Many organisations first encounter AI through products they already buy. The supplier can explain the product, its terms and its controls. Your organisation still needs to decide how the product will be used, what information it will handle and what review is required.
Separate the supplier from the use
Keep a supplier and product record that can be reused across the organisation. Then assess each distinct use separately. One product may be acceptable for drafting internal content but need a different review for customer-facing work or sensitive information.
Ask questions that lead to decisions
Focus on the information your organisation needs: what AI features are enabled, what data is used, whether data is retained or used for product improvement, where relevant information is processed and what controls are available to administrators.
Keep the answer with the work
Store supplier responses, contract terms and evidence with the supplier or product record. Link them to the AI uses that rely on them. Record unanswered questions as actions with an owner and due date.