Agree what information belongs in the service.
Begin with a data map: the records you intend to hold, their owners, their sensitivity and the people who need access. An inventory entry usually needs a useful description of a system, not a copy of every prompt, customer file or production dataset. Keep the purpose of collection specific and use references where full copies are unnecessary.
During scoping, identify retention expectations, permitted locations and any contractual restrictions on supplier documents. These decisions shape the implementation requirements.
Make access and approval authority explicit.
Separate the person supplying evidence from the person deciding whether it is sufficient. Define who may view sensitive material, change a classification, accept an exception or close an action. Include joiner, mover and leaver responsibilities so access remains appropriate when people change roles.
Ask how changes and review decisions will be recorded, how access will be checked and what evidence will be available to your assurance team. These controls must be agreed for the actual deployment.
Request evidence that matches the proposed service.
Security due diligence should cover the complete arrangement, including application configuration, hosting, support access and any connected services. Request the applicable service specification and security information rather than assuming that a general technology statement describes every delivery option.
- Confirm the hosting and data-processing arrangements for your scope.
- Identify supplier and sub-processor responsibilities.
- Agree incident contacts, escalation and communications.
- Document recovery, retention, deletion and exit requirements.
Keep public enquiries separate from sensitive evidence.
The public enquiry route is for describing your requirements and arranging the next step. Do not submit passwords, access tokens, full customer datasets or confidential assessment packs there. If detailed evidence is needed, agree an appropriate exchange method and authorised recipients first.
Certification status, availability commitments and specific technical controls should be supported by current documentation. EUAIC does not present a generic website statement as proof that a customer's complete AI deployment is secure or compliant.