A prospective customer asks for your AI policy. Your team sends a document. The next question is about a particular feature: what information does it use, and who reviews the output?
The policy may not contain that answer.
For a B2B vendor, I would prepare for AI governance questions at the level of the offering the customer is evaluating. An organization-wide statement is useful context, but the customer also needs to understand the specific deployment and its boundaries.
The questions below are a preparation guide, not findings from a buyer survey. Different customers will ask different questions according to their proposed use, sector and review process.
Where is AI used in this offering?
Explain which functions use AI and what they do. Distinguish a generated draft, a recommendation, a classification and an automated action.
If AI supports an internal process rather than a customer-facing feature, explain that distinction where it is relevant to the request.
Keep an approved description that Product can verify and Sales can explain. If the product contains several AI uses, organize the answer by function rather than compressing everything into “AI-powered.”
What happens to our information?
The answer should follow the customer's proposed configuration.
Describe the relevant inputs, retrieved information, outputs and processing services. Provide reviewed information about retention, access and training use, including the conditions and exceptions that matter.
If the answer depends on a contractual option, setting or service tier, make that dependency visible. Avoid sending an assurance that is accurate for a different deployment.
Technical, privacy and legal owners should review the relevant parts of the response. Marketing's role is to make the approved information understandable, while preserving its meaning.
Who can review or intervene?
Illustrative scenario: An HR software vendor provides an assistant that summarizes interview notes. A customer wants to know whether a recruiter can check the source notes, correct the summary and decide independently.
A policy saying that the company values human oversight does not establish these product behaviours. The response should describe what the recruiter can see and do, along with any limitations.
If another feature recommends a shortlist, answer separately for that function. Avoid implying that controls available in one workflow automatically apply to another.
Where useful and permitted, a demonstration of the actual review process can accompany the written answer.
What evidence supports the capabilities?
For a performance claim, identify the task, evaluation conditions, relevant result and limitation. Explain which evidence applies to the product version in scope.
A report about security controls and a test of output accuracy answer different questions. Present the evidence for the question being asked.
NIST's MEASURE 2.5 addresses documenting limitations on how performance generalizes beyond evaluated conditions. Source: NIST Playbook, Measure.
If a customer asks for evidence you do not yet have, say what is available, assign the gap to an owner and agree the next step. Do not substitute an unrelated document simply to complete the questionnaire.
What happens when something changes or goes wrong?
Be prepared to describe the relevant change and incident processes.
Who receives a report? How does the team investigate it? What can be paused? Who communicates with the customer? Which material changes trigger another internal review?
Keep the answer aligned with your actual agreement and operating arrangements. A response-time target that appears in one service contract should not become a promise to every prospect.
The OECD's AI Principles include transparency about capabilities and limitations, and accountability supported by traceability. These are useful reference themes for organizing the information you can substantiate. Source: OECD AI Principles.
Build a shared answer library
For each recurring question, maintain an approved answer, evidence location, owner, scope and last-review date. Record restrictions on external sharing.
I would include a clear distinction between current practice, conditional capabilities, unresolved questions and planned improvements.
This gives Sales a reliable starting point and reduces the need to reconstruct an answer from several departments during every opportunity. It also creates a place to record new customer questions that need investigation.
Your goal is an answer the customer can understand and the internal team can support.
For the marketing perspective, see building buyer trust around AI in HR technology.
Download the free readiness check, or explore an assessment that includes customer-facing AI claims.