AI security pre-assessment, started by your business teams

It is the short questionnaire a project team fills in before any security review takes place. It captures the intended use, the data involved, who will have access, where the service will be hosted and what it connects to. The point is not to rule on risk, but to gather enough to decide what comes next: a light review for a low-stakes project, or a full risk assessment for one that warrants it. Treat it as triage, not as a sign-off.

As soon as the business need is written down, and before a solution is picked or a contract signed. After that point every security requirement turns into a change request: encryption to retrofit, data location to renegotiate, logging the chosen product simply does not offer. A pre-assessment at the idea stage takes the business team well under an hour; the same question asked once the service is live can put the architecture back on the table.

The business team, with security reviewing. Whoever owns the project knows which data will be processed, who will use it and what for: that knowledge sits with them, not in the information system. Handing the questionnaire to the CISO means asking them to guess, then correcting afterwards. Judging the risk and deciding what happens next stays with the security team, which picks the file up once the answers are in.

No text prescribes a pre-assessment questionnaire as such, and no certification covers one. Several obligations still make it hard to avoid, each within its own scope: ISO/IEC 27001:2022 expects, in its Annex A, information security to be integrated into project management; the GDPR requires a data protection impact assessment before any processing likely to result in a high risk to the rights and freedoms of individuals; NIS2 expects entities within its scope to manage supplier-related risk. The pre-assessment is how you find out which of those applies.

A pre-assessment answers one binary question: does this project deserve a closer look, and how deep? The risk assessment itself comes next, in EBIOS Risk Manager or as a flash assessment: it frames the scope, identifies business values and supporting assets, builds risk scenarios, then decides how to treat them. In Vailor, the pre-assessment answers feed straight into that initial framing, which corresponds to the first EBIOS RM workshop. One sorts the projects, the other justifies the decisions.

This is one of the questionnaire's most useful jobs. A handful of questions is enough to spot the criteria that point towards a data protection impact assessment under the GDPR: special category data, systematic monitoring, evaluation or profiling, vulnerable people, datasets matched together, large-scale use. Processing that combines several of them calls for a DPIA. In France the CNIL also publishes the list of processing operations that require one and the list of those exempt, so a project can be placed against them from the outset. In Vailor, the pre-assessment flags these obligations, GDPR and AI Act alike.

Because a static form asks everyone the same questions: the business team gives up on fields that have nothing to do with its project, and security ends up chasing partial answers one by one. A spreadsheet keeps neither the history of the answers nor the link between the questionnaire, the project and the risk assessment that follows. A dedicated tool holds that thread, records who answered what and when, and flags the files still waiting. With Vailor, pre-assessment, qualification by security and the risk assessment sit in one platform, and the AI prefills from the project documents.