Somewhere between the insurance certificates and the cyber security questions, larger clients have started asking what AI tools their suppliers use, whether client data goes into them, and who signed that off. Most small businesses cannot answer, because nobody ever decided staff simply started using things.
If you supply anyone larger than you, this is arriving. Here is what will be asked and how to be ready, which turns out to be a smaller job than it sounds.
Why this is landing on small suppliers
Large organisations have spent the past two years writing internal AI policies. Those policies do not stop at their own staff.
Governance obligations flow down a supply chain through contracts and due diligence. When a
client commits to controlling where its data goes, it has to ask the same of everyone it sends data to, which includes your firm. The questionnaire is simply that commitment arriving in your inbox.
The mistake is treating it as a technology question. It is a commercial one. Suppliers who cannot answer get delayed, escalated, or quietly dropped from a shortlist.
The questions you should be able to answer
Six come up repeatedly, and none require technical knowledge to answer well.
Which AI tools does your team use? Including the ones nobody approved. This is the hardest
question for most small firms and the one you should answer honestly.
Does any of our data go into them? Client names, documents, spreadsheets, correspondence. Be specific rather than reassuring.
Are our inputs used to train models? Consumer plans and business plans often differ here, and most firms do not know which they are on.
Where is the data processed, and under whose law? Increasingly asked by clients in regulated sectors and by anyone with their own EU or UK obligations.
Who approved it? A named person, not “the team”. Governance questions want an owner.
What happens when someone leaves? If an employee’s personal account holds three years of client work, that is a real exposure and an easy one to describe badly.
Answering “we don’t use AI” is a poor strategy. It is usually untrue, and it is increasingly not believed.
Get your own house in order first
Start by finding out what is actually being used, without making it a disciplinary matter. Shadow
usage almost always exists because the official route was slower than the deadline, and people will tell you if the question is asked neutrally.
Then write a policy that fits on one page. What may go into an AI tool, what may not, which tools are approved, and who to ask. Long policies do not get read and therefore do not change behaviour.
Give each approved tool a named owner responsible for deciding whether it stays. Unowned tools are the ones that turn up in a questionnaire nobody can answer.
Where UK law actually bites
This is less dramatic than headlines suggest, but it is not nothing.
The ICO requires a Data Protection Impact Assessment where processing is “likely to result in a high risk to the rights and freedoms of natural persons”. Its list of indicators includes the use of innovative technology, invisible processing where data is obtained indirectly, and large-scale profiling. Putting personal data through an AI tool frequently touches at least one.
That does not make AI unlawful. It means you are expected to have thought about the risk and recorded that you did. For most small firms, a short screening assessment covering what data goes in, why, and what could go wrong is proportionate and sufficient.
The failure mode regulators care about is not using AI. It is using it with personal data while having no idea that you are.
Choosing tools with the questionnaire in mind
Once you have seen the questions, tool selection changes shape. The useful criterion is no longer just capability, it is whether you can hand a client a straight answer about the tool’s data terms.
Sometimes that means moving from consumer to business plans on what you already use, which changes the default terms immediately. Sometimes it means choosing an AI assistant for business that does not train on your inputs at all. Often it means neither, and simply keeping client material out of these tools while using them freely for everything else.
Whatever you choose, keep the documentation. The single most useful artifact in a due diligence process is a one-page summary of which tools you use, what data touches them, and where that data goes.
The part that is actually an opportunity
Most of this reads as a burden. It is also a genuine advantage for firms that move early.
Procurement teams at larger organisations are being slowed down badly by suppliers who cannot answer these questions. A small firm that responds inside a day, with a clear one-page document, stands out against competitors who need three weeks and a meeting.
Several sectors are heading toward this becoming a standard rather than a differentiator.
Being early is worth more now than it will be in eighteen months.
What to do this month
Ask your team what they use, without consequences attached. Expect surprises.
Move anyone on consumer plans doing client work onto business plans. This is the highest-value hour in the whole exercise, because it changes the default data terms across the board.
Write the one-page policy and the one-page supplier answer at the same time they contain nearly the same information, aimed at two audiences.
Complete a short DPIA screening for anything touching personal data, and keep it on file.
Diarise a review in six months, because both the tools and the questions will have changed.
The short version
The questions are coming whether or not you are ready, and they are not difficult questions. They are simply questions nobody in your business has been asked before.
An afternoon spent finding out what your team actually uses, followed by two one-page documents, puts you ahead of most of your competitors on something clients are starting to weigh.
Business Matters covers this territory in more depth across its AI and technology sections
