Your Next Enterprise Deal Comes With an AI Questionnaire. Can You Answer It?

You didn't lose that enterprise deal in the demo. You lost it 5 weeks later, in a spreadsheet, to a question nobody on your team could answer.

The champion loved it. The pilot went fine. Then it went to security review, and back came a document with 140 rows, 30 of them about AI.

Where does customer data go when the agent processes it. Which third-party services can the agent call. Who reviews its output before it reaches a customer. Can you produce a log of what it did last Tuesday at 3pm, and why it did that.

A year ago, "we take security seriously" got you through. Now agents need scoped identity, audit trails tied to specific tasks, and verifiable behavior logs to clear enterprise procurement. The questionnaire is where that gets checked.

Why it arrived so fast

Your buyer got the same memo you did.

Gartner expects 40 percent of enterprise applications to include AI agents by the end of 2026, up from under 5 percent. So every large company is deploying agents internally while also buying software that contains them.

Their internal deployments taught their security teams exactly what to be afraid of. Now they're asking you the questions they spent a year failing to answer themselves.

Ready, and it's an advantage. Unready, and it's a wall, no matter how good your product is.

The 4 that sink deals

Most of the questionnaire is boilerplate you can knock out in an hour. These are the ones where I watch founders go quiet.

Where does the data go? "We use OpenAI" won't do it. They want to know which fields leave your infrastructure, to whom, under what retention terms, and whether a customer can pull a specific record out. If you route through 3 vendors, all 3 are in the answer.

What is the agent allowed to do? They want a list of every tool, API, and integration the agent can reach, plus confirmation it can't reach anything else. "It has access to our internal systems" fails.

Who's accountable when it's wrong? They're asking whether a human reviews output before it hits a customer, and where exactly that line sits. If the honest answer is "nobody, it goes straight out," say that and explain why it's safe. Don't invent a review process on a form you'll have to prove later.

Can you show me what happened? Logs. Per action, per decision, retained. If an agent made a bad call 3 weeks ago, can you reconstruct what it saw and what it did? Most startups find out the answer is no while filling in the form.

Retrofitting is the expensive path

All 4 of those are architectural. A policy document written the week the questionnaire lands won't cover any of them.

Scoped permissions have to be designed into how the agent gets its tools. Audit trails have to be written when the action happens, not reconstructed afterward out of whatever you happened to keep.

Building this in from day 1 costs meaningfully less than retrofitting under pressure. And under pressure is exactly when you'll do it, because nothing motivates like a stalled six-figure deal.

[ROGER: a time you watched a deal stall on this, or a client who had to build audit logging in a panic. What was missing, and what it cost them in time.]

An afternoon of work, done early

You don't need a compliance department. You need a document that exists before anyone asks for it.

Write down every system your agents can touch, and why. Write down what data leaves your infrastructure and to which vendor. Decide which agent actions require human sign-off, then make the code enforce that decision instead of the wiki describing it.

Turn on logging that captures inputs, tool calls, and outputs. Then check you can actually query it, which is a different thing from having it.

Answer the 4 questions above in plain English and put them somewhere your sales team can find without asking an engineer.

The companies winning enterprise deals right now can answer on a Tuesday what everyone else needs 3 weeks and an emergency sprint to guess at.