Answering a European Client's Security and Compliance Questionnaire

Why your client sends you this questionnaire#

Your European client remains responsible for what you do on its behalf. If it is a controller within the meaning of the GDPR, Article 28 requires it to sign a detailed contract with you and, in return, requires you to provide it with the information needed to demonstrate your compliance and to allow audits. For the client, the questionnaire is the simplest way to document that choice.

Three factors make these questionnaires more demanding for a Moroccan provider:

• Morocco has no adequacy decision from the European Commission. Every data flow to Morocco must therefore rest on appropriate safeguards, in practice the standard contractual clauses, and on a transfer assessment. The detail is covered in our guide on the Moroccan processor of a European client.
• The AI Act applies to providers established outside the Union where the output of their AI systems is used in the Union (Article 2). Your client wants to know what AI you use and what your role is.
• Third-party risk programmes at large clients have become more structured. The guide on third-party risk management describes that system from the buyer's side; this page is its counterpart, from the supplier's side.

The six domains of a typical questionnaire#

Formats vary (an in-house spreadsheet, an assessment platform, a sector questionnaire), but the themes almost always recur.

For AI, the decisive question is your role: a centre that deploys a vendor's chatbot does not have the same obligations as one that develops it and markets it under its own name. The guide provider or deployer helps you decide. If a conversational agent answers European customers, also expect a question on the obligation to tell customers they are talking to AI, which has applied since 2 August 2026.

ISO 27001 and ISO 27701: evidence, not a legal obligation#

ISO/IEC 27001 certifies an information security management system; ISO/IEC 27701 extends it to privacy management. Neither is required by the GDPR, by Law 09-08 or by the AI Act. Their value lies elsewhere: a certificate issued by an accredited body, together with its statement of applicability, answers a large part of the security domain in one go.

Three precautions are essential:

• Check the scope. A certificate that covers head office but not the floor that processes the client's data proves nothing for that client. The scope is stated on the certificate.
• Do not confuse certification with compliance. ISO 27001 says nothing about your standard contractual clauses, your CNDP formalities or your obligations under the AI Act.
• Put accuracy before the timetable. "Certification targeted within twelve months, mock audit completed" is an acceptable answer. "ISO 27001 compliant" without a certificate is not.

For AI, ISO/IEC 42001 plays a comparable role; see our guide on ISO 42001 certification.

Building an evidence room#

An evidence room is a controlled, dated document repository in which every statement in the questionnaire points to a specific document. It turns a recurring ordeal into an updating exercise.

1. Start from the questionnaires you have already received. Group the questions by domain and identify those that recur.
2. Write a reference answer for each question, approved by the domain owner, with the date of approval.
3. Attach evidence to each answer: policy, procedure, extract from the record, configuration screenshot, test report, standard contract.
4. Sort the evidence into two tiers: what you can send (policies, certificates) and what you only show during an audit or a video call (detailed penetration test reports, architecture).
5. Name an owner and a review date for each document. Out-of-date evidence is worse than no evidence.
6. Keep a log of what you send: which document, to which client, under which confidentiality agreement, on what date.

If you carry out telemarketing on behalf of French clients, add a folder dedicated to proof of consent, which French regulations place on the business.

Who answers what#

The single coordinator is the key: they ensure that answers do not contradict each other from one domain to the next or from one client to the next.

Mistakes to avoid#

• Answering "yes" to everything so as not to lose the deal. A later audit will cost you the relationship.
• Copying another group's policies without applying them. The client will ask for evidence that they are applied, not for texts.
• Forgetting sub-processors: the telephony software vendor and the generative AI tool used by agents are among them.
• Sending sensitive documents without a confidentiality agreement or a log of what was sent.
• Letting the salesperson answer alone, without approval from the domain owners.
• Treating each questionnaire as a one-off, instead of feeding the evidence room.

Action plan#

• Appoint the questionnaire coordinator and the domain owners.
• Gather the last three questionnaires received and extract the recurring questions.
• Draft the reference answers and have them approved.
• Build the evidence room, with an owner and a review date for each document.
• Keep the list of sub-processors and the inventory of AI systems up to date.
• Check the Article 28 contract, the standard contractual clauses and the transfer assessment for each client.
• Schedule a full review at least once a year, and at every significant change.