Answer the Enterprise Security Questionnaire for Your AI Feature

What you need to know

The spreadsheet arrives on a Tuesday: 140 rows, a column headed "Vendor response", a column headed "Evidence", and a procurement contact who would like it back by Friday. You are a team of six in Pune or Manchester, your product is a retrieval-backed assistant on top of a frontier model API, and the buyer is a bank, an NHS trust, a council or a listed company whose security function has done this a thousand times. Nothing in the questionnaire is about your model's benchmark score. All of it is about where the buyer's data goes, who can see it, how long it lives, and what happens when something breaks.

The good news is that these questionnaires barely change from year to year. They were written for SaaS vendors a decade ago and have had an AI section bolted on since 2023; answer one properly and you have answered most of the next twenty. The bad news is that the AI section is where small vendors lose deals, because it asks four things a team focused on shipping has usually never written down: the exact path a request takes, whether the model provider is a sub-processor, whether anyone trains on the buyer's data, and which country the inference happens in.

This guide is for the vendor side. It covers the UK routes you will meet (NHS DTAC and the Data Security and Protection Toolkit, Cyber Essentials, and the supplier questionnaire behind frameworks such as G-Cloud) and the Indian ones (BFSI onboarding under the RBI's 2023 outsourcing direction, CERT-In's incident and log duties, and the DPDP Act). It is not legal advice; it is the engineering and evidence work that makes the legal conversation short.

The questionnaire anatomy: where the AI-specific questions hide

Most questionnaires are organised by control family, so the AI questions are scattered across ten clusters rather than gathered in one place. Reading them as clusters tells you what the reviewer is trying to establish, and which single piece of evidence closes several rows at once.

The clusters are the same in both markets; the emphasis differs. A UK public-sector or NHS questionnaire leans on the data-protection, clinical-safety and certification rows, and will ask for your DSPT status and Cyber Essentials certificate by name. An Indian bank or insurer's vendor-onboarding pack leans on residency, audit rights, sub-contracting and the incident clock, because the RBI direction makes the regulated entity accountable for all of those and it will push each obligation down into your contract. A listed company in either country tends to sit between the two and adds a business-continuity section that asks what happens if your model provider withdraws the model you depend on.

The first four clusters are all answered by the same underlying knowledge: exactly what your system does with a request. That is why the artefact in the next section comes before you open the spreadsheet.

Build the AI data-flow one-pager first

Before answering a single row, write down the request path with a region and a retention period against every hop. It should fit on one page, be true, and be the thing you paste into the evidence column for roughly a third of the questions. Keep it as plain text in the repository so it is diffed whenever the architecture changes.

AI DATA-FLOW ONE-PAGER   product: Contract Review Assistant   version 2026-09-14

[1] End user (buyer staff, browser)
      |  TLS 1.3 · SSO via buyer's IdP
      v
[2] App tier            region: eu-west-2 London / ap-south-1 Mumbai (per tenant)
      |  tenant ID + request ID attached; PII detector runs here
      |  stores: request metadata only · 90 days · same region
      v
[3] Retrieval store     region: same as app tier · per-tenant schema
      |  stores: document chunks + embeddings · for contract term · then deleted
      |  encryption: AES-256 at rest · tenant-scoped KMS key
      v
[4] LLM gateway         region: same as app tier
      |  strips secrets · enforces tool allow-list · pins model version
      |  stores: nothing durable (token counts and latency only)
      v
[5] Model API (SUB-PROCESSOR)   provider: [name] · endpoint: [gb.* / in.* / regional]
      |  retention mode configured: [ZDR | 30-day abuse monitoring]
      |  training on customer data: NO (provider terms, checked 2026-09-14)
      |  region of processing: [state it; never guess]
      v
[6] Response -> app tier -> user
      +--> [7] Logs   region: same as app tier · 180 days (CERT-In (iv), India)
                content: request ID, tenant, model, tokens, latency, error class
                prompt/response text: NOT logged

Backups: retrieval snapshots · 30 days · same region · same key.
Not in the path: no analytics vendor receives prompt text.

Three rules make this useful rather than decorative. Every hop names a region, not a continent. Every store names a retention period and what triggers deletion. And the model API hop states retention mode, training commitment and processing region as three separate lines, because they are three separate questions on the spreadsheet with three different answers depending on provider and deployment type.

If you already have a system card for the feature, the one-pager is its operational appendix. If not, the template in Write a System Card for Your AI Feature covers the intended-use, evaluation and limitation sections that the change-management cluster asks for next.

The sub-processor and training-data answers

Two rows sink more small vendors than any others: list your sub-processors, and do you train on customer data. The trap is answering from memory rather than from the provider's published terms. The fix is a table you maintain with the date you last checked each document. The following reflects each provider's commercial documentation as of September 2026; re-check on the day you submit, because these pages move.

So the training answer has a shape: two sentences, not one. The first is about you: your systems do not fine-tune, build evaluation sets or otherwise reuse the buyer's content for anything except serving the buyer. The second is about the provider: under the commercial terms you have accepted, dated and linked, it does not train on inputs or outputs. If you use production traces for prompt improvement or evaluation, describe that separately with the anonymisation step, rather than letting the reviewer find it in the retention section.

The sub-processor answer follows from the same table. The provider goes on the register with the region you call it in, the retention mode you have actually configured (not the one available), and the terms that govern it. Under UK GDPR a processor engaging another processor needs the controller's authorisation; under section 8(2) of India's DPDP Act a Data Fiduciary may involve a Data Processor "only under a valid contract", and that duty flows down through you. Buyers do not object to sub-processors. They object to finding one they were not told about.

Region and residency

The residency row is where "we use AWS in London" stops being enough. The reviewer wants to know where the model inference happens, which for a hosted API is a property of the provider's product, the endpoint you call and the deployment type you chose. As of September 2026 the published position looks like this.

Framing the law for each market

India. Do not write that the DPDP Act bans cross-border transfer; it does not. Section 16(1) of the Digital Personal Data Protection Act 2023 says the Central Government "may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified". That is a negative list: transfers are permitted unless a destination is restricted. Section 16(2) preserves any Indian law "that provides for a higher degree of protection", which is where sectoral localisation rules enter. The DPDP Rules are phased, with the main obligations landing by May 2027, so describe your current controls and roadmap rather than claiming compliance with a regime still coming into force.

For a bank, NBFC or other RBI-regulated buyer, the sharper document is the RBI Master Direction on Outsourcing of IT Services, in force since 1 October 2023. It requires the regulated entity's contract with you to specify "storage of data (as applicable to the concerned REs) only in India as per extant regulatory requirements", to grant audit and access rights to the entity and the RBI, to control sub-contracting, and to ensure incidents are reported "without undue delay, so that the incident is reported by the RE to the RBI within 6 hours of detection". Show you meet those clauses now, because they appear in the contract next.

United Kingdom. Sending personal data from the UK to a model API abroad is a restricted transfer under UK GDPR unless the destination is covered by UK adequacy regulations. The ICO's international transfers guidance sets out the tools: the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, both in force since 21 March 2022, with the old EU clauses no longer valid for UK transfers from 21 March 2024 (per Travers Smith's summary of the ICO timetable), plus a transfer risk assessment. Most providers' data-processing terms already incorporate one of these; name which, attach it, and make sure your own contract with the buyer matches. The ICO has said it plans to update both documents following the Data (Use and Access) Act 2025, so check the live page.

If the feature also serves EU users and falls under the EU AI Act's Article 50 transparency duties, in force since 2 August 2026, say so in the regulatory-mapping row; the detail is in the Article 50 implementation guide.

The evidence pack

Reviewers score evidence, not prose. "See attached" against sixty rows, pointing at nine documents that exist, beats sixty paragraphs of reassurance. Keep the pack in a shared folder with a version date on every file, in this order, because it is the order reviewers read.

evidence-pack/
  00-README.md                    index · version date · approver per document
  01-ai-data-flow-onepager.md     one per deployment region
  02-system-card.md               intended use · pinned model IDs · evals · upgrade policy
  03-subprocessor-register.csv    provider · region · retention mode · terms link · date checked
  04-retention-and-deletion.md    per-store retention · deletion runbook · last deletion evidence
  05-pen-test-summary.pdf         date · scope incl. prompt-injection cases · findings · fixes
  06-dpia-completed.md            UK GDPR DPIA; reusable for the buyer's own
  07-incident-runbook.md          clocks: CERT-In 6h · RBI 6h via the RE · UK GDPR 72h to ICO
                                  AI scenarios: injection exfiltration · model outage ·
                                  provider retention change · agent takes a wrong action
  08-access-and-secrets.md        role matrix · secrets manager · rotation · MFA · leavers
  09-continuity-and-fallback.md   gateway failover · degraded mode · provider exit
  10-certifications/              Cyber Essentials · ISO 27001 status · DSPT (NHS)
  11-regulatory-map.md            UK GDPR / DPDP / RBI / DTAC clause -> your control

Two of those clocks deserve context. India's CERT-In directions of 28 April 2022 require any service provider or body corporate to report listed incidents "within 6 hours of noticing such incidents", to keep ICT logs "for a rolling period of 180 days" within Indian jurisdiction, and to synchronise clocks to NIC or NPL time; Annexure I explicitly lists attacks on systems "related to Artificial Intelligence and Machine Learning". Your runbook should show the six-hour path exists and has been rehearsed.

For NHS work in England, the Digital Technology Assessment Criteria covers clinical safety, data protection, technical assurance, interoperability, and usability and accessibility. NHS England's 2026 refresh cut the form by 25 per cent and de-duplicated it against the Data Security and Protection Toolkit, with full transition by 6 April 2026. The DSPT is a self-assessment against the National Data Guardian's ten standards that "all organisations that have access to NHS patient data and systems must use". If your assistant touches patient data, a completed DSPT is the price of entry.

Minimum viable versus enterprise-grade

For the UK, the NCSC's Cyber Essentials is the cheapest credible start: five controls (firewalls, secure configuration, security update management, user access control, malware protection), independently verified, priced by organisation size from £320 plus VAT, with Cyber Essentials Plus adding hands-on testing. The NCSC notes that "a growing number of organisations require suppliers to be certified to bid for work", and public-sector buyers are the most consistent about it. For framework bids, the small-team guide to public-sector AI contracts covers the procurement side of the same evidence.

Answering patterns that win

Reviewers read hundreds of these and can tell within three rows whether a vendor is describing a system or a hope. The patterns that score are precise, scoped, and honest about what does not apply.

Answer at the scope asked. If the row is about encryption at rest for the retrieval store, name the algorithm and key management for that store and stop. The TLS version is a different row.

Prefer "not applicable because" to a hopeful yes. Many rows assume a mobile app, a warehouse or on-premises hardware you do not have. "Not applicable: no mobile client, and no data leaves the described flow" shows you understood the question.

Never claim a certification you do not hold, including "in progress". "SOC 2 Type II in progress" is the phrase most likely to trigger a call, because reviewers have heard it from vendors who had not engaged an auditor. Say what exists, what is scheduled with a date and assessor, and otherwise say no.

Offer the buyer's DPIA the inputs it needs. A UK controller processing personal data through your feature will usually have to complete its own data protection impact assessment, and an Indian Significant Data Fiduciary may face similar assessment duties once the DPDP Rules apply in full. Your completed DPIA template, the data-flow one-pager and the sub-processor register are the three documents the buyer's privacy team copies from. Handing them over unprompted shortens their review by weeks and signals that you have done this before.

Date every statement that depends on a third party. Provider terms change. "As of 14 September 2026, per the linked document" turns an opinion into evidence and protects you when the page moves.

Q: Is customer data used to train or improve any machine-learning model?
A: No. ExampleCo does not fine-tune, build evaluation sets from, or otherwise reuse
   customer content except to serve that customer. Our model sub-processor is
   [provider], used under its commercial API terms, which state inputs and outputs
   are not used for training by default (linked; checked 2026-09-14). Anonymised,
   sampled traces are used to tune prompts; the anonymisation step is in item 04.

Q: List all sub-processors with access to customer data.
A: (1) AWS, hosting: eu-west-2 for UK tenants, ap-south-1 for Indian tenants.
   (2) [Provider], model inference via [endpoint/region]; retention mode configured:
   [ZDR / 30-day abuse monitoring]. No other third party receives prompt or
   document content. Register with contract references: item 03.

Q: Where is customer data processed and stored?
A: Stored in the tenant's home region (London or Mumbai): retrieval store and
   backups. Processed in the same region, with model inference at [provider, region,
   deployment type], which per the provider's terms keeps processing within
   [geography]. Hop-by-hop diagram: item 01.

Q: Do you hold ISO 27001 or SOC 2?
A: No. We hold Cyber Essentials (certificate attached, issued [date]). ISO 27001 is
   scheduled for [quarter] with [assessor]. Controls in scope for this product are
   evidenced in items 01 to 09 in the meantime.

Common pitfalls, and a two-week plan

Two weeks to questionnaire-ready

Days 1 to 3: know your own system. Write the data-flow one-pager per region. Confirm the provider's retention mode and deployment type in the production account, not staging. Pull the provider's current terms and record the date. Draft the sub-processor register.

Days 4 to 6: governance documents. System card with pinned model IDs and an upgrade policy. Retention table per store, and run one real deletion end to end so you can evidence it. Access and secrets note with role matrix and rotation cadence.

Days 7 to 9: incident and continuity. Write the runbook with the four AI scenarios above, run a one-hour tabletop and record it. Document the gateway's failover and degraded mode; if you have not built one, the resilient LLM gateway guide is the shortest path.

Days 10 to 12: external evidence. Book the pen test with prompt-injection cases in scope, or gather last year's summary. Start the Cyber Essentials self-assessment if you sell in the UK; check whether the buyer needs DSPT or DTAC. For Indian BFSI buyers, map your answers to the RBI direction's contract clauses so legal review is short.

Days 13 to 14: the map and the dry run. Build the one-page mapping from UK GDPR, DPDP, RBI and NHS requirements to the evidence item that satisfies each. Then hand the pack to a colleague who did not write it and have them answer twenty rows from a real questionnaire using only the pack. Every row they cannot answer is a document you still need.

The teams that win these reviews are rarely the ones with the most certifications. They are the ones whose answers are true, specific, dated and boring. A buyer's security function wants a vendor it will not have to think about again. Give it a pack it can file, and the spreadsheet that arrives next Tuesday from a different buyer will take an afternoon.