Take a hypothetical. You’re on the annual re-scoping call for a client’s web and API test. The client’s security lead mentions that one of their customers has sent a security questionnaire.
The questionnaire asks whether the AI assistant in the client’s product has been tested, by whom, and with what result. Your account manager notes it and moves on to the API scope.
Six weeks later, the client’s product team fills in the questionnaire themselves. Nobody has tested the assistant as it runs in their product.
Your account manager could have asked one question on that call: what evidence does your customer need about the assistant? Moments like this come up in other accounts too. This article shows where to spot them, and how to check your own accounts in 30 minutes.
Four Places the Signals Appear
Customer Questionnaires
Your client is often the vendor under review. Its enterprise customers send security questionnaires before they buy or renew. Two standard questionnaires now include AI questions:
- The Cloud Security Alliance’s AI-CAIQ has 320 questions in version 1.1. It was released in June 2026 alongside the AI Controls Matrix.
- The Standardized Information Gathering (SIG) questionnaire has had an AI section since 2024, according to Mitratech, a SIG licensee. Its publisher, Shared Assessments, says the 2026 edition references ISO/IEC 42001, the AI management standard.
Someone at your client has to answer those AI questions. They may forward the questionnaire to you, or treat it as a sales-support task and never mention it.
Listen for phrases such as “our customer sent us a security review” or “they want to know about our AI”. When you hear one, ask which question the client has to answer and what evidence their customer will accept. Existing documents or test results may be enough. If they aren’t, there may be a test to scope.
AI Features in Your Current Tests
Your testers see AI features during ordinary web and API tests: an assistant in a customer portal, or a summariser in a case-management tool. They may note these as out of scope, because the statement of work didn’t name them.
Your existing checks may already cover part of the feature. Ask testers to tell the account manager about each one: what it can read, what it can do, and what the test already covered. The account manager can then agree any extra testing with the client.
Architecture Changes
Some clients connect assistants to internal APIs, tools, or Model Context Protocol (MCP) servers. Others let an assistant search internal or customer documents. Either change can let the assistant read more data or take new actions.
Look for what changed: a new permission, a new data source, or a new action. You’ll hear about it in change notices, architecture diagrams, and scoping questions. If a client asks whether new integration endpoints are in scope, ask whether an assistant calls them.
Governance Questions
Boards, auditors, and regulators may ask who tested an AI system and what they found. Two EU regulations make that question more likely for some clients.
The EU AI Act requires organisations that use high-risk AI systems to monitor how those systems run (Article 26). For the high-risk systems listed in Annex III, these rules apply from 2 December 2027 under Regulation (EU) 2026/1744. Not every AI system is high-risk, and the Act doesn’t require adversarial testing. A client asked to show that its monitoring works may still want test evidence.
The Digital Operational Resilience Act (DORA) requires financial entities, except microenterprises, to run appropriate tests at least once a year on the information and communication technology (ICT) systems behind critical or important functions (Article 24(6)). The tests can be internal or external.
DORA doesn’t mention AI. Our reading is that an AI component inside one of those systems belongs in the planning for that yearly testing. That doesn’t mean it needs a separate external AI test. Our build or partner framework covers both regulations in more detail.
Match Each Signal to a Next Step
The table below pairs each signal with the client’s question and a possible next step. Sometimes the answer is evidence the client already has. The table is a guide for commercial teams. It doesn’t describe what Provion covers, and it isn’t a sales script.
| Signal | Where you’ll hear it | The client’s question | Possible next step |
|---|---|---|---|
| A customer questionnaire with AI questions (SIG, AI-CAIQ, or a custom form) | Renewal or re-scoping call | “Can we show our AI feature was tested, by whom, and with what result?” | Check what the customer asks and what evidence it accepts. If existing documents don’t cover the AI feature, test it and give the client findings they can share. No certification or compliance claims |
| An AI feature found during an existing test | Tester notes; out-of-scope observations | “Is this covered by the test we bought?” | Check what the current test covered. Propose any extra testing for the client to approve |
| An assistant connected to internal APIs, tools, or MCP servers | Architecture diagrams; change notices | “What can it do if someone steers it?” | Test what the assistant can do, which account it acts as, and where a person has to approve |
| An assistant that searches internal or customer documents | Data-flow diagrams; release notes | “Can one user see another user’s data through the assistant?” | Test whether the assistant respects who can see what, using test accounts with different access levels |
| A board, auditor, or regulator asks who tested the AI system | Conversations with the CISO; audit findings | “What evidence supports our decision to run this system?” | A test tied to that decision and its date |
| A regulated client (financial, health, critical infrastructure) adds AI to a critical process | Annual test planning | “Does the AI component belong in this year’s testing?” | Confirm which rules apply. Add the AI component to this year’s plan if the plan doesn’t cover it |
| An AI product launch or a new AI vendor | Roadmap discussions; procurement | “Should we test before release, or before we sign?” | Test before release. Before buying, check that the vendor allows testing. If it doesn’t, ask the vendor for its own evidence |
Share the table with account managers before renewal season. The second column tells them where to listen. The third gives them the client’s question in plain words, and repeating that question back opens a better conversation than describing a service.
An AI feature becomes worth a scoping question once the client confirms that something isn’t covered.
Treat the Market Figures as Background
In 2025, 55% of EU companies with 250 or more employees used some form of AI, according to Eurostat. The figure is broad. It counts any AI use, so it can’t tell you how many customer-facing assistants exist. The survey also leaves out finance, insurance, and health companies.
A HackerOne survey of 303 security leaders in early 2026 found that 94% run more AI or machine learning systems than a year ago, and 66% formally test at least 61% of them. HackerOne sells security testing. It surveyed companies with more than USD 250 million in revenue in six countries, and Germany was the only EU member among them.
The two surveys measure different things. Together they suggest that AI use is growing and testing is uneven. Your own accounts will tell you more.
Run a 30-Minute Account Review
Pick five to 10 accounts with recent testing work or a renewal coming up. Give each account one row, and fill in the seven columns below from the records you have to hand. If you don’t know something, write “unknown” and check it later.
Do the review with two people: the account manager who owns the renewals, and a lead tester who has read the recent reports. The tester will remember AI features that never made the report summary. Spend 10 minutes choosing accounts, 15 filling in rows, and five sorting them.
Download the account review sheet to work in a spreadsheet. It opens in Excel or Google Sheets and flags the rows that are ready for a scoping conversation.
| Column | What to record | Where to look |
|---|---|---|
| 1. Account and next touchpoint | Client name and the date of the next renewal, call, or report readout | CRM; engagement calendar |
| 2. AI feature in test notes | Yes, no, or unknown. Where and when testers saw it | Report appendices; tester notes |
| 3. AI questions in a customer questionnaire | Yes, no, or unknown. Which questionnaire, and when the client mentioned it | Call notes; client emails |
| 4. Architecture change | Yes, no, or unknown. What changed, and when | Architecture diagrams; change notices |
| 5. Regulated process | Yes, no, or unknown. Which rules might apply | Client profile; testing plans |
| 6. AI system and owner | The system’s name and the person responsible for it | Any of the above |
| 7. Evidence gap and next step | What the client has to show, to whom, and by when. What’s missing. The question to ask next | Questionnaire deadlines; release and audit dates |
A completed row might look like this:
- Account: annual web and API test client, re-scoping call on 12 January
- AI in test notes: yes, a support assistant in the customer portal (March report)
- Questionnaire: yes, a customer questionnaire with AI questions
- Architecture change: yes, the assistant gained an order-lookup tool in September
- Regulated process: unknown
- System and owner: the support assistant, owned by the head of customer platforms
- Evidence gap: the customer wants answers before its spring renewal, and nobody has tested the assistant
- Next step: ask what the questionnaire asks and what evidence the customer will accept
Then sort the rows. A row with a named system, its owner, an evidence gap, and a decision date is ready for a scoping conversation. If any of the four is still unknown, or the row only says “they use AI”, it needs clarification, so ask about it on the next call. Keep “unknown” apart from “no”, because a report that doesn’t mention AI doesn’t prove the client has none.
Aim for a shortlist of up to three accounts. That’s enough to see whether these signals lead anywhere, and few enough to prepare each conversation well.
If the review finds nothing, add columns 2 to 4 to your scoping template so your team records these signals as they come up. Then run the review again next quarter.
Answer a Signal With a Scoping Question
When you spot a signal, skip the general AI conversation. Ask which AI system is involved, who owns it, and what the client has to show, to whom, by when.
In the opening example, you could ask: “Which assistant does the questionnaire cover, who owns it, and what evidence does your customer expect before the renewal?”
If the client can answer, you have enough to scope the work, though not yet proof of budget. If they can’t, start with a discovery conversation.
Keep two limits. Don’t promise testing your firm can’t deliver yet, and don’t call the work compliance or certification. A test gives the client evidence about how its system behaves, and the client decides what to do with that evidence.
Our build or partner framework sets out five questions for qualifying a client requirement and choosing how to deliver the work. The scoping guide walks through writing the scope addition.
Bring One Account to a Partner Conversation
Provion is an independent adversarial testing service for AI systems, built for teams in security-conscious and EU-regulated environments. It produces structured, defensible evidence of how an AI system behaves, fails, and exposes risk. We work with pentest and offensive-security firms that want to add AI adversarial assessment to their services while keeping ownership of the client relationship.
If your review turns up an account with a named AI system, bring it to a partner conversation. We’ll help you decide whether and how to scope it.
