Does ISO 42001 reduce the AI governance questionnaires customers send?
A certificate can reduce the repeated questions customers ask about your AI management system, but it does not answer product-specific questions on its own. The organization owns its controls, and an accredited certification body issues the certificate after its own audit. Whether ISO 42001 helps depends on three things: the scope of the certificate, the statement of applicability that justifies which Annex A controls you included and excluded, and whether the buyer's questions concern the management system or the behavior of one AI feature. Certification is one evidence source among several, alongside contracts, model documentation and test results.
Before you promise a questionnaire reduction, read the certificate scope and the statement of applicability together. Confirm which products and AI systems the scope names, since a buyer will ask whether the feature they are buying falls inside it. Check each exclusion against the justification written beside it, because buyers' reviewers often challenge exclusions first. Ask your certification body, or your own counsel, whether the certificate and statement of applicability can be shared under your nondisclosure terms. Your questionnaire library can then map each recurring question to the clause or control that covers it, and mark the rest as product or contract answers that certification does not settle.
Some buyers still ask for evidence the certificate does not show, including how a specific model was evaluated, what data trained or grounds it, and which third-party model vendor's terms apply. Plan for those questions with system-level documentation and test results rather than assuming the certificate will absorb them. The ISO/IEC 42001 standard page is the right starting point for confirming what the standard requires, and your certification body can confirm what its audit reviewed. Treat any statement that a certificate replaces a questionnaire as a claim to verify with the buyer before you make it.
Which questionnaire answers a certificate can cover and which it cannot
This is the area where a certificate carries the most weight. An ISO/IEC 42001 certificate shows that an independent certification body assessed the organization's AI management system against clauses 4 to 10, including context, leadership, the AI policy, roles, competence, internal audit and management review. The statement of applicability shows which Annex A controls the organization selected and why it excluded others, which answers questions about whether governance is documented and reviewed.
- Policy and direction: The certificate supports that a documented AI policy exists and is reviewed, under the controls in A.2.
- Accountability: Roles, responsibilities and a process for raising AI concerns (A.3) are the kind of evidence questionnaires ask for by name.
- Management review: Clauses 9.3.1 to 9.3.3 cover leadership review of the system, which the NIST AI RMF crosswalk links to executive responsibility for AI risk decisions.
- Exclusions: A questionnaire may ask why a control is absent. The justification in the statement of applicability answers that question.
- Scope limits: The certificate covers the scope the certification body audited, so a product outside that scope is not covered.
Check that the certificate names your legal entity, products and sites, and that the statement of applicability version matches the one the auditor reviewed.
Customers often ask how risks to their own users are identified, rated and treated. The certificate supports that a risk process and impact assessment process exist and run inside the management system, covering clause 6 and the impact controls in A.5. It does not prove that any particular risk assessment was sound, nor that the residual risk for a specific customer deployment is acceptable.
- Process existence: The certificate supports a documented assessment process for AI system impacts, including the separate assessment of impacts on individuals or groups and on society.
- Completed assessments: Individual impact assessment reports for named systems are separate evidence and should be shared, redacted if needed.
- Risk register contents: Customers may ask for the actual risk entries and treatment plans, which the certificate does not contain.
- Standards references: ISO/IEC 23894 and ISO/IEC 42005 are related guidance, and buyers may ask which one you followed.
- Model-specific failure modes: Bias, hallucination and misuse testing results need their own reports.
Ask the customer which impact assessment they expect to see and whether they want a summary or the full document.
Supplier questions are where many AI vendors lose time. Controls in A.10 cover allocating responsibilities across the AI life cycle and managing suppliers of AI products and services. A certificate shows that these controls exist and were audited for your organization, but it does not certify your model providers, cloud platforms or data sources. Each supplier's own certificate covers only that supplier's scope.
- Supplier process: The certificate supports that supplier selection, due diligence and monitoring are part of the system.
- Responsibility split: Documented allocation of life cycle responsibilities between you and the model vendor answers most questions about who does what.
- Vendor certificates: A model vendor's ISO/IEC 42001 or cloud certificate does not transfer to your product, and buyers may ask for both.
- Contract terms: Subprocessor lists, data use limits and audit rights sit in contracts, not in your certificate.
- Financial regulation: Banks and other regulated buyers may apply their own third-party risk guidance, such as the interagency guidance on third-party relationships, which requires evidence beyond a certificate.
Confirm which supplier evidence you can share and whether it is current.
Questionnaires often ask what customers and users are told about the AI system, how they are told about adverse impacts, and how incidents are communicated. These questions fall under A.8, which covers documentation for users, external reporting of adverse impacts, incident communication and reporting obligations to interested parties. The certificate shows that these processes exist, but the content of your user documentation is a separate item.
- Documented obligations: Clause A.8.5 asks you to determine and document reporting obligations to interested parties, which the certificate supports.
- Actual documentation: Model cards, user guides and limitations statements must be provided as files.
- Incident notices: Past notices or a sample communication plan show how the process works in practice.
- Contractual reporting: Notice periods and recipients are negotiated terms and belong in the agreement.
- Regulatory duties: Transparency obligations under the EU AI Act need their own mapping.
Ask the buyer which user-facing documents they want attached to the response.
Most product security questions fall outside any management system certificate. Penetration test results, vulnerability scan reports, encryption details, data residency, data processing terms and breach history are product facts that an ISO/IEC 42001 certificate does not establish. The A.7 data controls cover data management and provenance for AI systems, which helps with training data questions, but it does not replace a data processing agreement or a security assessment of the running service.
- Security testing: Recent penetration test reports and their remediation status are separate evidence.
- Data processing: Data processing terms, subprocessor lists and retention rules sit in contracts.
- Infrastructure assurance: A SOC 2 report or ISO/IEC 27001 certificate for the hosting environment may answer hosting questions, if its scope covers the service.
- Training data: The A.7 controls support provenance records, but licensing and personal data rights need legal review.
- Agent and model abuse testing: Red team results for AI-specific threats need their own reports.
Before responding, confirm which of these items the buyer will accept as separate attachments and how recent each must be.
How CSA STAR for AI and the AI-CAIQ fit into the answer
CSA STAR for AI sits between a self-assessment and a certificate, and it is the most direct way to show customers a published AI governance posture. The cards below cover how the levels work, what the public registry shows, the lighter options for small teams, and what to verify before you cite any of it in a questionnaire response.
Level 1: the AI-CAIQ self-assessment
Level 1 is a self-assessment against the AI-CAIQ, the questionnaire that maps to CSA's AI Controls Matrix. The organization answers the questions itself and publishes the result. It shows a customer that you have considered AI governance questions in a structured way, but it is not an independent check. Treat it as interim evidence while a certificate is pending, and say so plainly in the response.
Level 2: validated AI-CAIQ plus ISO 42001
Since 20 November 2025, a validated AI-CAIQ combined with ISO/IEC 42001 certification achieves STAR for AI Level 2. Both halves matter. The AI-CAIQ must be validated, and the ISO/IEC 42001 certificate must be current and issued by an accredited certification body. Confirm with the certification body that the certificate covers the product and sites the customer will rely on, because a certificate that covers only part of the business will not carry the same weight.
Public STAR Registry entries
CSA's public STAR Registry lets customers view a provider's security and compliance posture directly. A registry entry can reduce the number of repeated questionnaires a provider answers for each prospect. Before you point a buyer to it, open your own entry and check that the level, scope, dates and documents match your current environment. Stale entries are a common reason a customer's review stalls.
Validation status of the AI-CAIQ
Level 2 depends on a validated AI-CAIQ, so a completed questionnaire is not enough on its own. Ask the registry or the program owner how validation is recorded and whether it is current for the version you filed. Check whether the validated answers still match your product after new model vendors, new data flows or new AI features were added. An answer set that predates a major change can misstate your posture to a customer.
CCM Lite and CAIQ Lite for small teams
CSA offers CCM Lite and CAIQ Lite for SMEs and startups. They give a smaller company a narrower set of controls and questions than the full matrices. They suit an early-stage company that needs to answer the most common customer questions without building a full program. Confirm with CSA which Lite version applies to AI governance questions and whether it counts toward a STAR level, since the Lite materials are not the same as the AI-CAIQ used for Level 2.
Scope and dates to confirm before citing
Before you cite STAR for AI in a contract or questionnaire, confirm three things with the registry and your certification body: the in-scope product or service, the date the assessment or certificate was issued, and the expiry or next review date. A customer will ask which AI features are covered. Record those answers in the same place as your certificate so the response matches the public entry every time.
How to map questionnaire answers to the NIST AI RMF
A customer questionnaire that asks how you govern AI risk can often be answered by pointing to the same evidence used for ISO/IEC 42001, provided you translate the wording. The NIST AI Resource Center publishes a crosswalk, contributed by Microsoft, that maps subcategories of the NIST AI Risk Management Framework to clauses of ISO/IEC FDIS 42001 and to the implementation guidance in Annex B. Use it as a lookup table: start from the NIST subcategory named in the buyer's question, find the mapped clauses or Annex B guidance, and then pull the record that proves it from your own management system. The crosswalk is available at the NIST AI RMF crosswalks page, and the mapping document itself is linked from there.
Two examples from the crosswalk show how the lookup works. GOVERN 1.6, which concerns an inventory of AI systems, maps to the Annex B guidance for controls A.4.2 to A.4.6, so an answer about AI system inventory should point to your resource records for each system: data, tooling, system and computing, and human resources. GOVERN 2.3, which concerns executive leadership responsibility for AI risk decisions, maps to clauses 5.1 and 5.2 and to the management review clauses 9.3.1 to 9.3.3. An answer here should name the accountable executive, show the AI policy they approved, and attach the minutes of the most recent management review where AI risk was decided.
NIST states that inclusion of a mapping implies neither endorsement nor full coverage. Treat each mapped answer as a claim to verify, not a finished response. Before sending, confirm that the record named in your answer exists, is current, and covers the system the customer asks about, and that your statement of applicability does not exclude the control the answer depends on. Where a mapped subcategory has no matching evidence, say so in the answer and describe the plan, rather than letting the crosswalk imply coverage you cannot show. An independent auditor will test your records in the same way, so the same check protects both your questionnaire answers and any later certification.
How to build a questionnaire answer set from an ISO 42001 program
This sequence turns an ISO 42001 program into answers a customer can verify, with each answer tied to a stated scope, a documented control decision and evidence that exists. The output is a reusable answer library that stays accurate as the AI system changes.
Confirm certificate scope and validity
Start by checking the certificate, if you hold one, with the certification body that issued it. Confirm the legal entity named, the products, AI systems and sites covered by the scope statement, the issue date, and the current validity or surveillance status. Your answers can only claim what the scope covers. If you are not yet certified, record that status plainly and move to the next step. The output is a short scope note that every later answer must match.
Pull the statement of applicability
Obtain the current statement of applicability from the document owner, who is usually the AI governance lead inside your organization. Clause 6.1.3 requires this document to list the Annex A controls you need and to justify including or excluding each one. Read every exclusion closely, since a buyer will ask about any control you did not implement. The output is a controlled copy dated to match your scope note, with its version recorded.
Collect the questionnaire items and group them
Gather every AI governance question from the customer questionnaire, contract schedule or RFP and place each one in a row of a working register. Group similar questions together, such as those about training data, human oversight or incident notice, because buyers often phrase the same concern in several ways. Note the exact wording and any deadline the customer stated. The output is a single register with one row per question, so no item is answered from memory.
Map each item to a control or clause
For each row, identify the clause of ISO/IEC 42001 or the Annex A control it addresses, and where useful the matching subcategory of the NIST AI RMF crosswalk. Where a question has no clear counterpart, mark it as outside the standard and decide whether it needs a contract term, a policy or a plain statement. Do not map an item to a control you excluded without explaining the exclusion. The output is a mapping column that a reviewer can check line by line.
Attach the supporting evidence
For each mapped item, name the record that shows the control operates. Typical evidence includes the AI system inventory, impact assessments, technical documentation, supplier terms and model vendor agreements, monitoring logs and records of management review. Check that each record is dated, current and owned by a named role. The output is an evidence index that links every answer to a document the customer can request under your NDA, with any sensitive material redacted.
Record gaps and draft the answers
Write each answer in plain language that states what you do, which evidence supports it and any limits on the scope. Where the program does not yet cover an item, record the gap, its owner and the action you plan, and write an honest answer that says so. Avoid wording that implies certification covers things it does not. The output is a draft answer set plus a gap log that the internal AI governance owner reviews before anything is sent.
Review with the certification body and counsel
Before the answer set goes to a customer, confirm with your certification body that the statements about certification scope and status are accurate, and have your legal team review commitments and warranties. The certification body does not approve your answers, but it can confirm facts about its own certificate. Keep a record of who reviewed what and when. The output is a signed-off version with reviewer names and dates.
Keep the answer set current
Set an owner and a trigger for updates, such as a new AI system, a new model vendor, a changed scope, a surveillance audit or a new incident. Re-run the mapping and evidence checks when any trigger occurs, and retire answers that no longer match the program. The timing of reviews should be agreed internally and with your certification body, since no fixed interval is set by the standard for this step. The output is a version-controlled library that matches what you can show today.
What buyers still ask after they see a certificate
An ISO 42001 certificate tells a buyer that an AI management system exists and was audited. It does not answer how customer data is used, which model vendors sit behind a feature, or what happens when something goes wrong. The cards below cover the questions buyers ask most often after the certificate, with the evidence the organization must produce for each. The organization owns every answer, and an implementation partner can help prepare the records behind them.
Data residency and training use
Buyers ask where prompts, outputs and customer records are stored, which regions process them, and whether they are used to train or fine-tune models. The answer must match the data flow in the organization's documented resource and data records under A.4 and A.7. Evidence includes a current data flow diagram, the retention settings in each system, and written contract terms with each model provider. Check that the training-use answer covers logs, support tickets and feedback, not only the primary prompt data. Confirm each answer against live configuration before it goes into a questionnaire.
Model vendor dependencies
When a product calls a third-party model, buyers ask who the model provider is, what its certificate covers, and what happens if that vendor changes terms or goes offline. The organization must keep a supplier record under the A.10 controls for managing AI suppliers, with the vendor's assurance reports and the responsibilities split between both parties. A vendor's certificate covers the vendor's own management system, not the organization's use of it. Ask each vendor for its current certificate scope and the date of its last audit report.
Incident notification commitments
Buyers want to know how and when they will be told about an AI incident, such as a harmful output, a data exposure or a material model change. The control behind this is A.8.5, which asks the organization to determine and document its obligations to report information about the AI system to interested parties. Evidence includes the notification criteria, the named contacts, the contractual notice periods the organization has agreed to, and a record of how past incidents were communicated. Make sure the commitments in the contract match the internal procedure.
Human oversight in specific workflows
Customers in hiring, lending, healthcare or claims ask where a person reviews or can override an AI output before it affects their decision. A certificate does not state which workflows have human review, so the organization must document it per use case. The relevant evidence is the use procedure under A.9, the defined reviewer roles under A.3, and logs showing that reviews happened. Choose a few representative workflows and walk through them with the buyer's compliance team, using a short illustrative example rather than a generic description.
Red team and security test results
Buyers ask whether the AI features have been tested for prompt injection, data leakage, and unsafe outputs, and what the findings were. Testing results are evidence for the verification and validation work in the life cycle controls, but a certificate does not include them. The organization should retain dated test scopes, findings, remediation status and retest evidence, and decide what summary it will share under confidentiality terms. A security testing provider can run these exercises, but the organization decides which findings to fix and which risks to accept.
What to tell a customer while certification is in progress
Describe interim evidence as what it is: in progress or self-declared. While an ISO/IEC 42001 certificate is being prepared, the honest position is that the organization is working toward certification. Two items can support that position. The first is a CSA STAR for AI Level 1 self-assessment, which is an AI-CAIQ completed by the organization itself. The second is a documented statement of applicability under clause 6.1.3, which lists the Annex A controls the organization considers necessary and justifies each inclusion or exclusion. A customer can review both, but neither is a certificate and neither has been checked by an independent party. Write the answer so that a reader cannot mistake either document for an accredited result.
Do not claim certification before the certificate exists. Phrases such as "ISO 42001 certified" or "certified under ISO 42001 for our AI features" are untrue until an accredited certification body has issued a certificate for the defined scope. Planned dates, stage 1 or stage 2 audit bookings, and internal readiness reviews are also not certification. Check that every sales deck, security page, RFP response and contract clause uses the same wording, and that sales staff know the difference. If the certificate later covers a narrower scope than the one described, the earlier claim may need correcting in writing, so keep the scope statement consistent from the start.
Confirm the evidence format before sending anything. Ask the customer's security or procurement team which format their questionnaire accepts: a self-assessment, a completed AI-CAIQ, a statement of applicability, a project plan with dates, or nothing short of a certificate. Some questionnaires will not accept interim material at all, and it is better to learn that early than to send a document that is rejected. Record the answer and the version of the documents you sent, so that later questions about the same controls can be answered consistently.
Questions buyers ask before using ISO 42001 for questionnaires
Does an ISO 42001 certificate replace customer AI governance questionnaires?
Not entirely, but it often shortens them. A certificate shows that an accredited certification body assessed your AI management system at a point in time. Customers still ask product-specific questions, such as which models process their data, how outputs are monitored, where training data came from, and how you handle AI incidents. Send the certificate together with the statement of applicability and a short evidence pack that answers those questions directly. Ask each customer which questions the certificate already covers so that you do not repeat answers they have already accepted.
Is STAR for AI enough to answer a customer's AI questionnaire?
It depends on the level and on what the buyer accepts. STAR for AI Level 1 is an AI-CAIQ self-assessment published in the public STAR Registry. Since 20 November 2025, a validated AI-CAIQ combined with ISO/IEC 42001 certification achieves STAR for AI Level 2. The Cloud Security Alliance says the registry can reduce the need for repeated customer questionnaires. A Level 1 entry is self-declared, so a buyer with a high-impact use case may still send its own questions. Check the level the buyer's procurement team requires before you decide what to publish.
What does an ISO 42001 statement of applicability reveal to customers?
It shows which Annex A controls you chose to implement and why you excluded the others. Clause 6.1.3 requires a statement of applicability that lists the controls the organization needs and justifies including or excluding each one. Annex A has 38 reference controls in nine areas, so the document tells a buyer where your AI governance is strong and where it is limited. A company that only buys AI may exclude development controls, and that choice should be explained in plain terms. Share the statement under a non-disclosure agreement, keep it current, and confirm with your certification body which version it reviewed.
Can an implementation partner prepare answers to AI governance questionnaires?
A partner can prepare the systems, controls and evidence the answers depend on, and it can help draft responses. The organization still owns its controls, its AI policy and every statement it makes to a customer. An independent auditor or certification body is the only party that issues a certificate or audit report. DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own environment and prepares evidence for compliance assessments, but it does not issue reports or certificates. Agree the questionnaire work in a written, fixed scope that names the deliverables, the owner of each answer and who reviews the final text.
How long does ISO 42001 certification take and what does it need from staff?
The duration depends on your starting point, and no figure is given here. Ask the certification body for a written timeline. Initial certification normally has a two-stage audit, described in European Accreditation's FAQ on the two-stage initial audit. Cost has several parts: the certification body's fees for the audits, any partner fees for preparation, and internal time. Internal staff need to own the AI policy, the inventory of AI systems, impact and risk assessments, internal audit, management review and the evidence for each control. Ask both the certification body and the partner for a quote that lists these items and what recurs after certification.
How do I verify a supplier's ISO 42001 certificate?
Confirm that an external certification body issued the certificate, because ISO does not certify organizations. Request the certificate number, the certified scope, the validity dates and the certification body's name, then check that body's accreditation status with its accreditation body. Accreditation is voluntary, so a certificate from an unaccredited body is a weaker assurance. Check that the accreditation covers ISO/IEC 42001 specifically, since the Global ACI recognition documents did not list it as an endorsed sub-scope in version 3.3. ISO/IEC 42006:2025 sets additional requirements for bodies certifying AI management systems, which is a useful reference when you review the body.
Does mapping to the NIST AI RMF answer ISO 42001 questions?
A crosswalk helps you find the matching answer, but it does not prove coverage. The NIST AI Resource Center lists a crosswalk contributed by Microsoft that maps AI RMF subcategories to ISO/IEC FDIS 42001 clauses and Annex B guidance. For example, GOVERN 1.6, the inventory of AI systems, maps to the guidance for A.4.2 to A.4.6, and GOVERN 2.3, executive responsibility for AI risk decisions, maps to clauses 5.1 and 5.2 and the management review clauses 9.3.1 to 9.3.3. NIST states that inclusion implies neither endorsement nor full coverage, so check each mapped answer against your own evidence before you send it.
Common mistakes that weaken questionnaire answers
Customers reading an AI governance questionnaire check whether each answer points to evidence that exists and covers the scope they care about. The four mistakes below share one cause: the answer describes a broader or more finished position than the organization can show. Each card names the mistake and the check that prevents it.
Overstating certification scope
Answers often say the whole company is ISO/IEC 42001 certified when the certificate covers one product, one business unit or one set of AI systems. Read the certificate scope statement and compare it with the systems the customer is asking about. If a feature sits outside that scope, say so in the answer and state what governance applies to it. Ask the certification body to confirm the scope wording before you quote it. Also check the certificate is current, because an expired or suspended certificate does not support a present-tense claim.
Mapping answers to excluded controls
A statement of applicability lists each Annex A control and justifies whether it is included or excluded under clause 6.1.3. An answer that cites an excluded control, such as a development control for a team that only uses third-party models, presents a gap as a strength. Cross-check every control cited in a questionnaire answer against the statement of applicability before sending it. Where the customer asks about an excluded area, answer with the justification for the exclusion and the controls that address the underlying risk instead.
Copying crosswalks as proof of coverage
A crosswalk shows where a framework's subcategories relate to another standard's clauses and guidance. The NIST AI Resource Center states that inclusion in a crosswalk implies neither endorsement nor full coverage. Pasting crosswalk rows into an answer as if they prove compliance invites a follow-up question the team cannot answer. Use the crosswalk to find where your evidence likely belongs, then point to the specific record, review or log that the customer can inspect.
Answering with policies alone
A policy states intent. Customers ask whether the organization does the thing, so an answer that cites only the AI policy invites a request for proof. For each claim, name the operating record that shows the activity happened: an impact assessment dated for a live system, a review of a supplier's model card, an incident ticket, or a management review minute. If a control has no operating record yet, say it is being rolled out and give the date you can actually confirm, rather than describing it as in place.
Answering beyond the evidence set
Questionnaires often include questions about training data provenance, bias testing or model vendor practices that the organization does not control. Answers that claim knowledge of a third party's internal practices, or that promise controls not yet in the evidence set, create exposure during contract review. Keep a register of which answers rest on your own evidence and which depend on supplier documentation. For supplier-dependent answers, cite the supplier's own certificate or report and state what it does and does not cover.
When to bring in an implementation partner and what stays internal
The organization owns its AI governance, and that includes every control it claims in its statement of applicability. An implementation partner can help prepare the management system, documentation and evidence that a customer questionnaire will ask about, but the answers must reflect how the organization actually governs its AI systems. Decisions about which Annex A controls apply, who is accountable for AI risk, and what the organization tells customers stay with the organization. A partner such as DeployOpen works inside the organization's own cloud accounts, data centers or air-gapped networks to build and document those systems, and only an independent certification body issues the ISO/IEC 42001 certificate. DeployOpen does not issue reports, attestations or certificates.
Before signing, ask the partner for a written scope that lists the deliverables, the systems in scope, the evidence it will prepare and the roles each party keeps. Most DeployOpen engagements are fixed-scope, and a quote follows from that written scope, so the scope document is where cost and effort are decided. Ask what recurs after the first audit, such as internal audits, management review, evidence refresh and support, and whether it is priced separately. Confirm that the partner will not sign off on the organization's controls or write its customer answers as if they were independently verified.
Check the certification body before you rely on the certificate in a questionnaire. Confirm that it holds accreditation for ISO/IEC 42001 from a recognized accreditation body. Accreditation is voluntary, and ISO/IEC 42006:2025 sets requirements on top of ISO/IEC 17021-1 for bodies certifying AI management systems, so ask the body how it meets them. Then confirm the certification body is independent of the consultant who prepared your system. A firm that designed the controls should not also be the one that audits them. Ask the body to show its accreditation scope in writing, and confirm that the certificate you send to customers names the correct scope.
How DeployOpen prepares questionnaire evidence for ISO 42001
DeployOpen helps organizations prepare the AI governance records, system configurations and evidence that sit behind ISO/IEC 42001 and customer questionnaires. We prepare systems and evidence for an assessment, but the organization owns its controls and an independent certification body issues any certificate.
How we scope
- We agree a written scope that names the AI systems, products and teams covered by the questionnaire answers.
- Scope documents which Annex A controls the organization expects to include and which it expects to exclude, with reasons.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
How we build
- We configure self-hosted open-source platforms in your own infrastructure to keep AI system inventories and records current.
- We draft policy, role and resource records so each questionnaire answer points to a specific, dated document.
- We test the AI-facing applications and APIs in scope and record findings alongside the governance evidence.
How we hand over
- We deliver an evidence index that maps each questionnaire topic to the document, log or test result that supports it.
- We document ownership, review dates and update steps so answers stay accurate after the engagement ends.
- We hand over the materials to your team, and your auditor or certification body reviews them independently.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the handover.
- A retainer can keep the evidence index current as new AI features, models or suppliers are added.
- Ask any partner which items on a customer questionnaire still need your own legal or certification review.
