Most reviews ask for a description of the architecture and data flows, where data is stored and processed, which third party services and AI models are used, how access is controlled and logged and how data is encrypted. Certifications or audit reports, such as SOC 2, and recent penetration test results are also commonly requested.
For AI specifically, reviewers usually want to know whether customer data is used for training, how prompts and outputs are retained and how the vendor prevents data from one customer reaching another. Having these documents ready before the review starts can cut weeks out of the process.