A supplier says its AI service is secure. Your sales team wants to use it to prepare tenders from customer files. Before connecting those files, management needs answers that apply to the actual service and contract: who can access the material, what the supplier does with it, and what happens when something goes wrong?
This decision does not require a small Norwegian business to audit a global technology company. It does require the buyer to match the promised controls to its intended use, identify what remains unknown and decide what material the service may handle. A useful trial with approved, non-sensitive examples can begin while harder questions are resolved.
What public statements do and do not tell you
A research paper published on 3 November 2026 examined public documents from 200 of the world's largest listed companies. The researchers found that 32 of the largest 100 did not publicly acknowledge an AI risk in the documents they identified. This includes companies using AI as well as those developing it. The researchers also estimated results for the largest 1,000 from a sample; that is not a count of every company.
The finding is about public disclosure, not proof that those companies failed to manage risk. A company might manage an issue privately or publish a document the researchers did not find. Conversely, a polished statement is not proof that a control works for your account. The study is a preprint, its main document search took place in January and February 2026, with company feedback sought in June, and its sample is not representative of Norwegian suppliers.
The practical lesson is narrower: public information is a starting point for questions, not a substitute for assessing the service you intend to buy. Norway's National Security Authority recommends risk assessment, purchasing competence and suitable supplier requirements before outsourcing. Its guidance does not certify an AI vendor or impose the same contract on every business.
Start with the files and the work
Imagine a Norwegian engineering company considering a tender assistant. Its team wants to upload customer drawings, price estimates and draft proposals. This is a hypothetical example, not a client case. The benefit is faster preparation and a better search across previous bids. The potential cost is exposing a customer's confidential design or relying on an answer based on the wrong version of a drawing.
The project owner should first name the information, people and systems involved. Are drawings confidential under the customer agreement? Will the service receive personal information? Does the assistant need access to the entire archive or only selected files? A service that works well with public documents has not thereby been cleared for restricted customer material.
Then ask for answers tied to the proposed subscription, settings and data flow. A public policy describing a different product or consumer account is not enough. Record the answer, the source, its date and the person who will follow up. If the supplier cannot answer immediately, mark the point as unresolved rather than assuming the control exists or that the supplier is unsafe.
Five questions that change the purchasing decision
- Where does the material go? Ask which service components and subcontractors handle the files, where processing and support access take place, and whether data may leave the agreed environment. A storage location alone does not describe every access or processing operation.
- What may the supplier do with it? Check the applicable contract and product settings for model training, service improvement, human support, retention and deletion. Ask how those settings are enabled and whether they also cover subprocessors.
- Who can see and retrieve it? Ask how employee and administrator access is restricted, how access is removed and how the system is tested against a user retrieving another customer's documents. Test with approved sample files and accounts, not live confidential data.
- How will we know and respond? Agree how to report an incident, what notification and practical support the contract provides, who can suspend access, and what records are available for investigation. Test the contact route; a generic security email address is not a response plan.
- What changes after we sign? Identify how the supplier communicates changes to models, subprocessors, terms and security controls. Establish who reviews changes and when the business will retest or restrict the service.
Ask for evidence proportionate to the decision: contractual language, a description of the actual configuration, a relevant independent assessment and, where possible, a demonstration or a small agreed test. Check the scope and date of any assurance report and any exceptions. A certificate may cover a provider's management system without proving that this particular workflow is safe.
Decide what is allowed while gaps remain
A small firm may lack the bargaining power to change a standard contract. It still has options: use the service only with public material, remove sensitive details, limit access to a small group, choose another supplier, or delay the connection. Removing names alone does not necessarily make a drawing or commercial proposal non-confidential.
For the hypothetical engineering company, the first stage could use fabricated tender documents and require a person to verify references against the original files. Only after the unresolved contractual and access questions are addressed should management decide whether real customer material belongs in the service. Set a review date, a responsible person and a condition that stops expansion.
There is a cost to waiting too. The company may spend staff time searching old bids and miss opportunities to improve its response. Compare that cost with the exposure being avoided, and do not make low-risk experimentation wait for a decision about every future use. Before processing personal data, assess the applicable obligations and contractual roles with appropriate advice; the questions above are practical checks, not a legal determination.
Give the board the decision, not the questionnaire
Management owns the supplier review, implementation and follow-up. When the dependency or information is material, the board should see the intended business benefit, the information involved, the significant unanswered questions, the proposed restrictions and who has accepted the remaining exposure. The board should also ask what happens if the supplier changes or the service must be stopped. The separate AI supplier exit guide explains how to test continuity and an exit.
For your next AI purchase, take one important use case and ask the supplier to show how its answers apply to that exact configuration. A concise, specific answer can enable useful adoption. An unanswered material question tells management where to limit the trial and what to resolve next.
Sources checked on 9 November 2026. The engineering company and trial are hypothetical. The procurement questions and recommendations are the author's analysis. The illustration is AI-generated.