Answering an RFP or security questionnaire with AI — and the mistake that costs you
To answer an RFP, tender or security questionnaire with AI, give it the questionnaire as the structure and your current policies as the only source, require a quote from a named document under every answer, and check every answer that states a number, date, certification or promise. Treat any answer without a quote as a question for a colleague, not a draft to send.
Drafting is the easy part now. The expensive mistakes are elsewhere.
The mistake that costs you
The worst outcome is not a clumsy answer. It is a fluent, confident answer that quotes last year's policy — the backup retention period you have since changed, the certification that lapsed, the encryption standard you migrated away from. An AI quotes a superseded document as happily as a current one; it has no way to know which one your company stands behind.
The second-worst outcome is an answer with no source at all, where the model filled a gap with what a typical company would say. It reads exactly like the others.
Both are invisible unless every answer has to show where it came from.
Step by step
- Clear out what should not be quoted. Move old policy versions and drafts out of the folder — or, in MindMax, right-click them and keep the AI out. Ten minutes here prevents the worst mistake.
- Probe the three hardest questions first. Before drafting anything, ask the questions you are least sure of, such as "what do our documents say about data retention for backups?" A thin answer is a gap found while it is cheap.
- Hand over the questionnaire as the structure. Every question kept in its own wording and order — not renamed, merged or reordered. Reviewers check answers against their own numbering.
- Approve the outline before any answer is drafted. Every question and the point each answer will make. This is where you catch "we are going to say yes to SOC 2" before it is written down.
- Check the answers that commit you. Click through the quotes for every certification, number, date and promise. Then look at the answers with no quote — those are the ones most likely filling a gap.
- Mark it up and take only the edits you want. Comment where an answer is wrong, too confident or too long for the form. Revisions come back as tracked changes, grouped with reasons.
- Export to Word. Each citation becomes a numbered source that names the document and keeps the quoted passage. Keep the Markdown copy: it is the starting point for the next similar questionnaire.
Why the quote is the whole point
A questionnaire answer is a statement your company will be held to. "Where does it say that?" is a question you will be asked — by the reviewer, by legal, or by an auditor a year later. An answer with a quote from a named, current document answers it on the page. An answer without one is your company's signature on something nobody checked.
That is also why the line between "stands on our documents" and "does not" should be visible in the draft, not discovered later. An unquoted answer is not necessarily wrong. It is a task.
Where it goes wrong
- Your documents are the ceiling. If the policy does not say it, the answer cannot honestly say it either. Gaps found here are often the most useful output of the whole exercise.
- Portal-based questionnaires still need answers pasted in by hand, one field at a time.
- Character limits. Long, well-sourced answers may need trimming for the form; do that as a revision you review, not by hand-deleting the source.
- Legal and compliance review still applies. This gets you a sourced draft fast. It does not sign off.
The full workflow, with the questions to ask at each step, is answer a questionnaire from your documents. How answers cite their sources is in chat with your documents, and how the citations survive into Word is on Word and PDF export.