Third-party APIs, fine-tunes, open-weights models, and AI embedded in vendor products all count. If it makes a decision or generates text that reaches a customer, it belongs here.
Enough for someone else to understand the system without asking you.
Anthropic, OpenAI, Gong…
Pin the exact version, not a floating alias.
What it does and what happens with the output. This text is what questionnaire answers are generated from.
Who owns this, and how a person stays in control.
Optional until this reaches production.
One sentence. This is quoted verbatim on questionnaires.
What goes in, where it is processed, and whether it trains anything.
Comma separated: customer content, PII, telemetry…
Answered on almost every 2026 questionnaire. Getting it wrong is a contractual problem.