Due diligence, audits, tenders: the infernal cycle of questionnaires exhausting your teams in 2026

Monday morning. In your legal department's open-plan office, a senior lawyer opens their inbox. They've received a 180-question due diligence questionnaire. Deadline: Friday. One floor up, your CISO simultaneously receives a client security audit — 247 questions, same deadline. At the same time, your sales team is juggling a public tender worth 2.3 million euros, with the technical response due in ten days.

Three teams. Three questionnaires. One week.

This scenario is not exceptional. In 2026, it's the daily reality for most French companies operating in regulated sectors, dealing with demanding clients, or managing complex transactions. And behind this daily grind lies a structural problem that few organizations have truly quantified.

‍

The Invisible Cost: What Questionnaires Really Cost

To understand the scale of the problem, we first need to put a figure on what no one measures: the true cost of manually processing questionnaires.

Take a CISO whose annual salary is around 120,000 euros. According to client feedback fromOptivalue.ai, 40% of a security team's time is spent responding to questionnaires — not securing the company, not leading strategic projects, but searching for documents, filling out Excel cells, and verifying that cited certifications haven't expired.

Convert that figure into working days. Out of 220 working days per year, that's 88 days — nearly four months — spent on tasks that could be described, without disrespect, as highly paid qualified administrative work.

The same observation applies to the legal side: each contract review takes between 2 and 5 hours. With 15 contracts per month, half of a legal director's time is spent on linear reading — not strategic analysis. And for Procurement teams, a full supplier evaluation represents an average of 2 to 4 hours of work. For a panel of 210 active suppliers, that's 6 man-months per year dedicated solely to supplier compliance.

Three Types of Questionnaires, One Problem

The diversity of contexts often masks the convergence of symptoms. Whether it's an M&A due diligence, a certification audit, or a tender, teams invariably encounter the same difficulties.

1. Due Diligence: The Race Against Time

A data room opens. It contains 1,247 documents. The investment committee meets in ten days. Your analysts dive in — each taking a section, they read, compare, cross-reference. Eight days later, the report is ready, 140 pages. But a change-of-control clause in a major client contract was missed. Page 47 of an 82-page contract, in a subfolder no one opened.

The board will discover the risk after closing. Cost: 2.8 million euros in client waiver.

This isn't a competence issue. It's a problem of volume and time. Your analysts are hired for their strategic judgment. They spend 80% of due diligence reading and 20% thinking. That ratio should be reversed.

2. Compliance Audit: The Regulatory Maze

January: NIS2 takes effect. March: ISO 27001 audit. May: First CSRD reporting. September: CNIL inspection. November: Sapin 2 audit.

Your compliance team hasn't grown. Neither has your budget. Each new framework triggers the same cycle: read the requirements, map the evidence, identify gaps, prepare responses. Three months of work per framework. You have six of them.

Yet, 60% of documentary evidence serves multiple frameworks simultaneously. An access management policy valid for both NIS2, ISO 27001, and GDPR. But no one has time to cross-reference them. So each audit is prepared from scratch, with the same documents found, verified, and formatted again.

3. The RFP: Talent Wasted on the Wrong Task

Tuesday, 9:15 AM. A €2.3 million RFP lands. 180 technical, regulatory, functional questions. Deadline in 12 days.

Your best pre-sales engineer stops the PoC he was preparing for another prospect. He opens old deliverables, looks for answers from the last similar RFP, sends 14 emails to internal experts. Three of them are on leave.

Day D-2: The responses are ready, but the legal section contradicts the security section on the subcontracting policy. The RFP is submitted. You lose. The client cites 'inconsistencies' in their debrief.

How many RFPs has your team missed this year due to lack of time? This lost revenue doesn't appear in any reporting.

Why Traditional Approaches Are No Longer Enough

In response to this, companies have long opted for three solutions: hire more, create templates, or prioritize (in other words, accept not covering everything).

These approaches all hit their limits in 2026.

Hiring More doesn't solve the structural problem. If 40% of a team's time is spent compiling responses, adding a person to the team means dedicating 40% of their time to the same problem. The workload follows the headcount.

Templates improve consistency but not speed. Finding the right version, checking it's still up-to-date, sourcing evidence for each response — all of this remains manual. And the certification that expired last month isn't in any template.

Prioritization is the most honest — and riskiest — response. Assessing 30% of your supplier panel means leaving 70% in a blind spot. An incident occurring with an unassessed subcontractor isn't bad luck: it's the foreseeable consequence of an unresolved capacity constraint.

What document AI fundamentally changes

This is where a radically different approach comes in: not automating for automation's sake, but solving the real problem — that of dispersed knowledge.

Optivalue.ai transforms tender, audit, or compliance questionnaires into clear, sourced, and compliant answers. The platform doesn't generate generic responses: it analyzes your existing document base — internal policies, certifications, contracts, audit reports — and produces answers rooted in your own documents, with the exact source (document, page, date) for each statement.

The principle relies on two AI teams working in sequence. The first analyzes and generates. The second verifies, sources, and recommends. The human expert reviews, adjusts, and validates. Nothing goes out without their approval.

Client testimonials show 90% time reductions and an average annual ROI of 428%.

Specifically, what this changes:

• A 247-question security questionnaire processed in 47 minutes instead of 2 days
• A due diligence of 1,247 documents mapped in 45 minutes, with critical risks identified and sourced
• 210 suppliers evaluated in one week instead of a quarter
• Multi-standard audit preparation where evidence common to NIS2, ISO 27001, and CSRD is automatically shared

Sully Group, an IT services company with 900 employees, accurately measured the impact: « We went from 2 days per questionnaire to less than 2 hours. Just one case per month makes the entire annual subscription profitable. »

The real transformation: the expert's role

The question many ask at this stage: « Does AI replace my teams? »

The answer is no — and that's precisely where the value lies.

Your CISO doesn't become obsolete. They stop being a document compiler and return to what they were hired for: a security strategist. The time freed up shifts to the SOC, IAM redesign, the NIS2 plan — the projects that will restore their indispensability.

Your legal director doesn't disappear. They focus their attention on the 3 critical clauses identified by AI, instead of reading 42 pages to find the same 3 clauses — hoping not to miss a fourth one on page 34.

Your M&A analysts aren't replaced. They go from 80% reading and 20% thinking to the reverse. Their added value — strategic judgment, negotiation, deal structuring — is multiplied.

AI prepares, but you retain control and responsibility.

How to get started?

Optivalue.ai is up and running in less than 7 minutes. Create your account, upload your documents, and get your first answer as soon as you sign up. Accepted formats cover everything your teams produce: Excel, Word, PDF, web forms.

Our recommended approach: choose a questionnaire that's been sitting around for weeks in your team — the one most representative of your usual workload. Upload it with your document library. Measure the result.

Not a promise. A test.

This article is the cornerstone of our editorial strategy. Each persona has a dedicated article that delves into their specific use case:

• CISO/CIO → [NIS2 and security questionnaires]
• Legal Director → [Contract review and documentary risks]
• M&A Department → [Due diligence and data room]
• Procurement Director → [Comprehensive supplier evaluation]
• Sales / Bid Manager → [RFPs and win rate]
• Compliance / CSR → [Multi-framework and evidence consolidation]
• CEO/General Manager → [ROI and strategic responsiveness]

Ready to see the difference? Request a personalized demo →

‍