A vendor RFP demands conformity evidence for security and responsible-AI attestations rather than marketing slogans. What governance practice is illustrated?
Select an answer to reveal the explanation.
Short Explanation
You'll need supplier attestations with conformity evidence in the RFP, since supplier self-assessments alone don't give you verifiable security and responsible-AI proof. Vendor contracts come after you've already chosen, so they don't replace procurement standards for pre-award evaluation. Model attestations are too narrow when you're asking for supplier-wide security and responsible-AI assurance.
Full Explanation
A vendor RFP demanding conformity evidence for security and responsible-AI attestations rather than marketing slogans illustrates procurement standards that require evidence-based AI supplier attestations. The correct answer is procurement standards that require evidence-based AI supplier attestations. Cities buy outcomes and residual risk, not procurement standards that require evidence-based AI supplier self-assessments without independent conformity evidence. Asking for security test summaries, SOC-style reports, model documentation, bias-testing evidence, and contractual attestations lets evaluators compare suppliers on verifiable controls instead of rhetorical 'trust us' claims.
Procurement standards that require evidence-based AI supplier self-assessments fail procurement due diligence: self-assessments alone are not conformity evidence of security or responsible-AI attestations. Vendor contracts that require evidence-based AI supplier attestations fail: contracts enforce terms after selection and do not satisfy the RFP's pre-award procurement standards for evaluating conformity evidence. Procurement standards that require evidence-based AI model attestations fail: model attestations cover only model-level claims and do not provide the supplier-wide security and responsible-AI attestations required by the RFP.
Exam caveat: attestations are claims that still need verification proportionate to risk. The tested practice is requiring evidence beyond slogans in the RFP; low-risk tools may need lighter packets, but evidence requirements should scale—not disappear—for sensitive uses.
Operational check: write RFP clauses that mandate specific artifacts (security assessments, responsible-AI questionnaires, model cards, subprocessors), score them in evaluation, reject nonresponsive marketing-only bids for covered AI categories, and retain evidence in the contract file for audit.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.