Reference

What sits behind an AI governance answer?

Any organization can write "we use AI responsibly." The question that decides a security review is the next one: show me. This page sets out the chain a defensible answer runs on — question, answer, artifact, record — and what each link has to contain.

Written by Yosef Dabbit, Annexwright · Published 2026-09-23 · Last reviewed 2026-09-23 · Edition 2026.1

An unsupported answer is a claim

Enterprise AI questionnaires have stopped asking only whether a control exists. They increasingly ask you to explain it, to provide evidence, and to describe the process. That shift is what turns AI governance from a statement into a documentation problem.

The failure mode is predictable. A vendor answers twenty questions confidently in an afternoon. A week later the reviewer picks three answers and asks for the underlying document. If the document does not exist, or exists but is empty, or exists but names no owner, the deal slows — and the vendor's other nineteen answers are now also in doubt.

The chain

1 · The questionUsually one of about twenty. They cluster into governance, risk and impact, data, security, and transparency and people. The full list is here.

2 · The answerShort, factual, in your own words, and true of your organization today. Not a capability you intend to build.

3 · The artifactThe document the answer describes: a policy, an inventory, a register, an assessment, a procedure. It has to be attachable.

4 · The recordWhat proves the artifact is operating rather than shelved: a signature with a date, populated rows, a named owner, a review date that has not passed, a completed assessment.

Worked: "do you maintain an inventory of AI systems?"

This is a row from AW-E17, the Enterprise AI Questionnaire Answer Bank, as it ships:

AW-E17 · §1 Governance

QuestionDo you maintain an inventory of AI systems?

Starting answerYes. Every AI system, including third-party models and AI features in SaaS tools, is registered in our AI System Inventory with an owner, purpose, data classes, risk tier and review date. The inventory is reviewed monthly.

Supporting artifactAW-E06 AI System Inventory Register

Record that proves itRows with named owners, risk tiers and review dates in the future — not a spreadsheet created the morning the questionnaire arrived.

Read the answer again and notice how much of it is a specification for the artifact. Owner, purpose, data classes, risk tier, review date, monthly cadence — an inventory that does not carry those five fields cannot support the sentence. That is the useful property of writing the answer and the document together: the answer tells you what the document must contain.

An AI inventory is not a list of software subscriptions. The systems most often missing are the ones nobody procured as "AI": a feature switched on inside an existing SaaS tool, a model called through an API by one team, an assistant embedded in a support workflow. Scope is where inventories fail, not format.

Why a policy alone is not a governance system

A policy states intent. A governance system is the set of artifacts and records that show intent being carried out: who owns each system, what risks were identified and what was done about them, which decisions had a human in the loop, what happened when something went wrong, who was trained. A reviewer asking for evidence is asking for the second thing.

This is also why documentation alone does not make an organization compliant or certified. The documents are the structure; the records accumulate only by operating them.

Three things a reviewer can ask for immediately after your answer

The artifact itself — attach the policy, the register, the assessment.
The owner — a named person, not a department.
The last review date — and whether the next one is in the future.

If all three are available for every answer you gave, the review moves on. If they are not, you have found your gap list.

Take a complete document first

The four-way crosswalk is a whole file from the paid set — ISO/IEC 42001 mapped to NIST AI RMF, the EU AI Act and ISO/IEC 27001, clause by clause, as an Excel workbook. No signup, no email gate.

Read the crosswalk Download the workbook

The documents behind the chain

Annexwright publishes the artifacts these answers rest on: policy, acceptable use, inventory, a risk register pre-seeded with 41 AI-specific risks, impact assessment, human oversight, incident response, vendor due diligence and the answer bank itself.

Essentials — $149 Professional — $397

What you still do. Annexwright supplies the documentation architecture. You decide which systems are in scope, who owns them, what your risk appetite is and what you will actually do; you fill the registers, adapt the wording, operate the controls and keep the records. Buying documentation does not make an organization compliant or certified.

How this page was checked. Regulatory dates on this page were taken from the official texts and from the European Commission, the Illinois General Assembly, Texas Legislature Online, the Colorado General Assembly, the California Privacy Protection Agency, the New York State Senate and NYC DCWP, and were last reviewed on 2026-09-23. Where a date is an applicability or compliance deadline rather than an entry-into-force date, the page says so. Regulation changes; check the primary text before relying on any date for a decision. Nothing here is legal advice.