The AI Compliance Dossier: Ready for B2B Procurement Reviews
When customers or buyers ask about your use of AI in due diligence questionnaires (DDQs), the AI Compliance Dossier provides the right answers—as a structured self-declaration, without a certification audit and at a fraction of the cost of full certification.
- Answers without delay: The dossier contains prepared answers to the usual AI questions in B2B security reviews. They're ready when a request lands on your desk and complement your existing information security answers.
- Evidenced, not just claimed: Every answer is backed by concrete documentation. If a document is missing, we build it together—turning a sales obstacle into verifiable evidence.
- Ready to adopt: You receive answers and documents as Excel and Word files that your IT can transfer into your answer library, your wiki or your compliance platform.
- ISO-compatible: The structure is aligned with ISO/IEC 42001. If you later decide on certification, you can continue to use all documents directly.
When You Need the Dossier
The dossier pays off as soon as someone outside your company wants to know how you handle AI. Typical use cases:
- A customer sends a vendor assessment, security questionnaire, or due diligence request with questions about the use of AI.
- A buyer assesses your information security (vendor security assessment) and asks about your AI policy.
- A tender requires information on how you handle AI.
- An investor or buyer examines your company as part of due diligence.
- Your management wants to know where the company stands on AI.
Examples of Questions About AI Use
The following questions are examples of AI questions in vendor questionnaires. For each, the dossier provides an answer and the matching document.
| Question | Evidence in the dossier |
|---|---|
| Which AI systems do you use, and for what? | AI inventory |
| Do you enter confidential data or your customers' data into AI services, and under what contractual terms? | AI inventory, AI policy |
| Have you assessed the risks of your AI use? | Risk assessment and impact assessment |
| Is there a binding policy for the use of AI? | AI policy |
| Who is responsible for AI in your company? | RACI matrix |
| How do you train your employees in the use of AI? | Training records |
| Do your products or services contain AI functions, and how are they monitored? | AI inventory |
| Are you certified under ISO/IEC 42001, or are you planning to be? | Action plan |
The Eight Components
| Component | Content |
|---|---|
| AI inventory | Records every use of AI in the company with purpose, users and data flows, and checks the provider's terms: whether your inputs are used for training, whether a data processing agreement is in place and where the data is processed. |
| Risk assessment and impact assessment | Evaluates each AI use case against standard criteria and conducts a detailed impact assessment for high-risk systems, based on ISO/IEC 42005. |
| AI policy | Sets binding rules for employees: which AI tools are approved, which data may be entered into which tools and how to proceed in the event of security incidents. Includes a template for informing your customers where and for what you use AI. |
| RACI matrix | Assigns every AI task clearly: who decides, who implements, who is consulted and who is informed. |
| Training records | Document training measures with content and attendance, from existing records or from separately bookable AI literacy training. |
| Action plan | Tracks open action items with owners, remediation steps, and target dates, turning a critical "No" into a verifiable "Planned by …". |
| Question-and-answer catalog | Answers the usual AI questions in customer questionnaires in English and German and refers to the relevant document for each answer. |
| AI system description | Describes each AI system: how it works, its limits, version, logging, acceptance tests and explainability. For purchased tools, it refers to the provider's documentation and records your own acceptance. |
Frequently Asked Questions
Isn't Our ISO 27001 ISMS Enough?
Partially. An ISMS largely covers unauthorized data exposure, overly broad access rights, and shadow AI. ISO 27001 does not address risks that arise from the AI's results: hallucinations, automation bias and AI discrimination. The dossier adds these points to your ISMS rather than replacing it.
Will Customers Accept the Dossier Even Though We Are Not Certified Under ISO/IEC 42001?
Whether a customer accepts your answers is the customer's decision. The dossier provides what buyers value most in supplier assessments: an answer with traceable evidence. Where an answer is "No" today, the action plan shows by when and by whom the gap will be closed. If a customer explicitly requires a certificate, the dossier is the first step toward an AI management system.
How Much Effort Will This Require From Our IT Team?
I do most of the work. Your IT is involved at three points: in the kick-off meeting, in short interviews about the AI tools in use and in reviewing the results. The written offer sets out the exact scope.
Does the Dossier Protect Me Legally as a Managing Director?
The dossier documents which measures your company has taken in handling AI: inventory, risk assessment, rules, responsibilities and training. This documentation is the basis for demonstrating due care. Whether it is sufficient in a specific case can only be judged by a lawyer; legal advice is not part of the dossier.
What Happens to the Dossier If We Seek Certification Later?
The structure is aligned with ISO/IEC 42001. The building blocks—from the AI inventory and risk assessment to the AI policy, RACI matrix and training records—feed into your AI management system (AIMS) as its documentation base.
For formal certification, I add the further requirements of the standard in a second step, including internal audits and management review. If you commission me to build the AI management system within twelve months, I will not charge a second time for the dossier documents that feed into the management system.
What Does the Dossier Cost, and When Will It Be Ready?
After the initial call, you receive a written offer with a fixed price and date. The price depends on which foundations—such as an AI policy or AI inventory—already exist and which still need to be created.
What If an Answer Is Missing From the Dossier?
If the dossier lacks a clear answer to an AI question from a customer questionnaire, I will provide it within three working days of receiving the necessary information—during the term of the dossier.
In Which Language Will We Receive the Answers?
You receive the question-and-answer catalog in English and German, so you can also answer questionnaires in either language without translation effort.
Why Does the AI Compliance Dossier Need to Be Updated Every Year?
Four factors change constantly and require an annual review:
- New tools and contracts: additional AI applications and changed terms of use from providers, for example on storing and using your inputs.
- New obligations under the EU AI Act: further obligations apply from December 2026 and December 2027.
- New questionnaire versions: common standards for customer questionnaires, such as the SIG, appear in new versions every year.
- Staff changes: new employees need training records.
I offer the annual update of the AI inventory and documents as a separately bookable annual package.
Free starting point: whitepaper "Managing AI Risk in Your Enterprise" with an Excel template for your AI inventory
Contact
Send me the questionnaire you have on your desk, or write briefly what it is about. I will get back to you with a suggested date for an initial call. If you wish, we sign a confidentiality agreement beforehand.