Answer "Does your product use AI?" with a yes or no, then a short inventory: which features call a model, which provider hosts it, what customer data reaches it, whether it is retained or used for training, and who approves changes. A bare "yes" invites a long follow-up round.
Why reviewers ask this first
The AI question is a gate. A "no" usually skips a whole section of the questionnaire. A "yes" opens questions about data flows, model providers and agent permissions. Reviewers are not trying to catch you out. They need to know whether a new third party now sees their data.
That means the answer has to be accurate even when it is inconvenient. If a support widget, a code review helper or a search feature calls a hosted model, the honest answer is yes.
Build the inventory before you answer
Walk the product and the engineering workflow separately. Customer-facing features come first, then internal tools that touch customer data.
| Question | What to record |
|---|---|
| Which feature uses a model? | Feature name and owner |
| Where does the model run? | Your infrastructure or a provider |
| What goes in? | Data classes, such as account metadata or document text |
| What comes back and who sees it? | Customer, employee or another system |
| Is data retained or used for training? | The term in the provider agreement, with a date |
| Can the model take actions? | Tools, APIs and the permissions behind them |
If you cannot fill a cell, write "to be confirmed" and go find out. Do not guess in a document a customer will rely on.
An answer shape that works
Lead with the fact, then scope, then control. For example: "Yes. Two features use hosted language models: in-app search summaries and a support drafting tool. Customer document text is sent to the provider under a data processing agreement that excludes training use. Model calls are logged, and new AI features go through our change review before release."
Every sentence there is checkable. Offer the data flow diagram and the provider terms as attachments rather than pasting them.
What not to say
Avoid absolutes such as "no customer data ever reaches a model" unless you have tested it. Avoid marketing phrases like "enterprise grade AI". And do not describe an AI feature as audited or certified unless an independent party has actually said so in a report you can share.
If the feature is new, say so. "Released in September, covered by the policy dated 1 October" is a better answer than silence about timing.
Keep the answer from drifting
AI features change faster than annual questionnaire cycles. Store the inventory next to your other questionnaire answers, give it an owner and a review date, and update it when a feature ships. Several other posts in this series cover related answers, including how to keep answers consistent with a claims register and what to include for AI vendors in procurement.
Safeguard can help with the inventory side. Asset discovery and SBOM and dependency scanning show which AI related packages and services sit in your code, and compliance and evidence automation keeps the supporting records together. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Can I answer no if we only use AI internally?
Only if the question is about the product. If the form asks about your company or development process, internal AI tools count, especially when they touch customer data or code.
Do I need to name the model provider?
Usually yes. Reviewers treat the provider as a third party, so naming it and linking the data terms saves a round of questions.
Last reviewed: 19 October 2026.
