# What Should You Ask Suppliers Who Use AI on Your Work?

Canonical URL: https://business.theaieducator.io/posts/questions-to-ask-suppliers-who-use-ai
Publication: Dan Fitzpatrick Insights
Author: Dan Fitzpatrick
Topic: AI Governance and Risk
Published: 2026-11-01T16:41:00.000Z
Modified: 2026-11-01T16:41:01.593Z

Your freelancer, bookkeeper or agency may already be using AI on your work. Here are the five things to ask in writing, a one-page Supplier AI Card you can copy, and what to do with the answers.

## In brief

Ask every supplier or freelancer whose work carries your name, or who handles your customers' information, five things in writing: where they use AI, what of yours goes in, who checks it, who answers if it is wrong, and what happens when you part. Do not ban AI; record the answers.

## Key takeaways

- A supplier's AI use becomes your problem because your customer will ask you, not your supplier, when something is wrong.
- The Name-On-It Rule: a supplier may use AI on your work only after telling you in writing where, what of yours goes in, who checks it, who answers for errors, and what happens when you part.
- In one 2026 study of freelance work, 25.9% of clients expected proactive AI disclosure but only 8.6% of workers said they would give it, so silence is the default.
- UK Cabinet Office guidance treats supplier AI use as something to ask about and record, not to ban or score.
- Match effort to risk: all five questions for suppliers who carry your name or handle customer data, two for lighter work, one line for the rest.
- Add three plain lines to contracts and renewals on disclosure, training use of your data, and return or deletion at the end.
- A supplier who cannot or will not answer is telling you something: send them less, review sooner or move the work.

Ask every supplier or freelancer whose work carries your name, or who handles your customers' information, five things in writing: where they use AI on your work, what of yours goes into it, who checks the output, who answers if it is wrong, and what happens to your material when the job ends. You do not need to ban AI.

Your copywriter, bookkeeper, answering service and agency may already be using AI on your work, and the research below suggests many will say so only if asked. This matters to small and medium-sized businesses (SMBs, or SMEs in the UK and Europe) because you rarely have a procurement team to ask for you.

## Why does a supplier's AI use become your problem?

It becomes your problem because your customer will ask you, not your supplier. If a freelancer drafts your proposal with AI and invents a figure, or a bookkeeping service pastes your payroll file into a public chatbot, the error arrives under your name and the data leaves under your responsibility.

Careful buyers have started treating this as a routine question. The UK Cabinet Office's Procurement Policy Note 017, published on 17 February 2025, applies to central government bodies, and it says other public bodies "may wish to apply the approach". It states: "AI and Machine Learning is becoming increasingly prevalent in the delivery of "non-AI" services." Its example questions ask a supplier whether AI is used "as part of the products/services you intend to provide", and, for bids, to confirm that AI-assisted content "has been checked and verified for accuracy".

Read what the note does not do. It says the disclosure questions are "for information only" and should not be scored, and it says a supplier's AI use "is not prohibited during the commercial process". The model is to ask, record and decide, not to ban.

Law firms see the same gap. Writing on 17 August 2026 about the UK Information Commissioner's Office and its duty to produce a statutory AI code of practice, Arnold & Porter said "AI-specific contractual terms, covering training-data rights, model updates, output ownership, and sub-processing, are increasingly expected in due diligence, but are not yet standard in many existing supplier agreements." That is a law firm's reading, not a regulator's rule.

## What does the research say suppliers and freelancers actually do?

The best evidence I have found says silence is the default. A paper by Angel Hwang and colleagues, posted to arXiv on 8 March 2026 and presented at CHI 2026, studied AI disclosure in freelance work. It interviewed 41 freelancers across freelance platforms and ran surveys of 100 workers and 145 clients. The paper does not state a country in the text I read.

Here is what it found, as the authors report it:

- Of the 41 interviewed freelancers, 16 (39%) disclose AI use only when a client explicitly asks.
- In the surveys, 25.9% of clients expected workers to disclose AI use proactively, while 8.6% of workers said they would.
- 63.5% of workers believed clients could identify AI use simply by examining the work. Clients' own confidence averaged 3.11 on a 5-point scale, only slightly above the midpoint.
- Where clients had written AI policies, the paper found vague language such as "using AI with common sense" and "human judgment".

My interpretation: the supplier assumes you can tell, you assume they would say, and neither of you says anything. Take the limits seriously. These are freelancers and clients recruited through platforms, the figures are self-reported, and they are not a sample of the UK or US businesses that supply a 30-person firm. The pattern is a reason to ask, not a measure of how many suppliers use AI.

## What are the five things to ask?

I call the rule behind the five questions the Name-On-It Rule. The Name-On-It Rule is one rule for any work you buy that goes out under your name or touches your customers' information: the supplier may use AI on it, but only after they have told you in writing where they use it, what of yours goes into it, who checks the output, who answers if it is wrong, and what happens to your material when the job ends. If your name is on the work, you need those five answers before the work starts, because your customer will ask you, not your supplier.

The five will look familiar if you have read [how a small business should answer AI questions in tenders](https://business.theaieducator.io/posts/ai-questions-in-tenders-small-business). There I defined the Buyer's Five this way: "The Buyer's Five are the five questions behind every customer, tender and supplier questionnaire about your use of AI, however each is worded: What do you use it for? What goes into it? Who is accountable? Who checks the output? What happens if it goes wrong, or when we part? A business that can answer all five in writing, the same way each time, is ready for any questionnaire." The Name-On-It Rule turns the same five around and points them at the people who work for you.

1. **Where do you use AI on our work?** A good answer names tasks ("first drafts, transcription, summarizing call notes") and says what stays with a person. The warning sign is "we just use it to be more efficient".
2. **What of ours goes into it?** A good answer describes categories of your material, says what never goes in, and says whether the tool keeps it or learns from it. The Australian Government's guide to questions for AI suppliers asks it plainly: "Will any of our data be used to train AI models now or in the future?" The warning sign is a supplier who cannot say which tools they use or who else touches your files.
3. **Who checks the output, and how?** A good answer names a person and a check that fits the mistake. In my article on [training staff to catch AI mistakes](https://business.theaieducator.io/posts/train-staff-to-check-ai-output) the three slips are a wrong fact, invented support and a wrong fit, and a supplier's check should be able to catch all three. The Australian guide asks: "Where do people review or approve AI outputs?" The warning sign is "the client checks it".
4. **Who answers if it is wrong?** A good answer names a person at the supplier and how fast they correct and tell you. The Australian guide asks: "Who is accountable once the system is live". The warning sign is "the tool made a mistake", which describes the cause but names nobody.
5. **What happens to our material when we part?** A good answer says what is returned, what is deleted and when, and confirms it in writing. The Australian guide asks: "What happens if we decide to stop using the system?", "Can we export our data in a usable format?" and "How is data deleted after exit?" The warning sign is silence.

That guide, on the Australian Government's ai.gov.au site and filed under July 2026 (the document shows no date), is written for people buying AI products. It lists 46 questions in nine sections and says you need not ask them all. I borrow its wording because it is the clearest government list I found, and I keep to five because a supplier will answer five and ignore forty-six.

## Which suppliers need the full card?

Match the effort to what the supplier can damage.

| Tier | Who it covers | What to ask | When |
|---|---|---|---|
| Full card | Work goes out under your name (copywriter, designer, agency, translator, proposal writer) or your customers' or staff information passes through them (bookkeeper, payroll bureau, IT support, answering service, outsourced customer service) | All five, in writing | Before the work starts, and again at each renewal |
| Short card | They see some of your internal material but nothing personal and nothing that carries your name (a research freelancer, a training provider) | Asks 1 and 2 only | Before the work starts |
| One line | They supply goods or services where AI is unlikely to touch your material | "Do you use AI on our work? If that changes, tell us." | At onboarding |

If a supplier does both, with your name on the work and your customers' data in their hands, they are in the first row and you ask about the data first.

## The Supplier AI Card (copy this)

Ask the supplier to fill this in, in their own words. A card you complete for them will say what you hoped to hear.

**Supplier AI Card**

1. Supplier and job:
2. Where you use AI on our work (tasks), and what stays with a person:
3. What of ours goes into it, and what never will:
4. The tools you use, and anyone else who touches our material (including subcontractors):
5. Who checks the output, and how:
6. Who answers if it is wrong, and how fast you correct it and tell us:
7. What happens to our material when we part:
8. Completed by, date, and review date:

To send it, you can use this note, adjusted to your voice:

> Hi [name], we are asking every supplier to complete a one-page note on how they use AI on our work. It is not a ban and there is no right answer. If you use AI for part of the job, tell us where, what of ours goes into it, who checks it and what happens to our material when we finish. If you do not use it, say so. Could you return it by [date]?

### A worked example (hypothetical)

Take a hypothetical 30-person building services firm whose answering service takes calls out of hours. The card comes back: calls are transcribed and summarized into a text message, and the duty operator reads each summary before it goes out. Caller names, numbers and job addresses go in, never payment details. A cloud provider the supplier names stores the recordings. The operator checks any message with an address or a price against the recording. The account manager answers for errors, with same-day correction. Recordings are deleted within a period the supplier states in writing.

The owner learns two things she did not know: the summaries are machine-made, and a third party stores the recordings. She keeps the supplier, because the checks are sound, and adds two lines to the renewal. The card turned "assume it is fine" into "know and decide". That is the whole value.

## What I tell business owners

The first instinct I see in the business teams I train is to write a ban into supplier terms. I tell owners to start with the question instead. A ban teaches a supplier to stop telling you; a question teaches them that you will listen and that a straight answer costs them nothing.

I came to business after two decades as a teacher, assistant headteacher and Director of Digital Strategy in further education. The principle on [my business page](https://theaieducator.io/business?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=questions-to-ask-suppliers-who-use-ai) is that "The hard part of AI at work isn't the technology. It's helping people use it well, safely and every day. That's what an educator does." The card works the way a good lesson does: it makes the expectation visible and gives people a fair chance to meet it.

## How do you put this in a contract or purchase order?

Ask your adviser to check the wording for your jurisdiction, because this is not legal advice. Three plain lines cover most small suppliers:

- The supplier will tell us in writing where it uses AI on our work, and will update that note if it changes.
- Our information will not be used to train AI models unless we agree in writing first.
- When the job ends, the supplier will return or delete our material and confirm that it has.

The second line follows the Cabinet Office's own example for video-conferencing services, where departments will want terms that make clear that data is "not used for training purposes unless this has been specifically agreed and approved in writing by the client." Put these lines into new agreements and renewals. For existing ones, send the card first and use the answer to decide how much more you need.

## What if the supplier says no, or does not know?

Three outcomes are normal. A supplier who answers clearly gets filed and reviewed at renewal. A supplier who does not use AI writes "none" and agrees to tell you if that changes. A supplier who cannot or will not answer is telling you something: treat the unknown as a risk, send them less, shorten the review cycle or move the work.

Do not let the card become an argument about whether AI is good. The point is the one I made in [my article on AI disclosure to your own customers](https://business.theaieducator.io/posts/ai-disclosure-small-business): trust holds when people say what they did, not when they say nothing. Put your own house in order too. If your staff paste customer files into tools nobody approved, start with [shadow AI](https://business.theaieducator.io/posts/shadow-ai-small-business) and [your AI policy](https://business.theaieducator.io/posts/does-a-small-business-need-an-ai-policy). If a supplier handles money, read [how to stop AI voice and payment scams](https://business.theaieducator.io/posts/ai-scams-small-business) before trusting any change of bank details. For what you hold yourself, see [whether your business data is ready for AI](https://business.theaieducator.io/posts/is-your-business-data-ready-for-ai).

## What can you do this week?

You can finish most of this in an afternoon, with no project and no data team.

1. List the suppliers whose work carries your name or who handle customer or staff information. Fifteen minutes is enough.
2. Sort them into the three tiers in the table.
3. Send the note and the card to the top five.
4. Read each answer against the warning signs, record it in one sheet, and set a review date at the supplier's renewal or in six months.
5. Add the three contract lines at the next renewal.
6. Complete the Buyer's Five for your own business, so you can answer the same questions when a customer sends them to you.

## Next step

If you want to know how your own team would answer these five questions today, the free [Business AI Readiness Scorecard](https://theaieducator.io/business-ai-readiness?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=questions-to-ask-suppliers-who-use-ai) is the lowest-friction place to start. And if you are planning a leadership meeting, chamber event or industry conference and want a speaker who can take a room of owners through governance questions like these in plain language, take a look at my [business keynotes](https://theaieducator.io/business-keynotes?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=questions-to-ask-suppliers-who-use-ai).

## Sources and further reading

- Hwang, A. H.-C., Wong, S., Chen, B., He, J. and Do, H. J., ["Better Ask for Forgiveness than Permission": Practices and Policies of AI Disclosure in Freelance Work](https://arxiv.org/abs/2603.07459), arXiv:2603.07459, 8 March 2026 (CHI 2026). Interviews with 41 freelancers; surveys of 100 workers and 145 clients; country not stated.
- Cabinet Office, [PPN 017: Improving transparency of AI use in procurement](https://www.gov.uk/government/publications/ppn-017-improving-transparency-of-ai-use-in-procurement/ppn-017-improving-transparency-of-ai-use-in-procurement-html), GOV.UK, published 17 February 2025 (originally issued November 2023). Applies to UK central government bodies; others may adopt the approach.
- Australian Government, [Questions to ask AI suppliers](https://www.ai.gov.au/sites/default/files/2026-07/Questions-to-ask-AI-suppliers.pdf), ai.gov.au, 2026 (file filed under July 2026; the document shows no date).
- Arnold & Porter, [The UK ICO's New Statutory Duty to Produce an AI Code of Practice: What It Means for Businesses That Use AI](https://www.arnoldporter.com/en/perspectives/advisories/2026/08/the-icos-new-statutory-duty-to-produce-an-ai-code-of-practice), 17 August 2026.
- AI for Business with Dan Fitzpatrick, [How should a small business answer AI questions in tenders?](https://business.theaieducator.io/posts/ai-questions-in-tenders-small-business) and [How do you train staff to catch AI mistakes at work?](https://business.theaieducator.io/posts/train-staff-to-check-ai-output).

*Dan Fitzpatrick, The AI Educator, is a Forbes contributor, keynote speaker and five-times bestselling author who has trained more than 150,000 educators in 30+ countries. [About Dan](https://theaieducator.io/about).*


## Frequently asked questions

### Should I ask my suppliers whether they use AI on my work?

Yes, if their work carries your name or touches customer or staff information. Ask where they use AI, what of yours goes into it, who checks the output, who answers if it is wrong, and what happens to your material when you part. Ask in writing, and do not make it a ban.

### Can a freelancer use AI on my project without telling me?

Often yes, unless you have said otherwise. A 2026 study of freelance work found many workers disclose AI use only when asked, and 39% of the freelancers interviewed said so. If you want to know, ask before the work starts and record the answer.

### What should I ask a supplier who uses AI?

Ask five things: where they use AI on your work, what of yours goes into it, who checks the output, who is accountable if it is wrong, and what happens to your material when the job ends. The Supplier AI Card in this article puts them on one page.

### Should I ban suppliers from using AI?

Usually not. A blanket ban teaches suppliers to stop telling you. UK Cabinet Office guidance on AI in procurement treats disclosure as information to record, not a score, and says suppliers' AI use is not prohibited. Ask, record, and decide what you will accept.

### Do I need a contract clause about suppliers using AI?

A short one helps. Ask your adviser to check the wording for your jurisdiction, but three plain lines cover most small suppliers: tell us where you use AI, do not train models on our information without written agreement, and return or delete our material at the end.

### What if my supplier says they do not know how they use AI?

Treat the unknown as a risk. Send them less sensitive material, shorten the review period, and ask again with the Supplier AI Card. If they still cannot say which tools touch your information or who checks the output, consider moving the work.

---
Source: [What Should You Ask Suppliers Who Use AI on Your Work?](https://business.theaieducator.io/posts/questions-to-ask-suppliers-who-use-ai)
Publisher: [The AI Educator](https://theaieducator.io)