Procurement adds contractual clauses for data deletion, breach notice, and no secondary training on city data. What responsible practice is illustrated?

Procurement adding contractual clauses for data deletion, breach notice, and no secondary training on city data illustrates responsible contracting that protects civic data with AI vendors. The correct answer is responsible contracting practices that protect civic data with AI vendors. Municipal datasets often include resident PII, operational details, and nonpublic drafts. Without deletion rights, breach notification timelines, and a ban on secondary training or resale, the city loses control after data leaves its boundary—and responsible contracting practices that enforce model fairness with AI vendors do not create enforceable data-protection remedies.

Responsible contracting practices that enforce model fairness with AI vendors fail because enforcing fairness addresses bias and performance across groups instead of requiring deletion or return; they don't provide deletion rights, breach notice, or limits on secondary training. Responsible contracting practices that mandate algorithmic audits with AI vendors fail because model auditing is not data protection; it does not obligate the vendor to delete city data, notify the city of breaches, or refrain from secondary training. Responsible contracting practices that require open source models with AI vendors fail because requiring open source addresses model transparency and licensing instead of vendor duties regarding city data; it cannot replace contractual deletion, breach-notice, and no-secondary-training clauses.

Exam caveat: strong clauses are necessary but not sufficient. The tested practice is putting protective terms in the contract; cities must still verify compliance (attestations, audits, data-flow diagrams) because unenforced paper promises do not secure data.

Operational check: require schedule-driven deletion or return of city data at end of engagement, define breach-notice windows and cooperation duties, prohibit secondary training and advertising use of city data, flow down requirements to subprocessors, and verify deletion with certification before closing the procurement file.