Answer your customer's AI due diligence with proof behind every answer.
A fixed-price, evidence-graded review for AI vendors selling into banks, insurers and super funds. We grade up to 20 questions from your customer's AI or security due diligence questionnaire against your own records, so nothing you send is a claim you can't back.
- 7 business days
- From receipt of your evidence pack
- Up to 20
- Substantive AI questions answered and graded
- AUD 4,950 + GST
- Fixed price
Lender, BNPL or lending-tech firm getting ready for 10 December? See the AI Customer Assurance Sprint. AI vendor answering a bank, insurer or super fund's due diligence questions? See the Governance Decision Pack.
Where deals stall
A bank, insurer or super fund has sent you a due diligence questionnaire, and somewhere in it is a section on AI. It asks how you control changes to your models, where your training data came from, which foundation model sits behind your product, whether a person can step in on high-risk decisions, and whether the institution's data is ever used to train anything.
Your team does most of these things. The hard part is proving it. Your CTO stops building and starts drafting from memory. The answers read well, but nobody can say which ones your records actually support. Each weak answer comes back as another round of questions, and each round moves the deal date.
Institutions are looking harder at the AI and the third and fourth parties behind their suppliers, and APRA-regulated entities now manage their service providers under CPS 230. Answers get tested, not just read.
How it works: Map, Grade, Prove
Map
We separate the AI questions from security, legal and procurement, map each one to the record that could prove it, and map the AI supply chain behind your product: model providers, hosting, subprocessors and fourth parties.
Grade
We grade every proposed answer against your evidence.
Prove
We write each response to its grade, build a dated evidence register and a ranked gap list, and hand it all over in a 60-minute decision session.
The four grades
| Grade | What it means | What we do with it |
|---|---|---|
| Supported | A dated record backs the answer as written | Submitted as written, with the record cited in the register |
| Partially supported | A record exists but is incomplete, undated, or covers only part of the claim | The answer is narrowed to what the record supports, and the gap goes on the priority list |
| Not evidenced | No record backs the claim, even if the practice exists | Fixed before submission, or disclosed with a plan. Never submitted as if it were Supported |
| Not applicable | The question doesn't apply to your product | Answered as not applicable, with the reason stated |
The grades are evidence-readiness judgements to support your decisions. They aren't legal advice, a certification or an audit opinion.
What's included
Submission-ready, evidence-graded AI responses
Up to 20 substantive questions, each with its grade, the answer written to the grade, and the record it relies on.
AI supply chain and fourth-party map
Model providers, hosting regions, subprocessors and fourth-party dependencies, with concentration flags.
Dated AI evidence register
Every record with its owner, date and next review date, so the next questionnaire starts from evidence, not memory.
Evidence-gap priority list
Each gap ranked (fix before submission, disclose with a plan, or no action), with suggested disclosure wording.
A 60-minute decision and handover session with your decision owner
We walk through the grades and the gaps, and you decide what goes to the institution.
You decide what goes to the institution. We make sure every answer you send is one your records support.
Timing and what we need from you
| When | What happens |
|---|---|
| Kickoff | Engagement signed. We send the evidence request and a short pre-questionnaire for your technical owner (about 30 minutes). |
| Clock starts | The 7-business-day clock starts when your evidence pack arrives. You commit to sending it within 2 business days of kickoff. |
| Days 1 to 2 | Map the AI questions to your records and your AI supply chain. One 90-minute interview with your technical owner. |
| Days 3 to 4 | Grade every answer and complete the supply chain map. A 30-minute clarification if needed. |
| Days 5 to 6 | Draft the responses, rank the gaps, build the register. |
| Day 7 | Pack delivered, with the 60-minute decision and handover session. |
From you: a named evidence owner who pulls the records, your evidence pack within 2 business days of kickoff, your technical owner for no more than 3 hours in total, and your decision owner at the Day 7 session.
Price
AUD 4,950 + GST, fixed price. It covers up to 20 substantive AI questions. Larger questionnaires are quoted before we start.
Not included: legal advice, certification, an ISO 42001 implementation, SOC 2 or ISO 27001 remediation, penetration testing, contract negotiation, a full cybersecurity assessment, or any promise that the institution will approve you or sign.
What we won't promise
That the institution approves you or signs. Nobody outside the institution controls that. What the Pack does is stop the AI section being the reason your deal slips.
See it before you buy
A sample Pack for a fictional supplier, marked SAMPLE on every page: graded answers, a supply chain map and a register excerpt.
How it fits the Guidance for AI Adoption
The Australian Government's Guidance for AI Adoption (October 2025) sets out six essential practices for organisations using AI, including deciding who is accountable, measuring and managing risks, and sharing essential information. Your customers are applying the same thinking to their suppliers. The dated register and supply chain map give you a clear record of where you stand against those questions.
FAQs
We have SOC 2 and a compliance library. Can't we do this ourselves?
What does it cost, and what if we have more than 20 AI questions?
When does the 7-day clock start?
What if you find gaps? Do we have to tell the bank?
Is this legal advice or a certification? Will the bank approve us?
Lender, BNPL or lending-tech firm getting ready for 10 December? See the AI Customer Assurance Sprint. AI vendor answering a bank, insurer or super fund's due diligence questions? See the Governance Decision Pack.