The Higher Education Community Vendor Assessment Toolkit, stewarded by EDUCAUSE. Any vendor selling software to a US university completes one, which makes it the one questionnaire where you can be certain the buyer is asking.
← Learn · questionnaires
The questions are new. The deadline isn't.
Enterprise buyers added AI sections to their standard questionnaires in the last eighteen months. If you ship an AI feature and sell to larger companies, one of these is already on someone's desk — and most vendors answer with a policy document and hope nobody checks.
Who is asking, and what they ask
Control identifiers and section numbers move between revisions of every one of these, so check the workbook actually in front of you rather than a number quoted on a vendor's website — including this one. What does not move is the shape of the question.
The Cloud Security Alliance's questionnaire, mapped to its Cloud Controls Matrix. The general-purpose one, and the one most likely to arrive from an enterprise buyer outside education.
Shared Assessments' standardised questionnaire, weighted toward financial services and third-party risk. Long, and usually sent by an organisation with a formal vendor programme behind it.
Whichever arrives, the AI questions run the same way: do you log what your AI does, how long do you keep it, and who can change it. The first two you can answer from your architecture. The third is where an answer becomes a promise.
What good looks like
Three things the buyer is actually checking.
A record per interaction, not per deployment.
“We log application errors” does not answer a question about your AI features.
That it can't be quietly edited.
This is where most answers fail, because most logging can be. Saying “our logs are immutable” when the platform's own documentation says the lock can be removed is a claim an auditor can check.
That someone outside your company can be shown it.
The question is asked by a buyer who will be asked the same thing by their regulator or customer. You are one link in that chain.
How to answer honestly
Route your AI calls through something that records them, and hand over a record the auditor can verify themselves rather than one they have to accept. With Lyntway that is one line in your environment, and the answer becomes a receipt instead of a paragraph.
And answer the retention sub-question precisely. “Indefinite” is rarely true and always checkable.