Standardization, iso.org
• AI Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology, nist.gov/itl/ai-risk-management-framework
• Regulation (EU) 2024/1689 (EU AI Act), eur-lex.europa.eu

A note on this page

This guide is general information on how to respond to an AI governance due-diligence questionnaire against current international guidance. It is not legal advice and it does not tell you what a particular customer or contract requires you to disclose. For how the guidance applies to your organisation, read the primary sources above and take your own professional advice.