The AI questionnaire, explained — with citations
- What actually changes on 2 August 2026 (and what does not) The duties that start that day, the ones that do not, the December transition — and what to have ready that week.
- Received a security questionnaire? The first-24-hours playbook Triage the format, protect the deadline, decide who answers, and dodge the two mistakes that actually kill deals in due diligence.
- The 6 ways to get a questionnaire answered — with real prices Freelance gigs ($40–200), specialist services, vCISOs ($1,500 standalone), automation SaaS and GRC platforms, honestly compared — including when not to pick us.
- Article 50 in numbers 7 paragraphs, 4 duties, 2 roles, 7 dates, 0 days of Omnibus delay — every figure derived from our open CC BY 4.0 dataset.
- The EU AI Act for US, UK, Canadian and Australian vendors Country-by-country: the two Article 2 triggers, what your domestic framework adds (and doesn't), and the transfer mechanics buyers ask about. UK · Canada · Australia
- GRC platform vs. questionnaire service vs. DIY Vanta-style platforms, done-for-you services and answering in-house solve different problems. Costs, timelines and the one-line decision rule.
- EU AI Act Article 50: who actually owes what The provider-vs-deployer trap that ruins half of questionnaire responses, the real dates after the Digital Omnibus, and what non-compliance actually costs an SME.
- Does the EU AI Act apply to your non-EU SaaS? The two Article 2 triggers (market and output) that reach US, LatAm and APAC vendors, what you owe and don't under Article 50, and why the questionnaire arrives either way.
- Your voice agent has to say it's an AI Article 50(1) for voice agents, AI SDRs and chatbots: who owes the disclosure, the "obviousness" exception honestly read, and the questionnaire question that tests it.
- Is your SaaS "high-risk"? Annex III, read calmly The closed list that touches HR tech, edtech and insurtech, the Article 6(3) carve-out for procedural tasks, the December 2027 date — and the classification answer buyers check first.
- How to answer the AI section of a security questionnaire The full method: inventory first, the two-layer training-data answer, surviving "are you AI Act compliant?", and the gap formula procurement accepts.
- The AI-CAIQ: what it is and how to answer it The CSA's AI questionnaire (Oct 2025) is landing on vendors' desks. What buyers look for, the training-data trap, and the small-vendor method.
- SIG 2026 added an AI risk domain What your buyer's third-party risk team now expects, answering the ISO 42001 question without certification, and the MCC-AI clauses coming for your contract.