AI Governance & Compliance for SMBs: Answering Cyber-Insurer and Vendor AI Questionnaires

To answer a cyber-insurer or vendor AI questionnaire, you need four things on paper: a list of the AI tools your people use, rules for what data can go into them, a named person who approves new tools, and a written AI acceptable use policy. With those in place, most questions take minutes instead of days, and your answers are true.

Your staff are probably already using AI: drafting emails, summarizing documents, writing code, or taking meeting notes. That’s often a good thing. But the businesses you work with, and the companies that insure you, increasingly want to know how you control it. The questions arrive in renewal forms, client security reviews, and vendor onboarding packets, often with a deadline.

After 25+ years in technology and security, we see the same pattern: the questions are reasonable, but most small businesses haven’t written the answers down yet. Here’s how to get ready.

---

Who is asking, and why

• Cyber insurers want to understand risk before they renew or price a policy. AI tools can create new ways for data to leak.
• Clients and partners (especially in finance, healthcare, and legal work) need to know their data is safe in your hands, because they answer to their own regulators and clients.
• Vendors and platforms may ask how you use AI features inside their products.

The wording changes, but they’re all asking one thing: do you know how AI is used in your business, and is it under control?

---

The five areas most questionnaires cover

1. Inventory: which AI tools do you use?

Expect questions like “Do you use generative AI tools?” and “List the AI tools in use.” You need a current list: the tool, who uses it, what for, and whether it’s a business account or someone’s personal login.

Tip: Ask your team. You’ll likely find tools you didn’t know about. Our post on shadow AI covers the warning signs.

2. Data: what goes into those tools?

Questions often ask whether confidential, client, or personal data is entered into AI tools, and whether the vendor can train on it. You need clear rules for what’s allowed, and you need to know each tool’s data settings.

3. Access and approval: who decides?

“Who approves new AI tools?” “Is multi-factor authentication required?” Name one owner, even in a small business, and a simple approval step for new tools or new AI features.

4. Policy and training: is it written down?

Many forms ask directly whether you have an AI acceptable use policy and whether staff have been told about it. A short, plain policy that people actually read beats a long one nobody opens. Our free AI Acceptable Use Policy template is a starting point.

5. Incidents: what if something goes wrong?

Expect questions about how you’d handle data entered into the wrong tool, or an AI output that causes harm. Add AI to your existing incident plan: who to tell, what to check, and who contacts the client or insurer.

---

How to answer well

1. Collect what you have. Policies, tool lists, settings screenshots, training notes.
2. Answer honestly. If something’s partly done, say so and give a date.
3. Keep evidence. Save the policy, the inventory, and proof of staff acknowledgment in one folder.
4. Reuse your answers. Build a short “AI controls summary” you can adapt for every new form.
5. Review regularly. Tools change fast. Update the inventory and policy on a schedule.

---

Frameworks help, but you don’t need a certificate to start

Public frameworks such as the NIST AI Risk Management Framework give you a helpful structure: govern, map, measure, manage. A small business doesn’t need a big program to be aligned to that structure. A named owner, an inventory, written rules, and a review schedule cover the core. Our AI governance framework guide explains it in plain English, and AI governance for small business covers the basics.

---

Nonprofits get these questions too

Funders, partners, and insurers ask nonprofits similar questions, often about donor and client data. The same five areas apply, and a board-approved AI policy goes a long way.

---

When to get help

If a questionnaire is due soon and you’re not sure what’s really happening with AI in your business, an outside review can save time. An AI Security Assessment looks at the tools in use, how data flows into them, access controls, and your written policies, then gives you clear findings you can use to answer questions honestly and close gaps.

---

Frequently asked questions

---

If you can think it, we can build it securely. Artificial Intelligence · Security · Applications · Hardware