AI questions have been appearing in tender documents and supplier questionnaires for about a year, and most responses to them are still bad. Not dishonest, just unhelpful: a paragraph of reassurance that tells the evaluator nothing they can score. The firms writing good answers are not the ones using AI least, they are the ones who worked out what the question is actually asking.
The question is almost never whether you use AI. Evaluators assume you do, and a response implying otherwise reads as either evasive or uninformed. What they are trying to establish is whether your use of it introduces risk they will inherit, and whether you can demonstrate control rather than assert it.
What you use it for, specifically. “We use AI to improve efficiency” scores nothing. “We use AI-assisted analysis for first-pass document review and drafting, not for final recommendations or figures presented to the client” tells the evaluator exactly where the boundary sits, and boundaries are what they are looking for.
What it works from. An answer that says output is grounded in the client’s own documents and approved sources, rather than general training data or the open internet, addresses the single largest category of risk in the evaluator’s mind. If retrieval is restricted to a defined evidence set, say so plainly, because most respondents cannot say it.
What checks it passes before anyone sees it. This is where most responses collapse into generality. Naming the mechanism is worth more than describing the intent: independent models checked against each other, disagreement flagged rather than averaged away, claims carrying citations to the passage behind them, a named person approving before delivery.
What you can produce on request. The strongest line in an AI section is an offer, because it converts every preceding claim into something testable: that for any deliverable you can provide a record of what the analysis rested on and who approved it. Respondents who can write that sentence honestly are still unusual enough that it carries weight.
Do not name the models. It dates the response immediately, invites questions about vendors you do not control, and tells the evaluator nothing about your process. Describe the mechanism and the controls instead, which is what is actually being scored.
Do not claim compliance with any regulation. No supplier can confer it and no evaluator believes it, and a claim like that converts a strength into something the procurement lawyer now has to probe. Say that your workflow is built to support governance requirements such as human oversight and record-keeping, which is both accurate and more useful.
And do not promise a review process you do not run. A tender response is a document you will be held to for the length of the engagement, so a described gate that does not exist in practice is the worst available outcome: it is a written commitment with nothing behind it, in a file somebody will reread if anything goes wrong.
The practical move is to draft this section properly a single time and reuse it, because the questions are converging rather than diverging. A well-built AI section is roughly three hundred words and will serve for most of a year with light edits, which is a much better use of effort than improvising a fresh answer every time a questionnaire arrives with a deadline attached.
Qonera is the AI governance platform for professional teams, and the review and approval workflow is built so that each of those four answers is a description of something real: evidence audited before analysis, grounding restricted to your own files, disagreement between independent models surfaced as a Conflict Heatmap, and named sign-off written to a tamper evident audit trail you can export. Which obligations sit with us and which sit with you is set out in the responsibility matrix. The evaluator is not trying to catch you using AI, they are trying to find out whether anyone is checking it, and that is a much easier question to answer well.
Multi-model stress testing, Conflict Heatmap, tamper-evident audit trail, and structured sign-off, built for teams who need defensible AI output.