Why we built Soundings
The 80-question AI questionnaire standing between you and a signed contract
If you sell software or services to banks, insurers, public bodies or large companies, you've probably met it already: a spreadsheet of questions about how you use AI, arriving just as the deal is about to close.
By the Lowtide team · · 5 min read
The problem we kept seeing
Large buyers are under pressure to understand the AI in their supply chain. The EU AI Act is phasing in obligations, with its main high-risk duties now expected from December 2027 after the EU agreed a delay. ISO/IEC 42001, the first certifiable AI management system standard, was published in December 2023 and appears increasingly in procurement. The NIST AI Risk Management Framework and the ICO's guidance on AI and data protection are common reference points.
The result reaches suppliers as due-diligence questionnaires. Which AI providers do you use? Is customer data used for training? Who reviews AI outputs? How do you handle bias, incidents and model changes? Each buyer asks in their own words and their own format.
What goes wrong today
- Each questionnaire lands on a founder or engineer who has to find the answers from scratch.
- Answers drift between questionnaires, so two customers get slightly different accounts of the same practice. That is a real risk if anyone compares them, or if an answer was too generous.
- Questionnaires arrive at the end of a sales cycle, so slow answers delay revenue.
- Generic AI writing tools fill gaps with confident-sounding text that may not be true. In due diligence, an invented answer is worse than a blank.
How Soundings approaches it
Soundings starts with a short AI profile: the providers you use, what data goes to them, retention and training settings, human review, testing and incident handling. You fill it in once.
When a questionnaire arrives, paste in the questions, copied from the document or spreadsheet. Soundings drafts every answer from your profile only. Anything the profile doesn't cover is marked Needs input rather than guessed. You review, edit and download the answers as CSV, ready to paste into the buyer's format.
Because every answer comes from the same profile, customers get consistent answers, and updating the profile updates future answers. If you don't have an AI policy yet, Soundings can draft one from your profile too. Not sure where you stand? The free AI readiness check scores you against five common frameworks in a few minutes.
Example · B2B software and services
A software company selling to an insurer
A 25-person software company is in the final stage of a deal with a UK insurer. Procurement sends a 64-question supplier AI assessment covering data use, model providers, human oversight and alignment with ISO/IEC 42001.
The CTO completed the company's AI profile when the previous questionnaire arrived. Soundings drafts 57 answers from it and marks 7 as Needs input, mostly about bias testing, which the company hasn't formally documented. The CTO answers those honestly, adds them to the profile for next time, and returns the questionnaire in a day rather than two weeks.
This is an illustrative example, not a customer story.
What you get in the first month
- One AI profile your whole team can answer from
- Your next questionnaire drafted in minutes, with gaps clearly flagged
- Consistent answers across every customer
- A draft AI use policy if you don't have one
Who it's for, and who it isn't
A good fit
- Software and service companies selling to banks, insurers, public bodies or large enterprises
- Founders and CTOs who answer security and AI questionnaires themselves
- Teams preparing for ISO/IEC 42001 or EU AI Act questions
Probably not for
- Anyone looking for legal advice on AI regulation. Soundings drafts answers from what you tell it.
- Firms that need full security questionnaire automation across hundreds of controls
Sources
- Sidley Austin: EU lawmakers agree to delay key AI Act obligations (June 2026) (opens in a new tab)
- ISO/IEC 42001:2023 (opens in a new tab)
- NIST AI Risk Management Framework (opens in a new tab)
- ICO guidance on AI and data protection (opens in a new tab)
Examples in this article are illustrative, not customer stories. Nothing here is legal advice.