Why are clients asking in the first place?
Two or three years ago, the supplier questionnaire asked about insurance, information security, modern slavery and business continuity. Now it asks about AI. Sometimes it is a line in an annual supplier review, sometimes a page of questions in a procurement portal with a character limit and no room to explain, sometimes a client's own policy sent over with a request to confirm you comply.
The reason is simple. Your client's own regulator, board or customers have started asking them the same questions, and they are passing the obligation down the chain. A bank asks its law firms. A listed company asks its advisers. A public body procuring under the Procurement Act 2023 asks everyone on the framework. Nobody is trying to catch you out. They are filling in their own form.
That tells you what a good answer looks like. It is not a position statement about technology. It is evidence that somebody at your firm knows what is happening and can account for it.
What are the questions actually trying to establish?
Strip away the wording and most questionnaires want four things.
- What leaves the building. Does client material go into a third party system, which one, under what terms, and does anything get used to train a model.
- Who is accountable. Is there a policy, does anyone own it, and does a named human approve work before it reaches the client.
- Whether you know what you are doing. Can you describe the specific processes AI touches, or do you answer in generalities.
- What happens when it goes wrong. How errors are caught, what gets logged, and who the client calls.
Those are reasonable questions. They are also questions a firm cannot answer unless it has mapped its own work. A firm that has rebuilt a defined process knows which documents feed it, which tools it runs in and who signs the output. A firm where people quietly adopted whatever they found useful cannot answer honestly at all, which is the real cost of shadow AI.
Why do firms answer these badly?
The common failure is not dishonesty. It is inconsistency. One partner answers a form in March saying the firm uses AI for drafting under supervision. Another answers a different client in June saying the firm does not use AI on client matters. Both believe they are telling the truth, because neither knows what the other practice group is doing. If those two clients compare notes, or the same client sends the form to two offices, you have a problem no careful wording will fix.
The second failure is overclaiming in the other direction. A firm that wants to look modern writes about its AI capability in a bid, then fills in the due diligence form as though nothing had changed. The bid team and the risk team are describing different firms. We have written separately about mentioning AI in a pitch, and the rule is the same here: whatever you say in the pitch has to survive the questionnaire that follows it.
The third failure is the blank. Procurement teams read an unanswered question as a concealed answer. If something genuinely does not apply, write a sentence saying why.
What should a standing answer set contain?
Write the answers once, properly, and reuse them. A usable set covers:
- Scope. The named processes where AI is used, in your own vocabulary: client reporting, bid production, file notes. Specific beats general every time.
- Tools and suppliers. What you use, who provides it, where processing happens, and whether a sub-processor is involved. This is what you should already have gathered when reading the vendor contract.
- Data handling. What client material is entered, what is excluded, retention, deletion and whether inputs are used for training. The guide to data protection in AI client work covers the ground, and your answers should sit comfortably alongside your UK GDPR position.
- Human review. Who checks the output, against what, and who signs it before it goes out. The honest version of how review actually works convinces more than a promise that everything is checked.
- Governance. Your AI policy, who owns it, when it was last reviewed, and how staff are trained on it.
- Opt out. Whether a client can ask you not to use AI on their work, and what that means in practice.
Keep each answer short and factual. Date the set and version it. Treat it the way you treat your standard insurance and security responses, because that is what it has become.
Who should own it and who signs it off?
One person, named. In most firms of this size that is whoever owns risk and compliance, working with whoever leads on technology. The job is not to write prose. It is to keep the answers matching reality, approve any variation a partner wants for a particular client, and log which clients have been told what.
The alternative is the arrangement most firms have now, where the fee earner who received the form answers it between other work. That produces speed and inconsistency, and it means nobody can tell you later what the firm has already committed to.
The same discipline applies in reverse. If you send questionnaires to your own suppliers, that deserves the same treatment as any other supplier vetting.
What if the true answer is uncomfortable?
Sometimes it will be. You may have to say that AI assists with first drafts, that a transcription feature is on by default, or that a policy exists but training has not happened yet. Say it, and say what you are doing about it. Procurement teams deal with imperfect suppliers daily. What they cannot work with is an answer that falls apart on the second question.
There is a practical benefit to the discomfort. A questionnaire you cannot answer well is a precise list of the gaps in your governance. Cheaper to find them in a form than in a complaint, an insurance renewal or a conversation with a body such as the SRA, the ICAEW or the FCA.
What should a firm do about this in the next month?
Collect every AI question you have been sent in the last year, from clients, insurers and panel reviews. Put the questions in one list with the answers given next to them. You will see immediately whether the firm has been speaking with one voice.
Then write the standing set, get it approved, and store it where the bid team and the risk team both look. If responding to these documents is now a regular drain on senior time, it belongs with the rest of your tender response work and can be rebuilt the same way.
Finally, make sure what you write is true of the work itself, not just the policy shelf. If you are not sure where to start, the audit will point at the process that matters most, and telling clients you use AI covers the conversation that follows.