The AI questions on security questionnaires, and how to answer them honestly

Somewhere in the middle of this year’s customer security questionnaire, between the encryption section and the vendor management section, a new block appeared. Does your organization permit the use of generative AI tools? Which ones? What data may employees provide to them? Is there a written policy? How is it enforced?

Cyber insurance applications are growing the same section. So are the due diligence checklists that show up when a buyer or a sponsor starts looking at a company. The questions arrived faster than most small and mid-sized businesses wrote anything down, which produces a specific, awkward moment: the person filling out the questionnaire knows the honest answer is “people use whatever they want and we have never discussed it,” and they know that answer cannot go in the box.

What goes in the box instead is usually a hopeful “No” to the AI usage question. That answer is almost certainly false, as we laid out in your team is already pasting company data into AI tools, and false answers on security questionnaires age badly. On an insurance application they can surface during claims review, exactly when you need the policy to pay. On a customer questionnaire they become a misrepresentation discovered during an audit or an incident, which costs more trust than any honest gap would have.

What the askers actually want

Nobody sending these questionnaires expects a 40-person company to have an AI governance board. The questions test something simpler: whether management knows what its own people are doing with company data. The pattern behind every version of the AI block:

• Awareness. Do you know AI tools are in use, or are you pretending otherwise?
• Sanction. Have you chosen approved tools on business terms, rather than leaving everyone on free personal accounts?
• Data rules. Is there a stated line about what may and may not go into a prompt?
• A document. Is any of this written down where an employee could find it?
• Awareness training. Has anyone told the staff, at least once, in a form you can prove?

Answer those 5 honestly and well and you will satisfy essentially every AI section currently in circulation. Notice what is absent: nobody asks whether you use AI. Using it is assumed. The question is whether the use is governed.

The 4 sentences that close the section

For a company that has done the modest groundwork, the entire AI block collapses into answers of this shape:

1. “Employees may use approved AI tools under our written acceptable use policy, last reviewed [date].”
2. “The approved tools run on business-tier accounts under terms that exclude our data from model training.”
3. “The policy defines data classes that may never be entered into AI tools, including customer data, employee personal information and credentials.”
4. “The policy is covered in onboarding and in our recurring security awareness training, and completion is tracked.”

Every sentence is checkable, none of them oversells and together they read like a company that runs its shop. That reading carries over to the rest of the questionnaire, because reviewers calibrate their skepticism early. The mechanics of getting there, picking the sanctioned tool, writing the 1-page policy, teaching the 3 data classes, are the same 2-week project we described in the AI tools post. This post is about what that project buys you when the paperwork arrives.

The insurance angle is sharper than the customer angle

Customer questionnaires mostly want reassurance. Insurance applications create obligations. When an application asks whether you have an AI acceptable use policy and you check yes, that answer becomes part of the record the carrier can revisit if a claim involves, say, an employee pasting the customer database into a free chatbot. The safe posture is the boring one: answer what is true on the day you sign, and if the true answer is no, spend the 2 weeks making it yes before renewal rather than after. The same discipline applies across the whole application, as we covered in the 25 questions you’ll fail on your next renewal, and AI is simply the newest page of it.

One more place the question now appears: diligence. Buyers and sponsors have added AI usage to the IT section of their checklists, right beside shadow IT and data handling. A written policy with a review date is a 30-second diligence answer. Its absence is a finding in a report your valuation does not need.

If the honest answer today is “we have nothing”

Do not write the aspirational answer. Write the truthful one with a date attached: “AI usage policy is in development, with adoption scheduled for [month].” Reviewers accept in-progress answers with dates far more readily than they forgive discovered fiction. Then actually do it, in this order:

• Week 1: pick the sanctioned tool, buy the business tier, license the people already using AI
• Week 2: write the 1-page policy, 3 data classes, named tool, personal accounts excluded
• Week 3: one 10-minute training slot, attendance recorded, policy linked in the handbook
• Then: put a quarterly 30-minute review on the calendar, because the tools and the terms will not sit still

That sequence turns next quarter’s questionnaire from an exposure into a strength, and it is genuinely one of the cheapest wins available on the entire compliance surface. The wider walkthrough of handling a customer questionnaire without a fire drill is in our questionnaire guide.

Atticus Rowan writes these policies with clients, wires the approved tools into Microsoft 365 and keeps the questionnaire answers current as the tools change. If the AI section of something on your desk is staring back at you right now, start a conversation and we will make the honest answer a good one.