Enterprise Buyers Are Asking About AI Governance and Ethics — Here’s What They Want

There’s a new section in vendor security questionnaires that didn’t exist 12 months ago.

It’s got 10–15 questions. It’s specifically about AI. And if you’re an AI-enabled SaaS company selling into enterprise accounts, it’s going to land in your inbox mid-deal — right when you thought procurement was a formality.

I’ve spent 30+ years in IT security, and I’ve watched this movie before. First it was SOC 2. Then it was privacy and GDPR. Now it’s ai governance and ethics. The pattern is always the same: enterprise buyers start asking questions, vendors scramble, and the ones who prepared early close deals while everyone else stalls.

Here’s what’s actually happening — and what you can do about it right now.

---

The 5 AI Governance and Ethics Questions Enterprise Buyers Keep Asking

These aren’t hypothetical. These are real questions pulled from actual vendor security questionnaires that enterprise procurement teams are sending today:

1. “Do you use AI/ML models in your product? If so, which ones?”

Sounds simple. It’s not. They don’t want “yes, we use AI.” They want specifics — which providers, which models, which versions. They want to know if you’re running GPT-4, Claude 3, Gemini, or something fine-tuned. And they want to know if you actually know the answer or if you have to go ask engineering.

2. “Where is customer data processed by AI systems? Is it sent to third-party AI providers?”

This is the data flow question. When a customer types something into your product and it hits an AI model — where does that data go? Which provider’s servers? Which country? Is it retained for training? Do you have a Data Processing Agreement in place?

3. “What is your AI model governance policy? Who approves new model deployments?”

Translation: do you have a process, or does any developer on the team just drop in a new model whenever they feel like it? Buyers want to see that someone — a person with a name and a title — owns AI decisions.

4. “Do you maintain an inventory of all AI models and their versions?”

This catches more companies than you’d expect. Most teams know they use OpenAI. Fewer can tell you exactly which models are in production, which version they’re pinned to, and what happens when the provider releases an update.

5. “Have you assessed your AI systems against NIST AI RMF or ISO 42001?”

This is the frameworks question. NIST AI RMF is the US standard. ISO 42001 is the international one. The EU AI Act is actual law with fines up to 7% of global revenue. Buyers don’t expect you to be certified — but they expect you to know where you stand.

---

Strong Answers vs. Weak Answers — AI Governance and Ethics in Practice

Here’s the thing — the gap between a strong answer and a weak one isn’t about being perfect. It’s about being specific.

Let me show you what I mean.

The Model Inventory Question

Weak answer: “Yes, we use AI responsibly and follow best practices.”

Strong answer: “We use Anthropic Claude 3 Sonnet (pinned to version claude-3-sonnet-20240229) for document summarization and OpenAI GPT-4 Turbo for customer support suggestions. Both are documented in our AI model registry with approved use cases, data flow diagrams, and DPAs on file.”

See the difference? The weak answer sounds nice but says nothing. The strong answer tells the buyer exactly what they need to hear — specifics, documentation, evidence.

The Data Flow Question

Weak answer: “We take data privacy seriously and comply with applicable regulations.”

Strong answer: “Customer data sent to our AI features is processed via Anthropic’s API. We have a DPA in place. Anthropic does not use customer prompts for model training under our enterprise agreement. Data is processed in US-East-1. We strip PII from prompts before they reach the API.”

One answer generates follow-up questions. The other closes them.

The Governance Process Question

Weak answer: “Our engineering team reviews AI usage as part of our development process.”

Strong answer: “Our CTO approves all new AI model deployments. We maintain an AI model registry that tracks provider, model version, approved use case, data classification, and last review date. Changes to AI models go through the same change management process as production deployments.”

Look — the gap between these answers is about minutes of automated scanning. Not a 6-month compliance project. Not a $200K consulting engagement. Minutes. That’s it.

---

The Documents Buyers Expect to See

Answering questions in an email thread isn’t enough anymore. Enterprise procurement teams expect documents — structured, professional artifacts they can file in their vendor risk management system.

Here’s what they’re looking for:

AI Model Inventory — A registry of every AI model in your product. Provider, model name, version, purpose, data classification, approval date, and owner. If you can’t produce this in 30 minutes, that’s your first gap.

AI Risk Assessment — A structured analysis of what risks your AI usage creates. Data privacy risks (where does customer data go?). Model governance risks (who approves changes?). Security risks (are API keys hardcoded?). Transparency risks (do users know they’re interacting with AI?).

Compliance Control Mapping — This is the big one. Enterprise buyers want to see your AI controls mapped against recognized frameworks — NIST AI RMF, ISO 42001, EU AI Act. Not a full certification. A mapping that shows: here are the controls we have in place (mapped), here’s where we’re working on it (partial), and here’s what we still need (gap). That honesty actually builds trust.

30/60/90 Day Remediation Plan — Buyers don’t expect zero gaps. They expect a plan. Show them your priority order: what you’ll fix in 30 days (critical items), 60 days (process hardening), and 90 days (governance operations). A startup with a documented plan beats a larger competitor with vague promises every time.

---

Why “We Use AI Responsibly” Doesn’t Cut It Anymore

I get it. You probably do use AI responsibly. Your engineers are thoughtful. Your product team cares about user experience. You’re not doing anything reckless.

But here’s the problem — “we use AI responsibly” is what every company says. The ones that get hacked say it. The ones with data leaks say it. The ones that accidentally send customer PII to a training dataset say it.

Enterprise buyers have heard it a thousand times. It’s become meaningless.

What they want instead is evidence. Not promises — artifacts. Show me the model inventory. Show me the data flow diagram. Show me the control mapping. Show me who owns AI risk.

It’s the same evolution we went through with security posture. Ten years ago, “we take security seriously” was a fine answer. Then Equifax happened. Then SolarWinds happened. Now nobody accepts that answer — they want your SOC 2 report, your pen test results, your vulnerability management process.

AI governance is on the exact same trajectory. We’re just earlier in the curve. The companies that figure this out now get to close deals while their competitors are still writing policy documents in Google Docs at 11pm the night before a procurement deadline.

---

How to Build a Governance Proof Pack From Your Actual Codebase

Here’s where most companies go wrong — they start with policy templates.

They download a generic AI governance policy from the internet, fill in their company name, and call it done. It’s checkbox compliance. And it creates a weird incentive — companies get really good at writing policies that sound right while the actual codebase tells a completely different story.

The better approach? Start with what’s actually in your code.

Step 1: Know what AI you’re actually using. Scan your repos. Not a manual review where someone eyeballs imports — an actual scan that catches every AI SDK, every model reference, every dependency. You need to find the OpenAI calls in your service layer, the Anthropic imports in your backend, the LangChain orchestration in your pipeline. All of it.

Step 2: Map the data flows. For every AI integration you find, trace the data. What goes in? What comes out? Where does the provider process it? Is there a DPA? Does the provider retain anything? This is the stuff that keeps CISOs up at night — and it’s the first thing they ask about.

Step 3: Assess against frameworks. Take your AI inventory and map it against NIST AI RMF, ISO 42001, and the EU AI Act. For each control, mark it as mapped, partial, or gap. Be honest — gaps are fine as long as you have a plan to close them.

Step 4: Build the remediation roadmap. Prioritize by severity and business impact. API keys in source code? That’s day one. No model versioning? That’s a 30-day item. Formal bias testing procedures? That’s a 60–90 day item. The point isn’t to fix everything instantly — it’s to show that you’ve thought about it systematically.

Step 5: Package it professionally. This isn’t a Slack message or a Notion page. It’s a PDF that your CTO can forward to procurement and say: “Here’s our AI governance posture, backed by evidence from our actual codebase.” That’s how you move deals forward instead of stalling them.

If you want the full picture on what AI governance looks like for startups, we’ve broken that down separately. But the key insight is this: governance evidence that comes from your code is worth 10x more than a policy document someone wrote from a template.

---

The Real Cost of Not Having This

Let me be direct about what happens when you can’t answer these questions.

Deals stall. Enterprise procurement puts your deal on hold pending documentation. I’ve seen delays of 4–8 weeks while companies scramble to produce AI governance docs. Some deals just die quietly — the buyer goes with the vendor who had their documentation ready.

Your CTO gets pulled off the roadmap. Instead of shipping features, they spend 2–3 weeks assembling ad hoc responses across engineering, security, and legal. And every time a new questionnaire lands — because every enterprise buyer has their own version — the cycle repeats.

Your competitors with documentation win. If two vendors are equal on product but one can provide an AI governance brief and the other says “we’ll get back to you on that” — guess who gets the contract? Enterprise buyers choose the lower-risk option. Always.

And it compounds. SOC 2 auditors are now asking AI-specific questions during renewals. What starts as an observation this year becomes a finding next year. Findings become deal-blockers.

---

Stop Scrambling. Start With Your Trust Pack.

You don’t need a 6-month compliance program. You don’t need a Big 4 firm charging $150K to interview your team and produce slide decks.

You need a Trust Pack — a buyer-ready AI governance proof pack built from your actual codebase in minutes. It’s the document that replaces “we’ll get back to you on that” with “here’s our AI governance posture, mapped to NIST, ISO 42001, and the EU AI Act, with a prioritized remediation plan.”

It’s what your CTO forwards to procurement when the questionnaire lands. And it’s what moves the deal from “pending review” to “approved.”

Get your Trust Pack →