Is your AI ready for your customer's security review?

Selling an AI product to a hospital, bank, insurer or large employer? Their security team will ask how your AI is tested, monitored and governed. Find out now what they will ask, and where you would get stuck.

About 3 minutes 10 quick questions No sign-up needed

Thank you; your results are on their way. Check your inbox for the full checklist. Someone from our team will read your answers and reply within one business day.

First, two things about your product

So the results match the reviews you are likely to face.

Who buys from you?

What does your AI do?

Your answers stay in your browser unless you choose to send them.

1 of 10

Where a reviewer would get stuck

Get the full checklist with suggested answers

We will email the complete checklist, and someone on our team will read your answers and send a short note on where to start. No newsletter, no sales sequence.

Have a review coming up?

Talk with our team for 20 minutes. Bring the questionnaire if you have one; we will tell you which answers you can give today and which need work first.

Talk with our team

Why this matters

The AI section is the new part of the security questionnaire

Enterprise buyers already ask about passwords, encryption and backups. Now they also ask how your AI behaves, and a startup without good answers can watch a signed-off deal sit in review for months.

It arrives late

The questionnaire usually comes after the buyer has said yes in principle. The deal now waits on answers nobody on your team has written.

Policy is not proof

A written policy says what your AI should do. Reviewers increasingly ask for evidence of what it actually does, tested and dated.

Passing once is not enough

Models and providers change quietly. Buyers want to know how you would notice if your AI stopped behaving the way it did when they approved it.

Common questions

About the AI part of a security review

When will a customer ask about our AI?

Usually during vendor security review, after the business side has agreed. Hospitals, banks and insurers now commonly include an AI section alongside the standard security questions.

Does SOC 2 cover our AI?

Only partly. SOC 2 covers your security controls in general; it does not show how your AI model behaves. Many buyers now ask both.

Which framework should our AI policy follow?

The NIST AI Risk Management Framework is the most widely referenced in the US. ISO/IEC 42001 is the international management-system standard. Either gives a reviewer something familiar to check against.