Short answer: Expect questions on how you protect traveler and card data, which standards you meet, such as SOC 2, ISO 27001 and PCI DSS, and how any AI uses client data. Buyers also ask whether AI trains on their data and who approves its changes. Prepare one security pack and keep it current.
Security questions used to sit at the end of an RFP. Now they arrive early, and many include a section on AI.
What do security questionnaires ask a TMC?
Four things, in some form:
- How you protect data. Where traveler profiles and card data live, who can see them, and how access is approved and logged.
- Which standards you meet. An independent report, such as SOC 2, or a certification, such as ISO 27001.
- How you handle cards. PCI DSS applies to any business that handles cardholder data.
- How you use AI. What data it sees, whether it trains on that data, and who approves its work.
Privacy and security is the top barrier buyers name for AI in travel, at 47 percent in GBTA's April 2026 poll, so expect these questions to be read closely.
Should we get SOC 2 or ISO 27001?
Either answers most of the standards section. SOC 2 is an attestation from an independent auditor against the AICPA's Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy. ISO 27001 is a certification of an information security management system, and certificates now use the 2022 version.
US clients ask for SOC 2 most often. Clients with a large European footprint often ask for ISO 27001.
What is SIG Lite?
A shorter version of the Standardized Information Gathering questionnaire from Shared Assessments, which many companies use to assess vendors. The 2026 edition maps its questions to ISO 42001, the standard for AI management systems, so AI questions are now part of the template.
What do clients ask about AI?
FCM lists the questions procurement teams ask most:
- Are travelers getting correct answers?
- Are traveler interactions used to train a model?
- How does the AI connect with our own tools?
- How do you prevent made-up answers?
Expect a question on approvals too. In GBTA's 2026 research, buyers were least comfortable with AI changing or cancelling bookings (57 percent) and reading employee calendars (64 percent).
How do privacy laws apply to traveler data?
Traveler profiles hold personal data, so privacy law applies wherever your travelers live. In the US that now means a growing list of state privacy laws, which the IAPP tracks. For European travelers, GDPR applies, and transfers to the US typically rely on the EU-US Data Privacy Framework.
Does the EU AI Act apply to a travel agency?
For most agency work, lightly. The Act's high-risk list covers areas such as hiring and worker monitoring. Servicing and accounting AI sits outside that list, while AI used to screen job applicants would fall inside it. The 2026 AI Omnibus moved the main high-risk deadline to December 2, 2027. This is our reading, so check your own case with counsel.
How do you prepare your answers?
Keep one security pack, and update it each quarter
Your SOC 2 or ISO 27001 report, a data flow diagram, your subprocessor list, your PCI DSS status, an access and approval policy, and a one-page summary of how any AI uses client data.
Fraud belongs in the pack too. In March 2026, agency associations warned about criminals using agencies' IATA numbers to get NDC access, and advised limiting who can request or approve that access.
Common questions
Do TMCs need SOC 2?
Many corporate clients ask for a SOC 2 report or an equivalent. It's an independent attestation on your controls, so it answers a large share of a security questionnaire at once.
What is SIG Lite?
A shorter version of the Standardized Information Gathering questionnaire from Shared Assessments, used by companies to assess vendor risk.
Does PCI DSS apply to a travel agency?
Yes, whenever the agency handles cardholder data, as a merchant or as a service provider.
Does the EU AI Act apply to travel agencies?
Most agency servicing and accounting AI sits outside the Act's high-risk list. AI used to screen job applicants or monitor staff would fall inside it. Check with counsel for your own case.
Sources (11)
Show every source
- GBTA, Industry poll (April 2026) Trade association
- GBTA with Spotnana, Marriott and Direct Travel, The perfect business trip study (May 2026) Trade association
- FCM Travel, What is procurement asking about AI? Company's own claim
- The Business Travel Magazine, How may I help you? (2025) Trade press
- AICPA, 2017 Trust Services Criteria (revised 2022) Independent
- Mitratech, SIG 2026: key updates Company's own claim
- PCI Security Standards Council, PCI DSS Independent
- Addleshaw Goddard, EU AI Act: AI Omnibus formally adopted (2026) Secondary
- European Commission AI Act Service Desk, Annex III Independent
- IAPP, US state privacy legislation tracker Independent
- ATIA, Fraud alert: unauthorized use of IATA credentials and NDC access (2026) Trade association
Checked on October 28, 2026. Rules change, so check the source before you act on a date or an amount.
