AI Governance

How to Answer the AI Question in a PQQ

Framework submissions, client audits and insurance renewals have started asking how you govern AI. The practices that score well answer with records, not adjectives.

Documents and laptop on a desk during a review

The question arrives in different clothes. Describe your policy on the use of artificial intelligence. How do you ensure client data is not processed by unauthorised AI tools? What controls govern AI-generated output in your deliverables? Behind all of them sits the same concern: does this firm know where its project information goes.

What the reader is looking for

A procurement reader is not looking for enthusiasm about AI or a promise to be careful. They are looking for evidence that decisions get made and recorded: a written usage policy, a register of approved tools with named owners, an assessment behind each approval and review records showing the whole thing is alive rather than filed. If you can also say where each approved tool processes data, you are ahead of most of the field.

What not to write

Vague assurance scores nothing. “We use AI responsibly” is an adjective, not an answer. And never claim a certification you do not hold. If you are working towards a standard, say exactly that: a reader respects “our AI management system is built to ISO 42001 and we will describe it as certified only when certification is granted” far more than a claim that unravels under clarification questions.

The shape of a strong answer

Name the approved toolset and where each tool processes data. State plainly what never goes into public AI tools: client data, drawings, models and commercially sensitive correspondence. Name the policy owner and the review date. Confirm a person reviews AI-assisted output before it reaches a deliverable. Offer the register extract and impact assessments on request.

An answer like that takes minutes to assemble when the records exist. It cannot be written at all when they do not, which is the real argument for putting governance in place before the tender lands rather than the week it does.

WIT builds practices exactly this evidence: policy, register, impact assessments and review records, produced under the same management system that keeps our own ISO 27001 and ISO 9001 certifications current.

Let’s make technology work better for your practice

Tell us about your current setup, challenges and future plans. We will help you identify the right next steps.