The questions buyers actually send — answered one by one

Each guide takes one real AI-questionnaire question: why buyers ask it, the honest answer structure, and the mistake that costs deals. Every legal claim cites its article.

• "Our buyer says we must be EU AI Act compliant by August 2" There is no binary "compliant" state. Which duties actually start that day, and the reply to send your buyer.
• "List every AI subprocessor and where data goes" The one table that serves both the GDPR review and the AI Act review — provider, processing region, transfer mechanism.
• "Are you ISO 42001 certified?" Answering honestly when you are not: equivalent controls you can evidence today, and a roadmap without invented dates.
• "Fill in our HECVAT" — the AI questions Higher-ed vendor assessments, plus the Article 5(1)(f) trap: emotion inference in education is prohibited outright.
• "Complete our vendor security assessment (VSA)" The custom spreadsheet with no standard behind it: mapping each question to a known framework, consistently.
• "Do you use AI in your product?" The inventory question. Why "no" is often wrong when you ship third-party models, and the Article 50(1) rebranding rule.
• "What data was your AI trained on?" The two-layer answer: your model supplier's documentation, then your own fine-tuning and RAG — without inventing either.
• "Are you compliant with the EU AI Act?" Why yes/no is a trap. Classification → applicable obligations → status per obligation → gaps with a plan.
• "Is our data used to train your AI models?" What the buyer really asks, what the standard enterprise API terms say, and why your signed DPA is the answer's anchor.
• "Do you have an AI governance policy?" The most common gap in 10–50-person vendors — and the honest answer with a dated remediation step.
• "Does your product make automated decisions about individuals?" The GDPR Article 22 crossover: what counts, what doesn't, and describing the real human role without inflating it.
• "Who is the provider of your AI system?" The rebranding rule, the most commonly misread part of Article 50, and how to split provider and deployer correctly.
• "What human oversight exists over your AI outputs?" Describing the real mechanism — review, thresholds, override — without using "human oversight" as a compliance talisman.