What security will ask before approving AI

The rollout is going well, adoption is climbing, and then the security team asks for a meeting. Or a customer sends a questionnaire. Or the compliance lead mentions that the ISO 42001 assessment now covers AI vendors. The questions are the same in all three cases. Here they are, each with the answer that passes and the one that pauses the rollout.

1. Where is the data processed, and is it trained on?

Passes. Regulated data is processed in the region we chose, enforced by the platform per team, and training on our content is switched off with the vendor. Here is the data-flow diagram and the DPA.

Does not. The vendor says they are GDPR compliant. Everyone is on the same plan.

A policy that asks people to pick the right model is a request. Region and training settings applied at the platform level, per team, are a control, and reviewers know the difference. The data sovereignty page covers what that requires.

2. Who can access which models and which data?

Passes. Access follows our identity provider groups. Each team has a set of approved models and a set of connected systems. Here is the matrix.

Does not. Everyone has the same access. We trust people to be sensible.

Reviewers want to see that the finance team’s assistant cannot read the HR system, and that changing that takes a permission rather than a conversation.

3. How are skills, connectors and integrations checked before they run?

Passes. Every skill and connector is scanned before it runs and rated for risk. Low-risk ones are available. Higher-risk ones wait for approval from the owner of that process. Here is the review queue.

Does not. People can install what they need.

The moment an assistant can read a CRM or send an email, the thing that reads and sends needs a gate. Scanning skills and connectors is that gate, and it is where Harriet’s security model starts.

4. Is every action logged, and can we export it?

Passes. Every prompt, model call and tool call is recorded with the user, the time and the outcome, and the log exports to our SIEM. Here is a sample.

Does not. The vendor keeps usage statistics.

A reviewer wants to be able to answer, six months from now, what the assistant did with a specific customer’s record on a specific day. Token counts cannot do that.

5. What happens when someone leaves?

Passes. Access is provisioned and revoked through the identity provider. Deprovisioning removes the assistant, its connections and its history from the device.

Does not. We remove them from the seat list.

If the assistant was installed through personal sign-up, there is nothing to revoke, which is one of the strongest arguments for provisioning through the IdP and MDM from the start.

6. What are the vendor’s own certifications?

Passes. The platform is SOC 2 Type II, the report is in the trust centre, and here are the sub-processors and their regions.

Does not. They are a well-known company.

Ask every vendor in the chain, including the model providers. A platform that sits in front of them should be able to hand you the whole list.

7. How do we stop personal accounts?

Passes. The company assistant is on every device, with the models people want, so the sanctioned route is the easy one. Personal use dropped once it was. Here is the before and after from our shadow AI map.

Does not. We have a policy against it.

8. Who owns this?

Passes. One named person owns the AI policy, the review queue and the quarterly check against tools in use.

Does not. It is shared between IT and legal.

What ISO 42001 adds

If your company is pursuing the AI management-system standard, or customers are asking whether you are, the eight questions above map almost directly onto what an assessor wants. An inventory of AI in use, a risk assessment for each system, policies with an owner, and records that show the controls operate. A platform that can produce the inventory and the records from its own logs turns a months-long evidence hunt into an export.

If a review is coming, book a call and we will go through the eight with your answers in front of us.

Common questions

What does a security review ask about AI tools?

Eight questions, in practice. Where data is processed and whether the vendor trains on it. Who can access which models and data. How new skills, connectors and integrations are checked before they run. Whether every action is logged and exportable. How access is revoked when someone leaves. What the vendor's own certifications are. How personal accounts are prevented. And who owns the policy. An AI rollout that can answer all eight from a dashboard passes quickly.

What is ISO 42001?

ISO 42001 is the international standard for an AI management system, published in 2023. It asks an organisation to inventory the AI it uses, assess the risks of each system, define roles and policies, and keep records that show the controls operate. Companies in regulated sectors are increasingly asked for it by customers, and it pulls every AI vendor they use into scope.

Does Claude Enterprise or ChatGPT Enterprise pass a security review?

Both carry serious enterprise controls, including SSO, SCIM, audit logging and a default of not training on your data. What they cannot answer is anything about the other vendor's models, or about the AI features inside other tools your staff use. A review of the whole company's AI use needs one place that sees all of it.

What is skill and connector scanning?

Skills are reusable AI workflows and connectors are the links between the assistant and your systems. Scanning checks both before they run, for things like data exfiltration, prompt injection and over-broad permissions, and rates the risk. Low-risk ones run. Higher-risk ones wait for approval from the person who owns the process. It is the AI equivalent of reviewing a browser extension before it is allowed on the fleet.