Summary: AI questions now appear in most operational due diligence questionnaires and meetings. Allocators want to know which tools you use, how you approve new ones, whether investor data goes into them, and how you'd find out if someone broke the rules. A strong answer names the process and offers the evidence. A weak one restates the policy.
Why ODD teams are asking
In our conversations with managers and their compliance advisors, investor diligence is the most common reason a firm moves from experimenting with AI to governing it. An LP's ODD team asks a question the firm can't answer with evidence, and the project starts that week.
The questions are reasonable from the allocator's side. They are trusting you with their data and their capital, and they've read the same headlines about employees putting sensitive information into unapproved AI tools. They want to know the risk is managed, and they'll compare your answers across managers.
The questions that come up most
Wording varies by allocator, but the same eight questions recur. For each one, here is what a weak answer looks like, what a strong one looks like, and what to have ready if they ask for proof.
1. Do you have a written AI policy?
- Weak: "Yes, employees may only use approved tools."
- Strong: "Yes. It was adopted in [month], defines approved tools, permitted data and prohibited uses, and is acknowledged by all staff annually. Compliance and IT jointly own it."
- Evidence: The policy and acknowledgment records.
2. Which AI tools are approved, and for what?
- Weak: "We use ChatGPT Enterprise and Copilot."
- Strong: A list of approved tools, each with its approved purpose and the data classifications it may touch.
- Evidence: An inventory export.
3. How are new tools approved?
- Weak: "Requests go to IT."
- Strong: "Requests go through an intake that captures the tool, purpose and data. Compliance and IT review vendor terms, risk-tier the request, and record a decision. Typical turnaround is [X]."
- Evidence: A sample approval record.
4. Is investor or confidential data used with AI tools?
- Weak: "No."
- Strong: "Only in tools approved for that data classification, under contracts that prohibit training on our data. Unapproved tools may not receive investor data."
- Evidence: Data classification rules and the approval terms for those tools.
5. How do you diligence AI vendors?
- Weak: "We review their SOC 2."
- Strong: "We review training and retention terms, sub-processors and model providers, and security controls at approval, then monitor for changes."
- Evidence: A vendor trust report or diligence file.
6. How would you know if someone used an unapproved tool?
This is the question that separates managers, and the one most firms answer weakly.
- Weak: "Our policy prohibits it."
- Strong: "We monitor identity, network and endpoint data for AI use and compare it to our approved list. Unapproved use is reviewed and resolved. Last quarter we found [N] and resolved them by [approving, restricting or blocking]."
- Evidence: An exceptions log.
7. Do you use AI in the investment process?
- Weak: A vague answer that implies more or less than is true.
- Strong: A plain description of where AI is used (research summarization, document review, back office) and where it isn't, with human review noted.
- Evidence: Consistency between this answer, your inventory and your marketing materials.
8. Have you had any AI-related incidents?
- Weak: "No" with nothing behind it.
- Strong: "No incidents requiring notification. Our incident response plan covers unauthorized AI use, including Reg S-P notification steps."
- Evidence: The relevant section of the incident response plan.
The pattern
Look at the strong answers together. Each one points to a record: an inventory, an approval, a vendor file, an exceptions log. The policy is necessary but it is only the first answer. Everything after it depends on records that most firms don't keep yet.
The other pattern is consistency. ODD analysts compare your DDQ to your pitch deck, your Form ADV and what your team says in the meeting. If your marketing says AI drives research and your DDQ says AI isn't used in the investment process, expect a follow-up.
Where Clarier fits
Clarier keeps the records behind each of these answers: the inventory, intake and approval records, vendor trust reports, and a log of every discovery and decision. Smaller managers use it specifically to answer LP diligence questions with evidence instead of attestations. See how it works for diligence and exams.
The fastest way to find out which of these eight questions you can answer today is the AI program maturity assessment. It scores your program and shows where the gaps are.
