Partners that can't account for their AI use or explain how customer information is handled risk delaying contracts and losing business to competitors.

“An AI questionnaire answer becomes a business commitment. The people building the product, handling customer data, and signing the contract need to be able to stand behind it,” says Shayne Adler, co-founder and CEO of Aetos Data Consulting in Washington, D.C. Even an employee independently using a public LLM to analyze customer data presents a potential risk, she adds, because “you can't govern what you can't see.”

Who is responsible for answering AI questions in RFPs?

As AI becomes even more ubiquitous in business operations, companies want to know where their data goes, who has access to it and if outside providers are using that information to train their AI models. These concerns are warranted. Earlier this year, autonomous AI agents running during OpenAI cybersecurity evaluations escaped their restricted environments and gained unauthorized access to systems belonging to Hugging Face.

We learned a lot from that highly publicized incident, namely that AI agents can bypass security controls and gain access to systems they were never authorized to enter. This raises new concerns about how outside providers use AI and protect customer information, and those concerns are making their way into requests for proposals (RFPs), vendor reviews and contract negotiations.

At the same time, sales teams are fielding questions about AI use and data security that require input from IT, security and legal departments. And they don't always have the answers.

Those questions are becoming part of the vendor review process, and companies need someone who can answer them accurately and consistently.

“Nobody inside the company owns the answers,” says Dave Shanker, co-founder and managing partner at STS Consulting Group in Austin. “The security questionnaire lands with sales, nobody can say for sure which AI services touch customer data, and the response ends up being a best guess that later turns into a contract obligation.”

5 ways to prepare for AI questions in RFPs and vendor reviews

Preparation starts well before the next RFP arrives. Here are five ways to get out in front of them: 

1. Take inventory of your AI use. Ask employees which tools they're using and what information they're entering. Encourage candid discussions without fear of disciplinary action. “Before RFP even becomes an issue,” says Adler, “you need to know what your own landscape is.”
2. Investigate outside providers. Adler recommends examining subcontractors, including AI features embedded in existing software. Trace the breadcrumbs to find out where customer information goes and who receives it.
3. Assign responsibility. Name one person to coordinate AI disclosures across technical, product and legal departments. That person should keep track of changes in AI use and make sure the company gives customers accurate, consistent answers.
4. Train your salespeople. Provide approved responses, establish boundaries for customer discussions and incorporate AI questions into existing security training. “That way,” says Shanker, “you can certify or attest that the salespeople took this training and have the information you've provided.”
5. Spell out AI use in vendor contracts. Document data handling requirements and require annual certifications. “Decide your position on model training and put it in writing,” Shanker says. “For example, if vendors are allowed to use customer data to train AI models, make sure that's spelled out in your contracts.”

Shanker says this should all be handled before the next RFP hits your inbox. “Keep a current list of which AI services you use, what data each one can see, and who owns it,” he says. “Then test that you can actually export and delete a customer's data when asked, because more buyers are going to ask you to prove it.”