AI GOVERNANCE · EVIDENCE, NOT CERTIFICATION
Answer the AI questionnaire once. Reuse the answers forever.
A fixed-scope evidence pack built to the artefacts enterprise buyers actually ask for, delivered in one week by a practitioner credentialled in both ISO 42001 implementation and audit.
From £5,000 + VAT · 1 week
QUESTIONNAIRE SUPPORT
Your customer's security questionnaire
Evidence Essentials includes help with customer security questionnaires from the maintained evidence base. The scope check sets out what is included.
THE PROBLEM
Why questionnaires stall deals.
Enterprise vendor assessments now carry dedicated AI sections. The Cloud Security Alliance AI-CAIQ maps 247 control objectives across 18 domains. The Shared Assessments SIG 2026 questionnaire added an AI domain mapped to ISO 42001. HECVAT 4.0 carries a conditional 32-question AI domain triggered whenever a vendor declares AI features.
Most vendors cannot answer them. The deal does not get rejected, it stalls in security review, which is worse, because nobody tells you it has stopped.
The failures are consistent.
- No model card
- No training data provenance
- No stated position on whether customer data trains models
- No AI-specific incident process
- No system inventory
- No named accountable owner
DELIVERABLES
What you receive.
Five artefacts, each written to withstand scrutiny rather than to fill a field.
The five artefacts are confirmed at scoping and listed in the engagement letter before any work starts.
SECTOR PRESSURE
Where the questions come from.
Health and life sciences
NHS England replaced DTAC with Digital Frameworks (Assured Suppliers) in December 2025, and the AI Framework becomes compulsory for the AI Diagnostic Fund from December 2026. Clinical safety standards DCB0129 and DCB0160 are mandatory under the Health and Social Care Act 2012 and require a named Clinical Safety Officer. The EU AI Act classifies clinical AI as high-risk and Microsoft classes healthcare as Sensitive Use.
Financial services and insurance
The Shared Assessments SIG is the dominant vendor risk instrument in the sector and carries an AI domain mapped to ISO 42001. Credit scoring and insurance underwriting are Annex III high-risk and Microsoft Sensitive Use.
Education
EU AI Act Annex III covers education and vocational training, including admissions and assessment. Microsoft names educational admissions as Sensitive Use.
The instruments differ by sector. The evidence does not.
TRAINING DATA PROVENANCE
What provenance actually requires.
Enterprise buyers ask where training data came from, under what licence, and whether it can be proven unchanged. Three records answer it: an acquisition record showing when each source was added and from where, a licensing record showing what agreement covers the use, and an integrity record proving the dataset today is the dataset trained on.
Providers of general purpose AI models carry a further obligation under EU AI Act Article 53, in force since 2 August 2025, to publish a summary of training content and maintain a copyright policy. Organisations using third-party models are not caught by Article 53, but are still asked the provenance question by buyers.
INVESTOR DILIGENCE
The same pack answers investors.
Series A and later investors now ask for an AI acceptable use policy, a system inventory, an incident log, bias testing documentation, training data provenance, EU AI Act risk classification, and a named governance owner. The same pack answers both audiences.
CHOOSING BETWEEN THEM
How this differs from the AI Governance Readiness Assessment.
Question it answers
Readiness assessment
Where do we stand against ISO 42001 and the EU AI Act?
Evidence pack
What do we send the buyer who is asking?
Output
Readiness assessment
Gap analysis and roadmap
Evidence pack
Five completed artefacts
Trigger
Readiness assessment
Planning a certification
Evidence pack
A questionnaire has arrived
Price
Readiness assessment
From £2,500
Evidence pack
From £5,000
The AI readiness assessment tells you what is missing. The evidence pack produces the documents. Organisations facing an immediate procurement deadline usually need the second.
SCOPE
What it is not.
This is an evidence pack, not certification. It does not make you ISO 42001 certified and does not replace ISO 27001 or SOC 2.
Where the pack surfaces gaps that require an actual management system rather than documentation, the ISO 42001 Sprint closes them. The pack credits in full against a subsequent Sprint engagement.
QUESTIONS
Common questions.
A questionnaire has arrived. What now?
Book the Free Diagnostic. 45 minutes, no sales pitch, senior practitioner-led. If the evidence pack is not the right answer we will say so.
Prefer email? Write to info@goldlineconsultancy.co.uk.