Ready for scrutiny: answering AI questions from clients, insurers and auditors

It used to be a single line on a supplier questionnaire, if it appeared at all. Now AI questions show up in client due diligence, insurance renewals, tenders and audits. For many firms, the first sign that AI governance matters is a form they can’t quite fill in.

The good news: the questions are fairly predictable, and the answers come from work you probably need to do anyway.

Who is asking, and why

• Clients want to know their information is safe and that work they pay for is checked by a person.
• Insurers want to understand how AI might change your risk profile.
• Auditors and regulators want to see that you have oversight, not just good intentions.
• Partners and tender panels want reassurance that you won’t create problems for them.

They’re all asking a version of the same question: are you in control of how you use AI?

The questions you’ll usually see

1. Do you use AI tools in delivering our work?
2. Which tools, and for what purposes?
3. Do you have an AI policy?
4. Is client or personal data entered into AI tools? Under what controls?
5. How is AI output reviewed before it reaches us?
6. Have staff been trained?
7. Who is accountable for AI use in your firm?
8. How do you assess and manage AI risk, including in third-party software?

What good answers look like

Good answers are specific, honest and calm. They don’t overclaim, and they don’t hide.

Weak: "We take AI risk very seriously and follow industry best practice."

Better: "We use two approved AI tools for drafting and summarising. Client data is only entered into our enterprise tool, which doesn’t use our data for training. All AI-assisted work is reviewed by a qualified member of staff before it is shared. Our AI policy was last reviewed in September."

The second answer is shorter on adjectives and longer on facts. That’s what builds trust.

The evidence to keep ready

Most questions can be answered from a small evidence pack:

• AI register. Approved tools, what they’re used for, and the data they handle.
• AI policy. Current version, with a review date.
• Risk assessments. For higher-risk uses and key vendors.
• Training records. Who has been trained, when, and at what level.
• Review process. How AI output is checked before it reaches clients.
• Accountability. The named person responsible for AI governance.

Keep it in one place and keep it current. A pack that’s six months out of date can create more questions than it answers.

Tips for handling the forms

• Answer the question asked. Don’t volunteer a policy essay.
• Be consistent. Use the same core wording across questionnaires so answers don’t contradict each other.
• Don’t claim what you can’t show. If you’re still building something, say so and give a date.
• Keep a library. Save your best answers. You’ll reuse them often.

How TURMA helps

TURMA Assured keeps your register, policies, controls and evidence current in one place, so the answers are ready when the form arrives. TURMA Passport adds a recognised credential for your people and your business: a clear signal that you know what you’re doing with AI.

We know we’re covered if we’re asked questions. That’s the feeling to aim for.