The 10 AI Security Questions Your First Enterprise Buyer Will Ask in 2027, With One-Sentence Answers

Edward Frank Morris runs an AI company. In October he posted about the half of a client rollout that never makes the demo:

Everyone wants to be a Forward Deployment Engineer now.

Nobody mentions the paperwork.

I run an AI company. The build is the fun half of a client rollout. Here are the 6 jobs in the other half, and who runs them now:

Edward Frank Morris (@ThatsEFM) · October 16, 2026

Every founder who has sold to a big company knows that Tuesday. In 2027 the questionnaire will carry an AI section, and that section is where a young company can look more prepared than vendors ten times its size, because the questions are new for everyone.

My brother Jon and I help founders answer these reviews. In my experience, the founders who move fastest have one habit in common: they answer each AI question in a single sentence they can prove. So this post is built that way. It gives you the ten AI security questions we expect from a first enterprise buyer in 2027, a one-sentence answer for each, the proof to attach, and what to send when the honest answer is “not yet.” Then come five addendums for buyers who bring their own rulebook, in healthcare, insurance, legal, finance and defense. At the end, a builder drafts every sentence for your company.

The short answer

Expect these ten AI security questions from your first enterprise buyer in 2027. Each one has a one-sentence answer you can send, once it’s true for you:

1. Do you train on our data? No: your data never trains or fine-tunes any model, ours or our providers’, and our data processing agreement says so.
2. Which models and AI providers touch our data, and what happens when that changes? Every model provider is listed on our sub-processor page, and we give you 30 days’ notice before adding or switching one that sees your data.
3. What can your agent do without a person approving it? It reads and drafts on its own, and anything that sends, deletes, spends money or changes access waits for a named person on your team.
4. Whose credentials does your agent use? Its own scoped, short-lived identity, never a person’s login or a shared key, so you can see it in your logs and revoke it in one place.
5. Who signs for the agent? A named person at our company owns every agent we ship and answers to you for it, and here is that person’s name.
6. What happens when your agent reads something an attacker wrote? We assume any text it reads can be hostile, so no single step can read untrusted content, reach your data and send data out without a person approving it.
7. Can we see what it did, and can we stop it? Every action is logged and exportable to your tools, and one switch stops the agent for your account in under a minute.
8. Who tested it, and can we see the results? An independent team tested our AI features this quarter, and we’ll share the dated letter and what we fixed.
9. When it’s wrong, who tells us, and who pays? We notify you within 48 hours of confirming an incident, and our insurance covers claims caused by our AI features, as the certificate shows.
10. Which AI rules and standards do you follow? We run an AI management system aligned to ISO/IEC 42001, mapped against the EU AI Act and the state laws that apply to you.

The numbers in those sentences, 30 days, 48 hours and under a minute, are examples, and so are the names and providers in the sentences below. Use yours. Regulated buyers then add a page of their own, and the addendums cover the extra questions from healthcare, insurance, legal, finance and defense. If a sentence isn’t true for you yet, send its dated not-yet version instead, which every section below includes. The builder drafts all of them.

Why one sentence

A security questionnaire looks like paperwork. It works more like a loan application. Your buyer is about to lend you three things it can’t easily take back: its data, its authority inside its own systems, and the reputation of the person who signs off on you. Every AI question in the review is a version of one question. What will you do with what we lend you, and what happens if you’re wrong?

That’s the tension underneath every AI section, and it explains why reviewers read answers the way they do. A reviewer who approves you is putting their name next to yours. The kindest thing a founder can do is make that approval easy to defend. One sentence does that in four ways.

It’s a decision. If you can’t answer in a sentence, the answer usually hasn’t been decided. “Who owns this agent?” gets a paragraph when nobody does. “Do you train on our data?” gets a paragraph when nobody has checked the setting at each model provider. Writing the sentence forces the decision, and the decision is the real work.

It’s a promise. Answers don’t stay in the spreadsheet. They get pasted into a risk register, attached to the contract and checked again at renewal. I wrote about the security exhibit most startups sign without reading in The Security Exhibit Your Startup Signed Last Quarter. Write each sentence as something you’ll be held to, because you will be.

It travels. Your champion forwards your answers to security, privacy and legal, often with an AI summarizing them on the way. A paragraph gets summarized by someone else. A sentence arrives the way you wrote it.

It can be checked. A good answer names something the buyer can verify: a clause, a setting, a date or a person. The notes for episode 75, our conversation with Jonathan Mortensen of Confident Security, open with three words that sum up the principle: “Contracts aren’t controls.” The contract makes the promise. The control keeps it. A good sentence points at both.

So every answer in this post has the same shape: a promise, the mechanism that keeps it, and the proof they can check.

A list that went around in October made the same point from the other direction. Mark Ajzenstadt wrote down what a weekend-built app still needs before a paying customer, and two of his lines describe this whole post:

Every week someone tells me they vibe-coded their app over the weekend and don't need developers anymore.

Before it touches a paying customer, make sure it includes:

…
> least-privilege access for everyone, including the AI agent holding production credentials
> answers to the security questionnaire every enterprise buyer sends, with evidence behind each one
…

Mark Ajzenstadt (@mardehaym) · October 15, 2026

One more principle before the questions. A dated “not yet” beats a confident paragraph. Security teams accept open items all the time, from vendors of every size. What they can’t work with is a “yes” that turns out to mean “mostly.” If a sentence isn’t true for you today, send the not-yet version: what you’ll have in place, by when, and who owns it.

Why 2027 is different

For years, a SOC 2 report ended a lot of security conversations early. Thomas Ptacek, who co-founded the security firm Matasano, put it this way on Hacker News in May, answering a solo founder who wanted SOC 2:

"It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires."

tptacek, replying in Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?, May 2026

The handshake still works for the standard questions, and it’s worth having. It doesn’t cover the AI section, because the SOC 2 trust services criteria don’t mention agents. Yash Kosaraju, the chief information security officer of a16z, described how his team reviews AI tools on episode 104:

Listen · Episode 104 with Yash Kosaraju

Three things changed in 2026, and each one is already showing up in next year’s questions.

The rulebooks got an AI chapter. In April the Health Sector Coordinating Council published a 109-page guide to third-party AI risk for health systems (HSCC). In February the Treasury Department released an AI risk management framework for financial services with 230 control objectives (ZwillGen). Insurance regulators in 12 states began piloting an AI evaluation tool in March (Fenwick). The SIG, one of the most widely used vendor questionnaires, added a mapping to ISO/IEC 42001 in its 2026 version (Mitratech). The Cloud Security Alliance’s AI questionnaire now runs to 320 questions, built on a controls matrix with 247 control objectives, as Jon covered in What Is a DDQ?. And OWASP’s first Top 10 for Agentic Applications, published in December 2025, gave every reviewer a shared list of what can go wrong with agents (OWASP). Your buyer’s AI section is likely adapted from one of these.

The laws got dates. On January 1, 2027, Colorado’s rewritten AI law takes effect. SB 26-189 replaced the 2024 act in May, and it requires developers to give deployers a statement of intended uses, known risks and limitations and the categories of training data, plus notice of material changes (Seyfarth). California’s rules for automated decision-making technology also require compliance from January 1, 2027, with risk assessments due by the end of that year (Hunton). In the EU, transparency obligations have applied since August 2, 2026, and the obligations for stand-alone high-risk systems arrive on December 2, 2027 under the Digital Omnibus, Regulation (EU) 2026/1744 (Hunton). Washington, meanwhile, is pushing back on state AI laws, and in April the Justice Department joined xAI’s challenge to Colorado’s earlier law (Axios). The map will keep moving, so buyers want to know that someone at your company is reading it.

Insurers started writing AI out. ISO’s generative AI exclusions for general liability took effect on January 1, 2026, and by July more than 60 property and casualty insurance groups had filed for AI exclusions, according to the Center for Strategic and International Studies (CSIS). When your buyer’s own insurance stops covering AI, your answer about who pays gets read twice. There’s more on that in question 9.

The buyers are saying the same thing out loud. In a January survey that Okta commissioned, 98 percent of 150 IT and security decision-makers said agent controls would factor into their renewals to some degree, and 69 percent said security concerns were slowing their adoption of agents (Okta). Okta sells identity, so read that as a direction rather than a measurement. Gartner predicted in June 2025 that more than 40 percent of agentic AI projects will be canceled by the end of 2027, with inadequate risk controls among the reasons (Gartner). The projects that survive will run on vendors whose answers held up.

1. Do you train on our data?

What they’re really asking. Will our data end up improving something we don’t own, or show up in someone else’s answer?

Why it’s on the 2027 list. In February, Judge Jed Rakoff of the Southern District of New York ruled that a defendant’s exchanges with a consumer AI tool were protected by neither attorney-client privilege nor the work-product doctrine, pointing in part to terms that let the provider train on prompts and disclose user data (Proskauer). The lesson most legal teams took from it: the terms decide. That’s why health systems now ask for contract language saying a vendor “cannot use organizational data to train or improve models without explicit written consent” (HSCC). And reviewers now ask about retrieval and caching as well as training. Tian Pan, writing about these reviews in April, lists whether one customer’s prompt can share a context window or a cache with another customer’s data among the questions regulated buyers send (Tian Pan).

The principle. A no-training promise is only as good as the settings behind it, at every model provider and inside your own product. Check both before you write the sentence. For a founder, it’s often the first AI question the champion’s legal team raises, so a crisp, provable answer here buys goodwill for the rest of the review.

Michael Moore, Glean’s general counsel, gave the buyer’s version on episode 73: “I would also expect very clear guardrails against training using that user’s data without their knowledge or consent.” His reason fits in one line about free tools, where “your data and your personal information is usually the payment, because nothing is really free.”

Suha Can, then Grammarly’s CISO, gave the vendor’s version on episode 52: “On training, we absolutely do not train on the data of our enterprise customers, and it’s just not something we do.” He also described Grammarly’s customer-held key, which lets an enterprise customer revoke Grammarly’s access to its data.

Attach: the training clause in your data processing agreement, each model provider’s training and retention terms with the settings you use, and a short description of how customer data stays separate in search, memory and caches.

If it’s not true yet: “We don’t train on customer data, and by [date] our data processing agreement will say so and our provider settings will be documented.” Jon and I wrote the long version of this answer, with a builder, in question 1 of the five agent questions.

2. Which models and AI providers touch our data, and what happens when that changes?

What they’re really asking. Who are our fourth parties, and will we hear about a change before it happens?

Why it’s on the 2027 list. Model providers ship and retire models on their own schedules, and your buyer inherits every change. Health systems now ask for “Advance notification requirements (e.g., 30 days for non-critical, 72 hours for security patches)” and the “right to delay or reject updates” (HSCC). Colorado’s new law requires developers to give deployers notice of material modifications (Seyfarth). And in September a federal appeals court upheld the Pentagon’s order excluding one model provider from its supply chain, which showed every defense buyer how fast a provider can become unusable for them. The defense addendum has the details.

The principle. Your model provider is your buyer’s fourth party, and you own the change. The ability to switch is part of the product: if you can move to another model in a week without changing what the customer sees, say so, because it’s one of the strongest answers on the page. Picking one provider is fine. Not knowing how you would leave it is the risk.

Attach: your sub-processor list with model, provider, region and retention, your change notice policy, and an AI bill of materials that lists every model and AI feature by version.

If it’s not true yet: “Today we use one provider, and by [date] we’ll publish the full list with a 30-day change notice in our contract.”

3. What can your agent do without a person approving it?

What they’re really asking. How much of our authority are you borrowing, and where does it stop?

Why it’s on the 2027 list. Agents moved from answering to acting, and the frameworks followed them. OWASP’s agentic list puts tool misuse and exploitation second and identity and privilege abuse third (OWASP). In Okta’s survey, 80 percent of decision-makers named over-privileged access as a top concern (Okta). Yash’s test on episode 104 is the shortest version: is it “a two-way read-write or just a read?”

The principle. Decide by consequence, not by tool. Reading and drafting can usually run on their own. Anything you can’t undo, anything that spends money and anything that reaches a customer should wait for a person, or not happen at all. For a founder, a tight scope is what lets a careful buyer say yes to a small start. Yash described how his team says yes to a new tool on the same episode: “If it’s a POC, that can have a subset of test data.” A pilot scoped like that gets approved faster, and it grows on its own results. It also answers the trap Yash named in the clip above, that “after the third click you don’t really read what’s in there,” because fewer approvals, each for something that matters, get read. We went deeper on approvals in The Human in the Loop Is Going Away.

Attach: a permission matrix with each action, whether it reads or writes and whether it needs approval, the exact OAuth scopes you request, and the admin settings that narrow them.

If it’s not true yet: “By [date] every action that sends, deletes, spends money or changes access will wait for your approval, and until then the agent stays read-only in your environment.” If you’re still deciding, start with Are You Actually Going to Give the Agent Write Access?

4. Whose credentials does your agent use?

What they’re really asking. When your agent acts, will our logs show it was the agent, and can we cut it off without breaking anything else?

Why it’s on the 2027 list. Identity is where agent risk turns concrete. Only 27 percent of the decision-makers in Okta’s survey agreed that their identity systems were fully equipped to govern non-human identities at scale (Okta). In September, Okta and eleven other companies, including AWS, Google Cloud, Salesforce and CrowdStrike, formed the Blueprint Alliance, whose principles tie each agent to “an accountable human owner or operational team” (Okta). OWASP lists identity and privilege abuse among its top three agent risks for the same reason.

The principle. A shared identity erases the answer to “who did this?” Per-agent identity is what makes your answers to questions 5 and 7 true, and it makes revocation, offboarding and incident response cheap. A buyer who can revoke your agent in one place can afford to say yes to it.

Attach: which identity each agent runs as, credential lifetime and rotation, and the steps to revoke one.

If it’s not true yet: “Our agents share a service credential today, and by [date] each one will have its own scoped identity that you can see and revoke.” Your Agents Share One API Key shows how to split one in an afternoon, the 30-minute credential inventory finds the borrowed keys, and the AI agent offboarding checklist covers what happens when an agent retires.

5. Who signs for the agent?

What they’re really asking. Who is the person we call, and does that person have the authority to change things?

Why it’s on the 2027 list. Microsoft’s supplier data protection requirements, version 12, ask AI suppliers to “Assign and clearly define responsibility and accountability for the operation, oversight, and risk management of AI Systems during and after deployment” (Microsoft). Colorado’s new law splits liability for algorithmic discrimination between developer and deployer by relative fault, and it voids indemnification clauses that shield either party from that liability (Seyfarth), so neither side can simply contract the question away. In the EU, deployers of high-risk systems must “assign human oversight to natural persons who have the necessary competence, training and authority” (AI Act Explorer), from December 2, 2027 for the uses listed in Annex III.

The principle. An agent is software. We choose its model, write its prompts, grant its permissions and decide to run it. When it acts, it does what we built it to do or what we let it do, so accountability lands on a person. For a founder, naming that person is one of the fastest ways to earn trust in a review, because it tells the buyer that someone has both the authority and the responsibility. Jon took this question to the main stage at AI LAX Summit in October, on a panel whose first topic was which person owns what an agent does.

Attach: a one-page accountability map with the owner, a backup and the escalation path for each agent, and the date of the last review of its permissions.

If it’s not true yet: this is the one question without a not-yet version. Name the person today. Jon’s accountability map builder drafts the page with you, and Who Signs for the Agent? explains how to decide what an agent may do on its own.

6. What happens when your agent reads something an attacker wrote?

What they’re really asking. Prompt injection. Can a web page, an email or a document turn your agent against us?

Why it’s on the 2027 list. The companies building the models now say it plainly. OpenAI wrote in December 2025 that “Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully ‘solved’” (OpenAI), and the UK’s National Cyber Security Centre warned the same month that prompt injection attacks “may never be totally mitigated” (NCSC). OWASP’s agentic list starts with agent goal hijack (OWASP). So reviewers have stopped asking whether you’ve solved it. They ask what a successful injection could do.

The principle. Contain it rather than hoping to detect it. Simon Willison’s “lethal trifecta” names the dangerous combination: private data, untrusted content and a way to send data out (Simon Willison). Meta’s Agents Rule of Two makes the same point as a design rule (Meta). Keep the three apart, and a successful injection runs into a wall. Jesse Anglen, the founder of Ruh.ai, gave the honest version on episode 106, describing a guard agent he and his CTO designed to screen what another agent reads:

Listen · Episode 106 with Jesse Anglen

For a founder, the honest answer earns more trust than a confident one here, because the buyer’s security team has read the same OpenAI post you have.

Attach: a threat model for each workflow, your outbound allowlist and approval rules, and the results of your last adversarial test.

If it’s not true yet: “By [date] the step that reads outside content will be separated from the step that can send data out, and an independent test will check it by [date].” The fuller answer is question 3 of the five agent questions, and why a refusal in the prompt isn’t a permission boundary is in Your AI Agent Said No. Your API Key Said Yes.

7. Can we see what it did, and can we stop it?

What they’re really asking. Can we investigate without you at 2 a.m., and how fast does it stop?

Why it’s on the 2027 list. Microsoft’s supplier requirements ask AI suppliers to support “turning features off, including time elapsed until the feature can be turned off” (Microsoft). The time is part of the requirement. OWASP’s agentic list ends with rogue agents, the ones that keep running after someone should have stopped them, and the HSCC guide asks health systems to make vendors take part in incident response by contract.

The principle. Visibility is what lets a buyer act without waiting for you, and the speed of the stop matters more than its existence. Time it. A switch you’ve measured becomes a demo you can run on the security call, and it’s often the most persuasive minute of the review. If you’re deciding what to log first, our blast radius playbook maps the first hours of an incident.

Attach: a sample log entry and its fields, retention and export options, and the stop-switch runbook with the measured time.

If it’s not true yet: “We log agent actions internally today, and by [date] your admins will be able to export those logs and stop the agent for your account themselves.”

8. Who tested it, and can we see the results?

What they’re really asking. Has anyone outside your company tried to break this, and did you fix what they found?

Why it’s on the 2027 list. Tested evidence for agents is becoming a market of its own. AIUC-1, a standard written for AI agents, puts certified systems through more than 5,000 adversarial simulations across six areas, including security, safety and reliability (ElevenLabs). Lovable announced its AIUC-1 certification in July (Lovable) and Cursor followed in August (Cursor). ISO/IEC 42001 certifies something different, the management system around the AI. The security leader Lenny Zeltser described the buyer’s job with both in May:

AIUC-1 certificates, new to the market, offer evidence that a vendor tested its AI agent against agent-specific risks such as prompt injection. AIUC-1 works alongside SOC 2 and other frameworks to form a fuller governance picture, with scope shaped by the choices the vendor makes at audit time.

Both the buyer and the vendor have to carefully consider the scope, since AIUC-1 doesn't define "AI agent." The vendor decides which agent, tools, and data flows the audit will cover. The buyer should verify whether the audit matches what their organization actually uses.

AIUC-1 covers ground that existing certifications don't, and ISO 42001 certifies the management system around the agent. Together, they form a more complete picture than either alone. How AIUC-1 handles scope, auditor dynamics, and incentive alignment will shape what its certificates are worth over time.

Lenny Zeltser (@lennyzeltser) · May 7, 2026

Not everyone is sold on the new certificates. Zack Korman makes the skeptic’s case in a video he titled “Cybersecurity’s newest grift: AIUC-1.” Watch it next to the enthusiasts before you pay for anything.

The principle. Evidence beats adjectives, and scope is the whole game. A narrow certificate on a different product is weaker than an honest, scoped letter on the one the buyer will use. For a founder, that means picking the test whose scope matches what your buyer will deploy, and saying what was out of scope before they ask. Our view on cadence is in Pentest Once a Year?: annual is the floor, not the proof.

Attach: the dated test letter with its scope, the findings and the date each was fixed, the retest date, and the evaluation you run on every release.

If it’s not true yet: “Our first independent test of the AI features is booked for [month], and we’ll share the letter within two weeks of the retest.” Our AI red teaming team runs exactly this kind of scoped test.

9. When it’s wrong, who tells us, and who pays?

What they’re really asking. Will you call us before we find out some other way, and is there money behind your promises?

Why it’s on the 2027 list. The insurance market is moving under everyone’s feet. ISO’s generative AI exclusions for general liability took effect on January 1, 2026, and Verisk, which publishes the ISO forms, confirmed in July that it was drafting exclusions for agentic AI (CSIS). W.R. Berkley introduced what Insurance Journal describes as an “absolute” AI exclusion for its directors and officers, errors and omissions and fiduciary liability products (Insurance Journal). Gregory C. Allen of CSIS summed up the stakes in September: “an activity that cannot be insured is an activity that is effectively prohibited” (CSIS). Coverage written for AI is arriving at the same time. ElevenLabs launched an insurance policy backed by its AIUC-1 certification in February (ElevenLabs), and NBC News has reported on Munich Re’s aiSure and on Armilla, a Toronto company that sells AI insurance (NBC News).

@elevenlabs just became the first voice agent to be AIUC-1 certified and insured.

Enterprises want to deploy AI agents. But the question holding back adoption isn't "can it work?" - it's "can we trust it?"

AIUC-1 fills that gap. A rigorous, independent certification that validates ElevenLabs' leadership in designing and deploying secure AI agents.

They opened their systems to scrutiny, met the bar, and earned the right to say: our voice agents are certified and insured.

Congratulations to @matiii and the @elevenlabs team!

Rune Kvist (@RuneKvist) · February 18, 2026

The principle. When your buyer’s own insurers are writing AI out, the buyer asks whether yours still covers it. Read your policies for AI exclusions before the buyer does, and ask your broker at renewal for coverage that names your AI features. A certificate is a one-page proof that someone outside your company priced your risk and still wrote the policy. The insurance clauses in your customer contracts are covered in the security exhibit post.

Attach: your incident response plan with AI scenarios, the notification clause in hours, your certificate of insurance and the policy’s AI language.

If it’s not true yet: “By [date] our incident plan will commit to notice within 48 hours, and at our [month] renewal we’ll confirm in writing that our insurance covers our AI features.”

10. Which AI rules and standards do you follow?

What they’re really asking. Is anyone at your company watching the rules, and can you prove it?

Why it’s on the 2027 list. The question banks are converging on a few names, and the 2026 SIG now maps to ISO/IEC 42001 (Mitratech). The laws on the 2027 timeline above all ask for similar things: an inventory, documentation of intended use and limits, and a named owner. And the customers who care most don’t wait for regulators. Our own ISO/IEC 42001 case study begins with an AI company that “almost lost a strategic enterprise deal after failing to comply” with a customer’s AI committee requirements, then cleared its certification audit on day 93. (A disclosure: Jon was Augment Code’s chief security officer.)

The principle. Standards are a shared vocabulary, not a finish line. The quickest credible step is an AI policy, an inventory of every AI system you build or use, including the tools your own team uses, and a one-page mapping to the frameworks your buyers name. Certify when a buyer asks, or when the deal size justifies it. Shadow AI is where most inventories turn out incomplete, and our AI governance maturity model shows what each level looks like.

Attach: your AI policy, the inventory, the framework mapping and a certificate if you have one.

If it’s not true yet: “By [date] we’ll publish our AI policy and an inventory of every AI system we build or use, mapped against the EU AI Act and the state laws that apply to you.” Our ISO 42001 and EU AI Act teams build these documents with founders.

If you want the reasoning behind that table, how reviewers weigh one kind of evidence against another and how fresh each piece has to be, I wrote it up in From AI Policy to Proof, with a builder that turns your AI policy into an evidence pack.

Addendums for regulated buyers

Some buyers bring a page of their own. The ten questions still apply to them, and five industries add more, each anchored in rules their own regulators enforce. These are the three extra questions you’re most likely to see from each, with the one-sentence answer.

Healthcare addendum: what health systems ask AI vendors

Health systems read AI vendors through HIPAA’s business associate rules and, since April, the HSCC’s guide to third-party AI risk. Rob Suarez of CareFirst BlueCross BlueShield described the motivation when the guide came out: “Healthcare organizations require clear answers to what third party suppliers of AI are and are not doing” (GovInfoSecurity).

One more rule is coming. The update to the HIPAA Security Rule proposed in January 2025 isn’t final, and its target date is now July 2027. As proposed, it would give business associates 24 hours to tell covered entities when they activate their contingency plans, and require covered entities to get written verification of each vendor’s technical safeguards at least once a year (HIPAA Journal). Plan for both now and you’ll have nothing to rebuild if it lands.

Is every AI provider that touches PHI under a BAA that covers the features you use?

The HSCC guide asks about the “Existence of BAAs with all AI subcontractors” (HSCC), and model providers’ agreements often cover some of their features and not others, so the question is about features, not logos. Mark Ajzenstadt’s list from October has the line too: “a BAA with every vendor that touches that data, including your AI model provider.” Attach your BAA, each AI provider’s BAA with the features it covers, and a data flow diagram that shows where protected health information goes.

What’s in your AI bill of materials, and how will you tell us before a model changes?

The guide asks for an “AI Bill of Materials (AI BOM)” listing which features are AI-capable and enabled, along with “Advance notification requirements (e.g., 30 days for non-critical, 72 hours for security patches)” and the “right to delay or reject updates” (HSCC). Those numbers are the guide’s examples, and they make a reasonable default to offer. Attach the AI bill of materials, your change notice and rollback terms, and the validation results from your last model change.

How do you watch for drift and bias, and who reports a safety event?

The guide asks for “Bias assessment and mitigation strategies,” “Notification procedures for performance degradation” and “No limitation on vendor’s obligation to report safety events to regulators” (HSCC). Attach your monitoring metrics and schedule, your bias testing method and latest results, and the notice terms.

I wrote the full version of a health system review, with a 24-question pre-flight and an answer pack, in The Health System Security Review Your BAA Won’t Pass. Our AI and HIPAA work covers the model-provider side, and HIPAA compliance and HITRUST certification cover the rest. For the view from inside government health IT, listen to Jose Arrieta, the former chief information officer of HHS, on episode 40.

Insurance addendum: what insurers ask AI vendors

Insurers are regulated on how they use AI, and their regulators expect them to oversee the vendors they buy it from. The NAIC’s model bulletin on insurers’ use of AI had been adopted in 29 jurisdictions as of October 8, 2026, and California, Colorado, New York and Texas have insurance-specific AI rules or guidance of their own (NAIC). The bulletin makes insurers responsible for vendor diligence and suggests contract terms that allow audits (Quarles). Twelve states have piloted the NAIC’s AI Systems Evaluation Tool since March, with exhibits on how much AI an insurer uses, how it governs it, its high-risk systems and its data, and regulators planned to consider adopting it at their fall meeting (Fenwick). The NAIC is also working on a registration framework for third-party data and model vendors whose products feed “pricing, underwriting, claims, utilization review, marketing, and fraud detection” (Foley). If your product touches any of those, expect your buyer to ask how ready you are.

Will you help us answer our regulator?

New York’s Circular Letter No. 7 tells insurers to include terms in their vendor contracts that “provide audit rights or entitle the insurer to receive audit reports by qualified auditing entities” and “require the third-party vendor to cooperate with the insurer regarding regulatory inquiries and investigations” (NY DFS). Offer both before they ask. Attach the two clauses, your latest independent audit report and a short system description written for a regulator.

How do we know it doesn’t discriminate unfairly?

The same letter is direct about why: “An insurer may not rely solely on a third-party’s claim of non-discrimination or a proprietary third-party process to determine compliance with anti-discrimination laws” (NY DFS). Your word can’t be the answer, by rule, so make your testing something their team can repeat. Attach the method and latest results, the data sources including any external consumer data, and how a wrong data point gets corrected.

Which insurance decisions does it touch?

Regulators in the pilot are prioritizing high-risk systems that can cause serious harm to consumers or finances over low-risk back-office tools (Fenwick). The more precisely you describe where a person decides, the easier your system is to place on the right list. Attach a one-page description of purpose, inputs, outputs and who decides, and an entry they can paste into their AI inventory.

For a founder’s view of AI governance from the data side, listen to Abhi Sharma of Relyance AI on episode 70. Our ISO 42001 and AI red teaming work produces the documentation and the test results insurers ask for.

Legal addendum: what law firms ask legal AI vendors

Lawyers carry the duty of confidentiality personally, so they read AI terms more closely than almost anyone. ABA Formal Opinion 512, from July 2024, says that “a client’s informed consent is required prior to inputting information relating to the representation into” a self-learning generative AI tool, and asks lawyers to start by reading and understanding “the Terms of Use, privacy policy, and related contractual terms” (The Bar Examiner). Then came February’s ruling in United States v. Heppner, where Judge Rakoff held that a defendant’s exchanges with a consumer AI tool were not privileged. The court left open whether an enterprise product with no training on user data and contractual confidentiality commitments would come out differently (Proskauer).

Are you talking to AI about legal matters? Be careful.

He chatted with Claude about his legal strategy.

Then discussed with his lawyers.

A Federal judge just ruled that those AI chat logs have zero legal privilege

John Scott-Railton (@jsrailton) · February 11, 2026

Hacker News asked the vendor question directly, in a thread on the ruling:

"Does this analysis change if using on-site AI? What if the ToS is different?"

Kim_Bruning, commenting on US v. Heppner (S.D.N.Y. 2026) no attorney-client privilege for AI chats, April 2026

Your terms are the answer to that question, which is why the first sentence below matters so much.

Can our lawyers use it without risking confidentiality or privilege?

Notice what the sentence doesn’t promise. Privilege is for courts to decide, so say what your terms do and let the firm’s counsel draw the conclusion. Attach your enterprise terms on training, secondary use and disclosure, each model provider’s terms for the plan you use, and your retention, legal hold and export settings.

Does it respect our ethical walls and matter access?

A firm’s ethical walls keep one client’s team out of another client’s files. An AI index that ignores them can cross a wall without anyone noticing. Attach how permissions are inherited, a test that shows a wall holding on a sample matter, and the access log for a matter.

How do we know a citation is real?

Damien Charlotin’s database of AI hallucination cases counted 1,240 reported instances in US filings as of July 27, 2026, with 668 of them in 2026 alone (Maryland State Bar Association). Attach an example output with linked citations, how unlinked citations are flagged, and the review step before anything is filed.

Tony Thai, a software engineer turned law firm attorney who founded HyperDraft, talked about building software for lawyers on episode 51. If you’re about to answer a law firm’s review, our sales support team answers it with you, and our AI access control audits check the ethical-wall sentence against your system before you send it.

Finance addendum: what banks and financial firms ask AI vendors

Banks and broker-dealers have long-standing vendor rules, and three of them changed in 2026. Amended Regulation S-P requires covered institutions to oversee service providers and to make sure those providers notify them “as soon as possible, but no later than 72 hours after becoming aware of a breach involving customer information,” with smaller firms in scope from June 3, 2026 (Davis Wright Tremaine). In April the banking agencies replaced their 2011 model risk guidance with a version that covers vendor and third-party products and their validation, while leaving generative and agentic AI out of scope for now, pending a future request for information (OCC). And Treasury’s Financial Services AI Risk Management Framework, published in February, sets out 230 control objectives, including due diligence on data provenance and secondary use, fourth-party disclosure and termination rights for third-party AI (ZwillGen).

Will you notify us within 72 hours of a breach?

The rule’s own words make the best sentence, so use them. Attach the notification clause, the 72-hour step in your incident response plan and the date of your last tabletop exercise.

Can our model risk team validate it?

Generative and agentic AI sit outside the new guidance’s scope for now, and banks still have to manage the risk. The documentation you hand over is what lets a model risk team do its job without guessing. Attach documentation of intended use and limitations, test results and ongoing monitoring metrics, and your change log with its notice terms.

If we have to leave, how do we get out?

Exit planning and concentration risk are standard parts of bank vendor management, and Treasury’s framework names fourth-party disclosure and termination rights for AI specifically. A clean exit is also a sales argument: a buyer who knows how to leave finds it easier to start. Attach your export formats with a sample export, your transition support terms and your fourth-party list.

For a founder who sold into banks first and defense later, listen to Deepak Dutt of Zighra on episode 78. Bank reviews usually ask for a SOC 2 Type 2 report and a recent penetration test as well, so have both ready.

Defense addendum: what defense buyers ask AI vendors

Defense buyers bring the most specific rules of all. DFARS 252.204-7012 still governs controlled unclassified information (CUI): it requires adequate security, defines rapid reporting as “within 72 hours of discovery of any cyber incident,” and requires any external cloud service that stores, processes or transmits covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline (DFARS 252.204-7012). The second phase of CMMC, which would have required third-party assessments for Level 2 starting November 10, 2026, was suspended on July 13 for a program review. The Department was clear that “All Phase I self-assessment requirements remain firmly in place” (WilmerHale). And Section 1513 of the 2026 defense authorization act directs the Pentagon to build a security framework for AI and machine learning as an “extension or augmentation” of existing frameworks such as CMMC, then fold it into DFARS (Crowell). Expect a CMMC for AI.

One case also changed how defense buyers think about model providers. On September 25, a divided panel of the D.C. Circuit upheld the Pentagon’s order under the Federal Acquisition Supply Chain Security Act excluding Anthropic from its supply chain, after a federal court in California had ruled a separate designation unlawful in August (Holland & Knight). Anthropic has asked the full court to rehear the case (Lawfare). Whatever you think of the dispute, the lesson for a founder is portability. The contract clause that carries such orders, FAR 52.204-30, bars contractors from providing or using a covered product “as part of the performance of the contract,” so a defense buyer can need you to change model providers on short notice.

Where does our CUI go when your AI processes it?

A model endpoint that processes covered defense information is an external cloud service under the clause like any other, so it needs the same equivalency as your storage. Attach a boundary diagram that shows every hop, the FedRAMP authorization or equivalency evidence for each service, and your NIST SP 800-171 self-assessment score.

Which model providers are in what you deliver, and can you swap one fast?

Build the swap before anyone asks for it, then run it once so the sentence is a fact. Attach the model provider list for the deliverable, the results of your last switch test, and how you track exclusion orders and contract clauses.

Who, and what, can touch our environment?

AI tools are a new path for CUI and export-controlled technical data to leave a boundary, so defense buyers now ask about tools the way they ask about people. Attach the named access list with US person status where required, the approved AI tool list for the program, and your device and account policy.

Listen · Episode 78 with Deepak Dutt

For more on selling into defense, read How to Build a Defense Tech Startup and listen to Garrett Smith of Reveal Technology, a Marine Corps Reserve lieutenant colonel, on episode 90. Our CMMC Level 2, ITAR compliance and FedRAMP teams build the boundary and the paperwork that make these three sentences true.

Build your one-sentence answers

Fill in the facts once, pick the status that’s honestly true for each question, and choose an industry if your buyer has one. The builder drafts every sentence, swaps in the dated not-yet version where you need it, and lists what to attach. Change any sentence that isn’t exactly true for you before you send it.

Interactive · 10 minutes · Runs in your browser

The one-sentence answer builder

Start with the facts you know. Leave a field empty and the sentence keeps a bracket where your fact goes.

Industry addendumNoneHealthcareInsuranceLegalFinanceDefense

The builder needs JavaScript. The ten questions, the one-sentence answers and the addendums are written out above.

Load an example company Start over

…where you stand

…true, with proof

…proof coming

…not yet, with a date

Copy every sentence Download (.md) Print

Everything here runs in your browser and is saved only in this browser. The sentences are a starting point. Send only what's true for your company.

Have an operator check them →

We get your email, the industry you picked and the status of each question, never the details you typed. Jon or I reply to set up a review of your real questionnaire. No sequence.

How to send them

The sentences do most of the work. A few habits do the rest.

Put them where buyers already look. A trust page with current answers saves you from rewriting them for every buyer, and it shows that you take your own security seriously. Jon noticed exactly that on episode 50, when he opened RunReveal’s trust center in the middle of the recording with Alan Braithwaite:

Listen · Episode 50 with Alan Braithwaite

Keep them alive. Agent products change fast. When a model, a scope or a retention period changes, update the sentence and tell the customers who received the old one. That’s question 2 answered in practice, and buyers notice.

Check every yes before it leaves. Read each “yes” against the system it describes, because enabled isn’t enforced. If the buyer sent a due diligence questionnaire rather than a security one, What Is a DDQ? explains the difference, and if your SOC 2 audit is still underway, SOC 2 in Progress? has the words to use.

Offer one call between security people. Thirty minutes between your security owner and theirs resolves more follow-ups than a week of email. If you don’t have a security owner yet, that’s what an on-demand team is for.

If your first enterprise deal is also your first big sale, Y Combinator’s Startup School talk on enterprise sales covers the rest of the process the security review sits inside.

We’re taking this subject to MicroConf US in Austin next April, where YSecurity is a sponsor and our talk is “How Founders Turn Security Commitments Into Revenue.” It’s on our events page, along with field notes from the stages and booths we’ve been at.

Ten sentences won’t close a deal on their own. They do something quieter: they show a stranger in a security team that you know what you built, that someone owns it, and that you’ll tell the truth when the answer is “not yet.” That’s what they’re actually buying.

Sasha