Governance questions
Do you have a documented AI governance framework, and can you provide it? What is the structure of your AI governance — who is responsible for AI governance decisions and at what level? Do you have an AI system inventory, and can you demonstrate it is current and complete? What is your process for approving new AI system deployments? Do you have a named Chief AI Officer, AI Risk Officer, or equivalent accountable executive? How often is AI governance reviewed at board level? Have you had any AI-related regulatory inquiries, enforcement actions, or litigation in the past three years?
Data questions
What are the sources of your training data? Do you hold documentation of the licensing or lawful basis for each training data source? Does your training data include personal data, and if so, what is your lawful basis for processing it for training? Have you tested your training data for representation gaps or demographic biases? What is your process for managing data quality in training data? How do you handle data subject rights requests (deletion, access) in relation to training data? Do you use synthetic data, and if so, how is it generated and validated?
Technical questions
How is your AI system validated before deployment, and who conducts the validation? What bias testing have you conducted, using what methodology, and what were the results? What monitoring do you have in place for AI performance in production? How do you detect and respond to model drift? What is your AI incident history and what has each incident taught you? Have you conducted red-teaming or adversarial testing of your AI system? What is your model change management process — how are significant changes to the AI controlled and approved?
Legal and regulatory questions
Which AI regulations apply to your products and operations, and how are you tracking compliance? Are any of your AI systems classified as high-risk under the EU AI Act, and if so, what is your compliance status? Have you conducted a fundamental rights impact assessment for any AI deployments? What are your obligations under applicable data protection law for AI processing, and how are you meeting them? Do you maintain the technical documentation required by the EU AI Act for high-risk AI? What are your contractual AI governance obligations to your customers, and how are you meeting them?
