Security Questionnaires Eat Into Selling Time—Let AI Find the Evidence

By Greg Nowak. Last updated 2026-08-21.

A security questionnaire may look like an administrative detail. But when it reaches the sales team, the search begins: Where is the current security policy? Which data processing agreement applies to this particular service? Is the audit report still valid, and who can answer the technical question?

Drafting the response is rarely the most time-consuming part. The real work lies in finding the right documentation, checking it and ensuring that it actually addresses what the customer is asking.

AI can be useful here in a clearly defined role. As a document assistant, it can find previously approved information and show where it came from. It should not guess the company’s security posture or make new commitments on its own.

Suppliers will feel the effects of NIS 2 as well

Denmark’s NIS 2 Act came into force on 1 July 2025. Companies can use the NIS 2 checker from SikkerDigital, Denmark’s public cybersecurity information portal, to assess whether they are directly in scope. However, the tool does not determine whether a company supplies an organisation covered by NIS 2. Direct statutory obligations and customer requirements are therefore two separate issues.

Material from the Danish Agency for Digital Government explains why the supplier dimension matters. Among other things, covered entities must address management accountability, incidents and adequate cybersecurity measures. The more detailed guidance template also covers supply-chain security, registers of direct suppliers and requirements that can be incorporated into supplier contracts.

These may include requirements concerning cybersecurity, incident notification, audits or audit reports, vulnerability management, subcontractors and the handling of information when a contract ends. Even a small supplier may therefore receive a fairly extensive security questionnaire without itself being directly covered by the NIS 2 Act.

The bottleneck is finding the answer, not writing it

The questions are often repeated, but the wording varies from one customer to another. One asks about “incident notification”, while the next wants to see the company’s “procedure for security events”. The answer may already exist in the incident response plan or approved contract language. A conventional keyword search simply does not always recognise the connection.

Version control makes the task more difficult. A well-written answer from last year may have expired, apply to a different product or be classified for internal use. A workable solution must therefore begin with document management, access controls and clear ownership. Adding a chatbot on top of a disorganised shared drive does not solve the underlying problem.

A RAG assistant works from approved documents

RAG stands for retrieval-augmented generation. In practice, the system first searches a defined document repository. It then drafts a suggested answer based on the passages returned by the search.

OpenAI’s documentation describes semantic search, among other capabilities. It can find relevant passages even when the customer’s question and the company’s documents use different words. Documents can be placed in a vector store, where they are divided into sections and indexed. Attribute filtering can limit searches by criteria such as date, document type, product or confidentiality level. A relevance threshold can also filter out weak results.

This is well suited to finding evidence. It is not the same as proving that the evidence is correct or current.

The document repository needs to be more than a folder

A practical document base might include security policies, data processing agreements, audit reports, standardised customer responses and product descriptions. Every document should have an owner and metadata that make it possible to determine where and when it may be used:

• approval date and expiry date
• product, service or legal entity
• document type and responsible department
• confidentiality level and access group
• status as draft, approved or expired

This makes the search more precise than “find something about backups”. The assistant can look for the current, approved backup description for a specific cloud service while excluding drafts.

ENISA’s technical guidance includes practical examples of evidence and mappings between requirements and standards. These mappings can be incorporated into the index structure so that different ways of phrasing the same security question point to a single, controlled body of documentation.

From customer question to approved answer

1. Import: Questions are retrieved from a spreadsheet or transferred from a customer portal.
2. Classification: The system identifies the topic, product and requested evidence.
3. Retrieval: The RAG pipeline searches only documents that the user is permitted to access and filters them using relevant metadata.
4. Suggested answer: The assistant produces a short draft with the document name, supporting passage, validity status and a clearly displayed confidence level.
5. Review: Unanswered, conflicting or sensitive questions are routed to the appropriate subject-matter owner.
6. Export: Approved answers are returned to the spreadsheet or relevant portal.

The system’s most important quality is not its ability to complete every field. It is its ability to say: “Insufficient supporting evidence was found.” An empty field in a review queue is better than a persuasive answer with no documentation behind it.

Relevance is not the same as compliance

A high search-result score tells you only that a passage resembles the question. It does not prove that the company meets the requirement. The solution should therefore keep three things separate: the source’s status, the search result’s relevance and final human approval.

An expired audit report, for example, may be highly relevant but still unsuitable as a current customer response. Nor should the assistant infer certifications, contractual obligations or technical controls that the documents do not directly support. Legal wording, new security commitments and answers about specific incidents should always have a named approver.

Integration removes repetitive work

The solution delivers real value only when it fits the way the team already works. Many security questionnaires arrive as spreadsheets with columns for answers, comments and evidence. Others must be completed directly in a customer portal.

A solution can handle imports, field mapping, version control and exports while keeping the actual submission as a controlled action. At nowa.dk, Greg’s AI automation service for Danish companies, the task can be brought together in a single workflow: an access-controlled document repository, a RAG pipeline, a review queue and integrations with the formats already used by the sales and security teams.

Start with one questionnaire, not the entire archive

A pilot does not need to include all of the company’s documents. Choose one representative supplier questionnaire. Identify the policies, agreements, reports and standard responses that should support the answers. This process will also reveal where documentation is missing, outdated or lacks an owner.

Then test whether the system finds the correct source, excludes old versions and routes uncertain questions to the right person. Quality should be assessed by the accuracy of the sources, appropriate escalations and the reduction in manual searching—not only by how many fields were completed automatically.

The aim is not to take responsibility for security away from people. It is to spend less selling time on repeatedly hunting for the same documents while delivering answers that are more traceable, consistent and properly approved.

Related on GrN.dk

• Fra leverandørfaktura til bogføring: AI med en kontrolpost

Need help with this kind of work?

Talk to Greg about a secure document assistant Get in touch with Greg.

Sources

• SikkerDigital: NIS 2-tjek
• Digitaliseringsstyrelsen: Hvad er kravene?
• Vejledningsskema for cybersikkerhedsforanstaltninger
• ENISA: NIS2 Technical Implementation Guidance
• OpenAI API: Retrieval guide