Digital services maps each AI use case to applicable privacy, records-retention, and sector rules before go-live. What compliance practice is this?

Mapping municipal AI uses to applicable regulatory frameworks is the correct compliance practice when digital services maps each AI use case to applicable privacy, records-retention, and sector rules before go-live. That works because public-sector AI sits inside overlapping duties—privacy, retention, accessibility, procurement, and sector law—that consumer SaaS terms do not automatically satisfy. A per-use-case regulatory map before go-live identifies which controls, notices, and retention schedules are mandatory so compliance is designed in rather than patched after a complaint or audit letter.

Assuming consumer SaaS terms satisfy all public-sector duties fails by concept: private terms rarely cover municipal records, retention, or public transparency obligations. Delaying any legal mapping until after a regulator sends a letter fails by concept—reactive compliance accepts avoidable risk and signals weak control design. Treating open-source models as exempt from privacy and records rules fails by concept: hosting or using open weights does not erase duties over prompts, logs, outputs, or retained municipal records.

Exam caveat: mapping must be maintained when use cases expand or vendors change subprocessors—one-time maps go stale. Keep digital services / municipal go-live framing. Operational check: inventory each AI use case; list applicable privacy, records, and sector rules; assign control owners; block go-live until gaps are closed or formally accepted; and revisit the map at major changes or scheduled reviews.