# AI security questionnaire answer bank · [Product] · [Date] Structure follows the domains your customers use most (for example, the AI-CAIQ). One canonical answer per question. A named owner approves every answer before it goes to a customer. | ID | Domain | Question (canonical form) | Answer | Evidence (doc, report, control) | Frameworks satisfied (ISO/IEC 42001, NIST AI RMF, EU AI Act, other) | Owner | Last reviewed | Confidential? | |---|---|---|---|---|---|---|---|---| | G-01 | Governance | Do you have an AI policy and a review process? | | | | | | | | M-01 | Models and suppliers | Which models and providers do you use, and where are they hosted? | | | | | | | | D-01 | Data use | Do you train on customer data? | | | | | | | | P-01 | Privacy | Can you support our DPIA? | | | | | | | | S-01 | Security | How do you defend against prompt injection and tool misuse? | | | | | | | | E-01 | Evals and testing | How do you test quality, safety and fairness? When was your last red team? | | | | | | | | H-01 | Oversight | What can the system do without human approval, and how is it stopped? | | | | | | | | T-01 | Transparency | How do users know they are interacting with AI? | | | | | | | | I-01 | Incidents | How will you notify us of an AI incident? | | | | | | | | R-01 | Regulation | What is your EU AI Act role and risk classification? | | | | | | | ## Rules - Answers cite evidence; if there is no evidence, the answer says what exists and what is planned, with a date. - New questions not in the bank are answered by hand, then added. - Review every answer at least every [six] months and after any material change.