Prepared by [your firm name] under its own brand
Managed with RIVAL
Pack details
1. Executive summary
The client uses four AI tools across marketing, customer service, and finance. Twelve claims were reviewed. Seven are current, one is stale, one is missing, one is unsupported, and two are not applicable. Three gaps have owners and due dates. Since the previous approved review, the marketing acknowledgement gap was closed and one new tool was declared.
2. Request and scope
Noordwind Retail asked its suppliers to complete a security questionnaire with a new AI section. The section asks who uses AI tools, on which data, under which policy, whether staff were briefed, and how the supplier keeps this current. The operator scoped the review to the three departments that handle Noordwind data and to the period since the previous review.
Due date: 29 August 2026. Status at generation: answered.
3. Known AI use and controls
| AI tool | Users | Data | Policy | Classification |
|---|---|---|---|---|
| Microsoft 365 Copilot | 31 people | Internal documents, email | AI use policy v3 | Approved |
| CRM assistant (vendor add-on) | 12 people, marketing | Customer contact data | AI use policy v3, data annex | Approved with conditions |
| General chatbot (consumer plan) | 6 people, customer service | Should contain no customer data | AI use policy v3 | Restricted |
| Invoice extraction tool | 4 people, finance | Supplier invoices | AI use policy v3 | Unreviewed, declared 22 July 2026 |
4. Claims and evidence states
Each claim carries one state. Current: a supporting record exists inside its review window. Stale: the record exists but its window has passed. Missing: no record or control exists. Unsupported: records exist but do not substantiate the claim. Not applicable: the claim falls outside the scope, with a reason.
| Claim | State | Supporting record | Owner and next action |
|---|---|---|---|
| An inventory of AI tools in use exists and is maintained. | Current | AI map export, 30 July 2026 (E-01) | |
| An AI use policy is in force and versioned. | Current | Policy v3, effective 1 June 2026 (E-02) | |
| People in scope acknowledged the current policy version. | Current | 36 of 36 acknowledgements, latest 24 July 2026 (E-03) | |
| Marketing staff completed the data-handling briefing. | Current | Awareness report export, 12 completions, 18 July 2026 (E-04) | |
| Customer contact data is only entered into approved tools. | Current | CRM assistant approval and data annex, 9 June 2026 (E-05) | |
| The consumer chatbot is restricted for customer data. | Current | Tool classification record, 9 June 2026 (E-06) | |
| Microsoft 365 audit records are reviewed for AI activity. | Current | Audit-log export, 1 May to 31 July 2026 (E-07) | |
| Finance staff completed the data-handling briefing. | Stale | Awareness report, 4 completions, 3 February 2026, outside the six-month window (E-08) | Owner: finance lead. Refresh briefing by 5 September 2026. |
| The invoice extraction tool has a documented data-handling rule. | Missing | No record. Tool declared 22 July 2026. | Owner: operator. Classify the tool and add the rule to the data annex by 29 August 2026. |
| Customer service staff use only the approved tools. | Unsupported | Audit-log export shows two consumer-chatbot sessions from customer-service accounts on 14 July 2026 (E-07) | Owner: customer service lead. Confirm no customer data was entered, then assign one drill and re-acknowledge. |
| High-risk AI systems are registered and assessed. | Not applicable | Reason: no high-risk system in scope during the period. | |
| AI-generated public claims are verified before publication. | Not applicable | Reason: marketing publishes no AI-generated external content in the period. |
5. Gaps and remediation
- Finance data-handling briefing is stale. Owner: finance lead. Action: refresh briefing. Due: 5 September 2026.
- Invoice extraction tool has no data-handling rule. Owner: operator. Action: classify the tool and extend the data annex. Due: 29 August 2026.
- Two consumer-chatbot sessions from customer-service accounts. Owner: customer service lead. Action: confirm no customer data, assign one drill, re-acknowledge. Due: 22 August 2026.
6. Changes since the previous approved review
- Version 1 of 6 May 2026 covered 1 February to 30 April 2026 with nine claims; version 2 covers twelve.
- Closed: marketing acknowledgement gap. All twelve marketing acknowledgements recorded by 24 July 2026.
- New: invoice extraction tool declared on 22 July 2026; one missing claim opened.
- New: audit-log review claim added and supported by the 1 May to 31 July export.
- Changed: finance briefing moved from current to stale on 3 August 2026.
7. Response index
Each questionnaire question maps to the claims that substantiate the answer, with their states at approval.
| Question | Claims | State |
|---|---|---|
| Which AI tools do your staff use for our data? | Inventory; approved tools; restricted chatbot | Current |
| Do you have an AI policy, and did staff confirm it? | Policy in force; acknowledgements | Current |
| Were staff briefed on handling our data with AI? | Marketing briefing; finance briefing | Current; stale, refresh due 5 September 2026 |
| How do you monitor AI use? | Audit records reviewed; customer service tool use | Current; unsupported, action due 22 August 2026 |
| Do you use high-risk AI systems for our work? | High-risk registration | Not applicable |
8. Methodology
The reviewer opened the review from the request, mapped its questions to the claim structure of the AI Governance Core release in use, and linked each claim by hand to one or more records. Records came from the platform ledger, uploaded documents, one CSV export from the awareness platform, and one Microsoft 365 audit-log export. The reviewer set each state, recorded reasons for unsupported and not-applicable claims, assigned owners to gaps, and approved the review on 12 August 2026. Approval froze the claims, states, and links; this pack was generated from that frozen review.
9. Evidence index
- E-01 AI map export, 30 July 2026, platform record.
- E-02 AI use policy v3, effective 1 June 2026, platform policy version.
- E-03 Acknowledgement records, 36 of 36, latest 24 July 2026, platform records.
- E-04 Awareness platform completion report, marketing, 18 July 2026, CSV import.
- E-05 CRM assistant approval and data annex, 9 June 2026, uploaded document.
- E-06 Tool classification record, consumer chatbot, 9 June 2026, platform record.
- E-07 Microsoft 365 audit-log export, 1 May to 31 July 2026, file import.
- E-08 Awareness platform completion report, finance, 3 February 2026, CSV import.
10. Scope and limitations
This pack documents recorded actions and current state for the stated scope and period. It is not a legal opinion, not a certificate, and not a guarantee of compliance with any law. It does not assess any individual, and no customer, insurer, auditor, or regulator is obliged to accept it. Records outside the scope, or created after 12 August 2026, are not included. The next review is scheduled for November 2026.