Short answer: Build one approved answer library from your policies, past questionnaires and audit reports, then use an AI model to match each new question to that library and draft an answer with a citation to the source document. A named person reviews every answer before it goes back to the customer. For most small B2B vendors this turns a questionnaire from a day or more of scattered work into a few hours of focused review, and the answers get more consistent over time.

The problem

If you sell software or services to larger organisations, sooner or later a prospect's procurement team sends you a security questionnaire. Sometimes it is a standard format such as the Cloud Security Alliance's CAIQ. More often it is the customer's own spreadsheet, with a hundred or more questions about encryption, access control, backups, incident response, subprocessors and staff vetting.

The people who answer these are rarely security specialists. At a 20 or 50 person company it is usually a founder, the CTO or whoever looks after IT. In a 2023 Ask HN thread, a founder described how every client above roughly 100 staff sent their own assessment, often with 100+ questions, and said the team was too small to hire someone just for this. Replies suggested the same few workarounds: keep a master document of answers, standardise on one questionnaire format, or buy a tool. In a May 2026 thread, a solo founder said customers kept pressing them about certification, and several replies pointed out that completing the buyer's questionnaire is usually the alternative when you have no SOC 2 report.

What it costs

Cobalt's CTO, writing about their own experience, says to expect at least a full day of effort for one technical person to fill a questionnaire in, with deadlines that usually run from a few days to about two weeks. That same article notes they could reuse about 60% of answers from a recent previous questionnaire, though they still had to check each one.

Here is an illustrative estimate so you can plug in your own numbers. Assume you receive 3 questionnaires a month, each takes 10 hours of senior time, and that time is worth £80 an hour. That is 30 hours and £2,400 a month, or close to £29,000 a year, spent mostly on answering questions you have answered before. The larger cost is often the delay: a deal that sits in procurement for an extra two weeks while the CTO finds time.

Why it keeps happening

Buyers are under real pressure to check their suppliers. Verizon's 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled to 30%, based on more than 12,000 confirmed breaches. In the EU, the NIS2 Directive lists supply chain security, "including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers", among the minimum measures in-scope organisations must take (Article 21). Sending questionnaires is the cheapest way for a buyer to show they did that work.

On the vendor side, a few things make it painful:

  • Every buyer uses a different spreadsheet, so the same question appears in a dozen different wordings.
  • The answers live in many places: the security policy, the cloud provider's documentation, an old pen test report, a Slack thread from last year.
  • Nobody owns the library of past answers, so each questionnaire starts from the last one someone can find, which may be out of date.
  • Some questions need a decision, not a fact ("Will you notify us of a breach within 24 hours?"), and those wait for a busy founder.

A SOC 2 report, issued by a CPA firm, can shortcut many of these questions, but it costs time and money to obtain and some buyers still send their own questionnaire anyway.

How AI solves it

The useful pattern is retrieval-augmented generation (RAG): the model only writes answers from documents you have approved, and shows which document each answer came from. The model is good at recognising that "Is customer data encrypted at rest?" and "Describe your storage encryption controls" are the same question. It is bad at knowing facts about your company that are not written down, so the workflow has to stop it from guessing.

The workflow, step by step

  1. Build the source library. Collect your security policies, your public security page, your subprocessor list, the latest pen test summary, any SOC 2 or ISO 27001 report, and your best recent completed questionnaires. A standard set such as the CSA's Cloud Controls Matrix and CAIQ (197 control objectives across 17 domains in version 4.1) is a good backbone, because many custom questions map onto it.
  2. Turn past answers into approved pairs. Each question and answer pair gets an owner, a last reviewed date and a link to its evidence. This is the most valuable step and it is mostly human work, done once.
  3. Ingest the new questionnaire. Plain code reads the spreadsheet, Word file or PDF and splits it into individual questions while keeping the row and column positions, so the answers can be written back into the buyer's own file.
  4. Match each question. An embedding search finds the closest approved answers. If there is a near-exact match, it is reused word for word.
  5. Draft the rest. For questions without a close match, a language model drafts an answer using only the retrieved documents and cites them. If the documents don't cover the question, it must say "no source found" and leave it blank.
  6. Score and route. Rules flag low-confidence matches, questions with no source, and anything touching legal commitments (notification times, liability, data residency, audit rights) for a named owner.
  7. Review and approve. A person reads every answer, edits where needed and approves. Approved new answers go back into the library.
  8. Export and log. Answers are written back into the buyer's original file, and a copy of what was sent, to whom and when, is kept. Your questionnaire answers can end up in the contract, so you want a record.

Where to use AI and where to use rules

Task Best tool Why
Reading the buyer's file and keeping its layout Plain code Spreadsheets have fixed cells; you need exact write-back
Matching reworded questions to past answers Embeddings search Handles different wording well
Drafting answers to new questions LLM with retrieval and citations Writes clear prose from your own documents
Deciding what needs legal or founder sign-off Rules (keywords, categories) Predictable and easy to audit
Yes/no answers about specific controls Approved library, then a human A wrong "yes" is a misrepresentation
Tracking owners, review dates and expiry Plain workflow tool No judgement needed

Some model providers now support citing source passages directly, which makes review much faster because the reviewer can click through to the policy line behind each answer. Anthropic's citations feature is one example.

Costs and timeline

These are estimates, with the assumptions stated. Your numbers will differ.

Do nothing

Using the example above (3 questionnaires a month, 10 hours each), you spend about 360 hours a year of senior time. Answers drift between questionnaires, and nobody can say which version is current.

Buy an off-the-shelf tool

Trust and compliance platforms now include questionnaire automation. Vanta, for example, describes a knowledge base built from past questionnaires and uploaded policies, AI-drafted answers with citations, review and approval steps, and support for spreadsheets, documents and third-party portals. Its plans are sized by volume (it lists 144 or 288 questionnaires a year on different tiers) and prices are on request. If you are already on one of these platforms for SOC 2, this is usually the right first step. Setup is days to a couple of weeks, mostly spent loading and cleaning your past answers.

Build a custom tool

A custom build makes sense when your answers depend on product, region or deployment model, when you need it inside your own systems (your CRM, your document store, a private cloud), or when the same library also has to answer RFPs and due diligence requests. Assuming a clean set of policies and around 20 good past questionnaires, a focused build with evaluation and a review screen is typically 4 to 8 weeks of work. Running costs are mostly model usage and hosting, which for a few questionnaires a month are small compared with the staff time involved.

Where the time saving comes from

Assuming 60% of questions match an approved answer (similar to Cobalt's reuse figure) and take about 1 minute each to check, and the remaining 40% take about 4 minutes each to review a cited draft, a 150 question questionnaire takes roughly 1.5 hours for the matched questions plus 4 hours for the rest. Call it 5 to 6 hours instead of 10 or more in the first months, falling as the library grows. Edit the assumptions to fit your own volumes.

When not to use AI

  • If you get one or two questionnaires a year. A well-kept spreadsheet of past answers and a public security page will do the job.
  • If your policies don't exist yet. AI can't answer from documents you don't have. Write the policies first. Starting from a CAIQ template and answering it honestly is a good exercise.
  • For anything you can't verify. If the source library doesn't say it, the answer is "we don't do this yet" or a question for a person. Overstating your controls to win a deal creates risk you will have to live with if something goes wrong later.
  • For commitments. Breach notification times, liability caps, data location and audit rights are business and legal decisions. The tool can flag them; it should not answer them.
  • If a platform you already pay for covers it. If you are on a compliance platform with questionnaire automation, try it before building anything.

How to start

  1. Count last year's questionnaires and roughly how long each took. If it is fewer than five, stop at step 3.
  2. Gather your policies, security page, subprocessor list and your five best completed questionnaires into one folder.
  3. Build a master answer sheet with an owner and review date for each answer. Map it to CAIQ where you can.
  4. Decide which topics always need sign-off (legal, founder, DPO).
  5. Try the questionnaire feature in any compliance tool you already use on your next real questionnaire.
  6. If it doesn't fit your products, regions or systems, scope a custom RAG tool with an evaluation set built from your past questionnaires.

If you want help with step 6, our custom LLM and RAG development service covers the build, evaluation and guardrails, and our AI workflow automation work covers the intake and routing around it. For the wider picture, see AI agents vs AI chatbots and what it costs to build an AI chatbot.

FAQ

Can ChatGPT fill out a security questionnaire?

A general chatbot can draft plausible answers, but it doesn't know your controls, so it will guess. Use a tool that answers only from your approved documents, cites the source for each answer, and leaves questions blank when there is no source. A person should still review every answer before it is sent.

How long should a security questionnaire take to complete?

Without a library of past answers, a 100 to 200 question questionnaire often takes one technical person a full day or more. With an approved answer library and AI-drafted answers, most small vendors can get that down to a few hours of review. The first few questionnaires take longer while the library is being built.

Do I need SOC 2 to answer security questionnaires?

Not always. Many buyers will accept a completed questionnaire and a security overview from a smaller vendor, and some will sign with a commitment to obtain SOC 2 later. A SOC 2 report, issued by a CPA firm, can replace many questions, but some buyers send their own questionnaire regardless.

What is the difference between CAIQ and SIG?

CAIQ is the Cloud Security Alliance's set of yes/no questions based on its Cloud Controls Matrix, aimed at cloud services. SIG is the Standardized Information Gathering questionnaire from Shared Assessments, and many buyers start from it and customise their own version. Both are standard formats, so keeping a current completed copy of either saves time on custom questionnaires.

Is it safe to upload our security documents to an AI tool?

Check the provider's data handling terms first: whether your data is used for training, where it is stored and who can access it. For sensitive material such as pen test reports, use a business plan with training disabled, or a private deployment. Add the tool to your own subprocessor list if customer data is involved.

How do I keep questionnaire answers up to date?

Give every approved answer an owner and a review date, and re-review when a policy, provider or product changes. Rules can flag answers older than, say, twelve months.

Sources

If you'd like to talk through your own questionnaire workload, get in touch at https://sintraflow.com/contact.