After go-live, the city continuously monitors AI vendors for model-provider subprocessor and region changes. What ongoing ecosystem practice is this?

Monitoring AI vendors continuously for subprocessor and region changes that affect civic compliance is the correct ongoing ecosystem practice after go-live. AI providers frequently change model hosts, subprocessors, and regions; a compliance posture frozen at signature date drifts as those changes land. Continuous monitoring—via vendor notices, DPA updates, and region settings—lets the city detect residency or assurance impacts before residents or auditors find them the hard way. The practice works because civic compliance depends on the live data path, not the sales-call architecture diagram.

Checking vendor compliance only once at contract signature and never again fails by concept: one-time checks miss post-award subprocessor and region drift. Assuming subprocessors never change after the sales call fails by concept—cloud AI supply chains change routinely. Letting departments discover region moves when residents report odd latency fails by concept: latency anecdotes are a poor and late compliance signal compared with deliberate vendor monitoring.

Exam caveat: continuous monitoring is an operations obligation tied to residency and subprocessor commitments; exact tooling varies, but “set and forget” is wrong. Keep city post-go-live vendor framing. Operational check: subscribe to vendor security/subprocessor notices; review region and subprocessor changes on a cadence; map changes to municipal residency and DPIA/DPA obligations; and escalate material moves before workloads silently follow them.