Procurement teams want proof that the people running agents on their data or their customers are trained, current and limited to what they are qualified to approve. Expect requests for a training policy, a list of named reviewers with certificate status, a way to verify those certificates independently, and evidence that approval rights follow the training record.
Why do clients ask about people rather than the model?
A client buying a service that uses agents carries the risk of what those agents do on its behalf. The model is the supplier's choice and changes often. The control the client can test is the human layer: who reviews the agent's held actions, who sets its limits, and whether those people know what they are doing. As regulators will ask who was trained, not which model you used, so will the client's risk team, because they will be asked the same question by their own supervisor.
What will the questionnaire ask for?
Most security and supplier due diligence questionnaires now carry a section on AI. The training questions tend to follow the same pattern.
| What the client asks | What a good answer contains |
|---|---|
| Do you have an AI training policy? | A written policy naming the roles that must be trained and the level each needs |
| Who reviews agent actions on our account? | Named people or roles, with their certificate level and expiry date |
| How can we verify their training? | Certificate numbers or QR codes checkable at the issuer, not a PDF |
| What happens when training lapses? | Approval rights pause, cover is in place, and the workspace enforces it |
| How do you train people for our use case? | Evidence that tests and practicals reflect the client's industry and the actions the agent takes |
| How are incidents handled? | Who is trained to stop an agent, how quickly, and what record is left |
| Can you show past decisions were made by qualified people? | A sample from the record showing approver, certificate status at the time and reason |
The last row is the one that separates mature suppliers. Anyone can show a training policy. Showing that a particular held payment in a particular week was approved by someone whose certificate was current at that moment requires the training record and the decision record to be joined.
What makes the evidence credible to a client?
Three properties carry weight. The evidence should be specific: named people, not "all staff complete annual training". It should be current: expiry dates visible and in the future. And it should be independently checkable: the client's assessor can confirm a certificate at its source without asking the supplier. What counts as evidence of competence explains why a completion certificate alone does not meet that bar.
An example: an outsourced claims handler
Take an insurer appointing a claims outsourcer that uses agents to draft settlement offers. The insurer's due diligence asks for the names of everyone who approves held offers on its book. The outsourcer provides a list of 12 reviewers with certificate numbers. The insurer's procurement lead checks four at random at the issuer: three are current, one lapsed last month.
The outsourcer then shows the workspace log: since the lapse, that reviewer has approved nothing, and their held items went to colleagues. The insurer is satisfied, not because every certificate was current, but because the system behaved correctly when one was not.
How should a supplier prepare?
Build the pack before the questionnaire arrives. The training evidence pack template for AI audits lists the parts, and how to prepare training evidence for an AI audit covers sampling. If you have a SOC 2 report, check what it says about training and awareness controls; SOC 2 and evidence of training for teams running AI agents explains the overlap. The structure of levels behind all of this is in the guide to AI literacy and certification for people who work with agents.
Where the Academy fits
Pryme Intelligence Academy issues professional certificates through VerifyDoc.ai, so a client can check any reviewer's certificate by number or QR code, and a lapsed or revoked one shows as such on the same page. A public register lists certified people by name, credential and expiry. For teams, an admin view shows progress, results and expiry dates, which is most of what a supplier questionnaire asks for.
Questions people ask
Will clients accept internal training instead of an external certificate?
Some will, if the internal programme is documented, tested and tied to approval rights. External certificates checkable at source reduce the work on both sides, because the client does not have to audit your training design.
How often will clients ask for updates?
Expect the training evidence to be refreshed at each contract review, and sooner if reviewers on the account change. Keeping expiry dates visible avoids surprises.
Should we share reviewers' names with clients?
Share what the contract and data protection rules allow. Many suppliers share names and certificate numbers for the reviewers on a client's account, and roles plus numbers for everyone else.