AI security questionnaires: answering enterprise reviews of AI features
AI security questionnaire themes enterprise buyers raise: data use, tenant isolation, prompt injection, approval, logging, and the evidence that answers each.
Short answer
Enterprise buyers now add AI questions to security reviews: how you use their data, how you isolate tenants, how you handle prompt injection, where a human approves actions and what you log. An AI security assessment report gives you tested, dated evidence for those answers. It does not decide whether a buyer accepts you. Each buyer sets its own bar.
An enterprise buyer is reviewing your product and finds an AI feature. The questionnaire now has AI questions that your standard answers do not cover. No standard or buyer sets one fixed list, so prepare for the themes buyers commonly raise and gather evidence for each.
What do enterprise buyers ask about AI features?#
Buyers ask about data, access, control and records. The themes below reflect public AI control sets such as the CSA AI Controls Matrix v1.1, which lists 247 control objectives across 18 domains. Your buyer may use a different form. Each row pairs a theme with the evidence that supports a good answer.
| Question theme | Typical question | Evidence to prepare |
|---|---|---|
| Data use | Do you send our data to a model provider? Is it used for training? Where is it stored? | Data-flow diagram, provider terms you rely on, retention settings |
| Tenant isolation | Can another customer's users reach our documents through the AI feature? | Cross-tenant test results for retrieval, cache and memory |
| Prompt injection | How do you handle instructions hidden in documents, emails or web pages? | Indirect injection test results, attempt counts and the controls that limit impact |
| Tool and agent actions | What can the AI do on our behalf? Which credentials does it use? | Tool list with scopes, per-user credential design, permission tests |
| Human approval | Which actions need a person to approve? | Approval design and bypass test results |
| Output handling | Can the AI show links, images or HTML that send data out? | Output rendering tests |
| Logging and monitoring | Do you log prompts, tool calls and outputs? Who can read the logs? | Log design, retention, access list |
| Change control | What happens when the model or prompt changes? | Release process and retest triggers |
| Incident response | How would you find and handle an AI-specific incident? | Runbook that covers AI features |
How does an assessment report help answer these questions?#
A report turns a claim into evidence. "We isolate tenants" becomes "we tested retrieval across test tenants with seeded markers, on this date, under these conditions, and here is what happened". Our reports state the conditions, attempt counts, observed behavior, evidence, impact, fix and retest result. They also list controls that held and limits of the test. See the example report.
The LLM application assessment tests retrieval boundaries and supplies tenant isolation evidence. The AI agent assessment tests permissions and approval, and the MCP assessment tests tool trust and tokens.
Answer only what the report shows. If we did not test an area, say so, and do not stretch a result into a wider claim.
How should you answer the prompt injection question?#
Do not claim you prevent prompt injection. The UK NCSC says it may never be totally mitigated, and the best you can do is reduce likelihood and impact. A credible answer states four things:
- which untrusted sources your AI reads
- what the AI can reach if one source is hostile
- what limits impact, such as least-privilege tools and approval for risky actions
- what you tested, and how often the attack worked
Which frameworks do buyers mention?#
Buyers cite the OWASP Top 10 for LLM Applications, NIST AI RMF, ISO/IEC 42001 and CSA materials. Our framework mapping shows how findings relate to them. ISO/IEC 42001 sets requirements for an organization's AI management system, per its scope statement. It does not certify one product.
What do we not promise?#
We do not promise that a buyer, auditor or regulator will accept a report, and we do not say your product is secure or compliant. We tell you what we tested, what we saw and what to fix. Ask the buyer which evidence it accepts before you scope the work.
To plan an assessment around a specific review, start scoping and tell us the buyer's questions and deadline. Do not send production secrets or real customer data through the form.
Questions
Will an assessment report make a buyer accept our AI feature?
We cannot promise that. Each buyer sets its own criteria. A report gives you specific, dated evidence of what was tested and fixed. Ask the buyer early which evidence it accepts.
Should we send the whole report to the buyer?
Usually no. Reports show weaknesses. Many teams share a summary and the list of tested areas under NDA. Decide with your own legal and security leads, and check what the buyer asks for.
Does ISO/IEC 42001 replace this testing?
No. ISO/IEC 42001 is a management-system standard for an organization, so it does not test one product. Buyers may ask for both a management system and product-level test evidence.
Sources
- CSA AI Controls Matrix v1.1 (checked 9 November 2026)
- IEC Webstore: ISO/IEC 42001:2023 (scope statement) (checked 9 November 2026)
- NIST AI RMF 1.0 publication page (checked 9 November 2026)
- OWASP Top 10 for LLM Applications 2026 (README) (checked 9 November 2026)
Shipping an AI feature or agent?
Describe the system, the data it reads and the actions it can take. We reply with questions and a proposed scope.