Do you have an AI use policy?
A ai question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. Staff and product use of AI follows a written policy that lists approved tools and says what data may be used with them. Customer data may only be used with [approved tools under business terms].
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- The AI use policy
- The list of approved AI tools
If you don't do this yet
A one-page policy listing approved tools and banning customer data elsewhere is a reasonable start, and easy to share.
Related questions
Is our data used to train AI models?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.