How to write an AI risk statement for clients or a tender

Clients, public buyers and insurers are starting to ask suppliers how they use AI. A clear AI risk statement answers those questions once, consistently and in a way that stands up when someone checks.

This article sets out where the questions are coming from, what a credible statement contains and the mistakes that undermine one. It ends with a template you can adapt.

Where the questions are coming from

The questions are not hypothetical. There are documented examples across public procurement, AI supply chains, standard security questionnaires and insurance.

• UK central government. Procurement Policy Note 017, updated in February 2025, applies to central government departments, their executive agencies and non-departmental public bodies, and other contracting authorities may choose to follow it. Its sample questions ask suppliers whether they used AI to help write their tender and checked it for accuracy, and whether AI is part of the products or services they intend to provide. These sample questions are for information only and must not be scored, although, as Burges Salmon notes, buyers may ask further relevant AI questions that are scored. The note also allows buyers to carry out extra due diligence where AI has been used, including clarification questions, supporting documents, site visits and presentations. It also points out that AI is increasingly used to deliver services that are not themselves about AI, giving AI transcription in video conferencing as an example.
• EU public buyers. In March 2025, the EU’s Community of Practice on the public procurement of AI published updated model contractual clauses for buying AI: one set for high-risk systems and a lighter set for others. They are voluntary and based on the EU AI Act’s requirements for high-risk systems, and private companies can draw on some of the clauses as a reference.
• AI supply chains. Under Article 25(4) of the EU AI Act, providers of high-risk AI systems and the third parties that supply AI systems, models, tools, services or components used in them must agree in writing the information, technical access and assistance the provider needs to comply. When the high-risk rules apply, from December 2027 for uses such as recruitment and credit scoring, suppliers in those chains should expect detailed questions.
• Standard security questionnaires. In July 2025, the Cloud Security Alliance published its AI Controls Matrix, 243 controls across 18 domains, with a companion self-assessment questionnaire, giving buyers a ready-made set of AI questions to send to suppliers.
• Insurers. Material prepared for the Lloyd’s Market Association’s wordings forum in April 2026 invites underwriters to consider questions such as “Who would be checking the output and what are their qualifications?” Slaughter and May report that underwriters increasingly ask about acceptable use policies, staff training and human review.

There is not yet a single standard format, and the questions vary from one buyer to the next. That is the strongest argument for writing a master statement now and adapting it each time, rather than drafting a fresh answer against every deadline.

What a credible statement contains

A good statement is short, specific and backed by evidence. Each element below should be answerable in a few sentences, and each sentence should point to something you could produce if asked.

• Scope. What the statement should say: Which AI tools you use and for what: internal work, preparing bids, delivering the service. Evidence to have ready: An up-to-date register of AI tools and uses.
• Client data. What the statement should say: Whether client information goes into AI tools, which ones, where it is processed and whether the supplier can use it to train its models. Evidence to have ready: Supplier terms, data processing agreements and a simple data flow.
• Human oversight. What the statement should say: Who reviews AI-assisted work before it reaches the client, and what qualifies them to do so. Evidence to have ready: A written review procedure and the roles responsible.
• Governance. What the statement should say: Who is accountable, what policy applies and how often it is reviewed. Evidence to have ready: An approved, dated policy and the owner’s name.
• People. What the statement should say: What guidance and training staff receive. Evidence to have ready: Training and guidance records.
• Legal position. What the statement should say: Which laws and rules apply to your AI use, and your role under them. Evidence to have ready: A short, dated legal assessment.
• Incidents and change. What the statement should say: How AI-related errors or incidents are handled, and when the client will be told. Evidence to have ready: An incident procedure that covers AI.
• Supply chain. What the statement should say: Which third-party AI providers you rely on and how you assessed them. Evidence to have ready: Supplier due diligence records.

Five mistakes that undermine a statement

• Saying “we do not use AI” without checking. IBM’s 2026 data breach study found shadow AI, meaning staff use of unapproved tools, involved in 43% of the security incidents it studied, and 38% of UK workers surveyed by KPMG and the University of Melbourne admitted using AI at work in inappropriate ways. Unless you have looked, you probably do not know. A more defensible answer describes what you have approved and how you control the rest.
• Claiming to be “fully compliant with the EU AI Act”. What the Act requires depends on your role and on the risk level of each use, and several obligations do not apply until December 2027 or later. It is better to say which obligations apply to you and what you have done about them.
• Blurring standards and certification. “Certified to ISO/IEC 42001” and “informed by ISO/IEC 42001” mean very different things. Use the precise wording, and only claim a certification you hold.
• Relying on comfort words. “Robust”, “industry-leading” and “secure” tell a buyer nothing. Replace each one with a fact: who reviews the output, where the data goes, how often the policy is checked.
• Saying different things in different places. If your tender response, your website and your internal policy describe your AI use differently, a careful buyer will notice. Keep one master statement and draw from it.

A template you can adapt

The wording below is illustrative. Replace the text in square brackets, delete anything that does not apply and do not include any statement you cannot evidence.

How we use AI. [Firm name] uses AI tools to support [drafting, research and data analysis]. Approved tools are recorded in our AI register, which is reviewed [quarterly]. [We do not use AI in delivering the services described in this tender.] [or: We use AI in delivering these services as follows: (description).]

Your data. Client information is entered only into tools approved for that purpose, under contract terms that [prevent the provider from using it to train its models]. [Data is processed in the UK or the European Economic Area.]

Human oversight. All AI-assisted work is reviewed by a qualified [role] before it is shared with you. AI is not used to make decisions about [individuals or your matters] without human review.

Governance and people. [Name, role] is accountable for AI governance. Our AI policy was approved by [the board] on [date] and is reviewed [annually]. Staff receive role-specific guidance and training, and records are kept centrally.

Legal position. We process personal data in line with UK GDPR. [Where our services fall within the scope of the EU AI Act, we act as a (deployer or provider) and have (describe measures).]

Suppliers. Our principal AI providers are [names]. We assessed each before use for data handling, security and contract terms.

Incidents and change. We will tell you promptly of any AI-related incident affecting your data or services, and of any material change to how we use AI on your work. Supporting documents are available on request.

For public sector tenders that follow PPN 017, add a direct answer on whether AI was used to prepare the bid itself and confirm that any AI-assisted content was checked for accuracy.

Practical tips

1. Write it before you need it. A statement drafted against a tender deadline tends to be vague or optimistic. Draft the master version now, while there is time to check it.
2. Prove every sentence. For each claim, note the document that supports it. If there is no document, either create one or remove the claim.
3. Get it signed off. Have the accountable owner and whoever advises you on legal and risk matters approve the master statement, and date it.
4. Answer the question asked. Use the master statement as a source, but tailor each response to the specific question and service.
5. Be honest about the bid itself. If AI helped write your response, say so where asked, and make sure a person has checked every fact and figure.
6. Review it when things change. Update the statement when you adopt a new tool, change a supplier or a relevant rule changes, as well as on a fixed date.
7. Ask your own suppliers the same questions. Your statement is only as reliable as the information your AI providers give you. The questions you are asked are the ones you should be asking them.

A good AI risk statement is short, specific and true. Most of the work lies in making sure it is true.

Sources checked October 2026. Procurement guidance and regulatory positions may change and should be re-checked before reliance. Figures from IBM’s 2026 report are taken from independent summaries of the full report, which is available from IBM on registration. The template is illustrative and is not a substitute for advice on a particular tender or contract.

This article provides general information and does not constitute legal advice. Businesses should take qualified advice before making representations about their use of AI in contracts or tenders.

References

Procurement

• Cabinet Office, PPN 017: Improving transparency of AI use in procurement, 17 February 2025: https://www.gov.uk/government/publications/ppn-017-improving-transparency-of-ai-use-in-procurement/ppn-017-improving-transparency-of-ai-use-in-procurement-html
• Burges Salmon, “Improving transparency of AI use in public procurement: PPN 017 published”: https://www.burges-salmon.com/articles/102k15q/improving-transparency-of-ai-use-in-public-procurement-ppn-017-published
• Covington, Inside Privacy, “EU’s Community of Practice publishes updated AI model contractual clauses”, April 2025: https://www.insideprivacy.com/artificial-intelligence/eus-community-of-practice-publishes-updated-ai-model-contractual-clauses/
• Cliffe Dekker Hofmeyr, “An overview of the European Union’s Model Contractual Clauses for Artificial Intelligence”, 3 September 2025: https://www.cliffedekkerhofmeyr.com/en/news/publications/2025/Practice/Corporate-Commercial/corporate-and-commercial-alert-3-september-an-overview-of-the-european-unions-model-contractual-clauses-for-artificial-intelligence

EU AI Act

• European Commission AI Act Service Desk, Article 25: Responsibilities along the AI value chain: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-25
• European Commission AI Act Service Desk, Article 113: Entry into force and application: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113

Questionnaires and insurance

• Cloud Security Alliance, “Cloud Security Alliance delivers the AI guardrails you’ve been looking for”, 10 July 2025: https://cloudsecurityalliance.org/press-releases/2025/07/10/cloud-security-alliance-delivers-the-ai-guardrails-you-ve-been-looking-for
• DAC Beachcroft, AI and policy wordings, presentation to the Lloyd’s Market Association wordings forum, 21 April 2026: https://lmalloyds.com/wp-content/uploads/2026/04/AI-and-Policy-Wordings-DACB-21-April-2026.pdf
• Slaughter and May, The Lens, “How GenAI risks are reshaping the E&O insurance market”, 25 November 2025: https://thelens.slaughterandmay.com/post/102lvw3/how-genai-risks-are-reshaping-the-eo-insurance-market-insurance-industry

Data

• Baker Donelson, “Ten takeaways from IBM’s 2026 Cost of a Data Breach Report”, 30 July 2026: https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report
• Sentra, blog on shadow AI in IBM’s Cost of a Data Breach 2026 report, 13 August 2026: https://sentra.io/blog/ibm-cost-of-a-data-breach-2026-shadow-ai
• KPMG UK, “UK attitudes to AI” (KPMG and University of Melbourne, Trust, attitudes and use of AI: a global study 2025): https://kpmg.com/uk/en/insights/ai/uk-attitudes-to-ai.html

Standards

• ISO, ISO/IEC 42001:2023, Artificial intelligence management system: https://www.iso.org/standard/42001