Enterprise buyers ask an AI startup the usual questions about access, encryption, and incident response, plus a short AI specific set: where prompts and customer data go, whether data trains models, how agents are limited, and how models and packages are sourced. Having a written answer and one piece of evidence for each saves weeks.
The usual questions still come first
Expect the standard review: who can access production, how data is encrypted, how vulnerabilities are handled, how incidents are reported, and whether an independent report such as SOC 2 exists. If your audit is still in progress, say so plainly and do not describe it as complete.
The AI specific questions
OWASP's 2025 list of risks for LLM applications is a useful map of what a careful reviewer worries about: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. Buyers rarely quote the list, but their questions follow it.
| Question you will hear | Evidence worth having |
|---|---|
| Where do prompts and outputs go, and who are the subprocessors? | A subprocessor list and a data flow diagram |
| Is our data used to train models? | A written statement and the matching contract clause |
| How are agent actions limited? | Tool allowlists, approval steps, scoped credentials |
| How do you keep one customer's data from another's? | Tenant isolation tests |
| Where do models and packages come from? | An inventory (SBOM) and a model source policy |
| What stops runaway spend or abuse? | Rate limits and per user caps |
| What do you log, and for how long? | A logging and retention summary |
How to answer well
Answer the question asked, in two or three sentences, then name the evidence. Avoid adjectives. "Tool calls are limited to an allowlist and high impact actions need human approval" beats "our agents are secure."
Keep a single library of approved answers so sales, engineering, and founders say the same thing. When an answer is "not yet", add the date you plan to close the gap only if you will keep it.
Reference frameworks buyers recognise
NIST published the AI Risk Management Framework 1.0 in January 2023 and a Generative AI Profile in July 2024. Both are voluntary. Mapping your controls to them gives reviewers a familiar structure, but do not claim conformance or certification against them.
A short note on Safeguard
Safeguard offers SBOM generation, compliance and evidence automation, and policy gates that help produce the artifacts above. Try a free scan at gold.safeguard.sh/scan.
Quick check
Can we answer questionnaires without a SOC 2 report?
Yes. Give specific, true statements about controls you operate today, state the audit status honestly, and offer evidence. See how to answer before a SOC 2 Type 1 arrives.
Should we cite OWASP or NIST in answers?
You can say you used them as a reference. Do not imply certification or formal conformance.
Sources
Last reviewed: 19 October 2026.
