The AI register package lists purpose, data sources, human oversight, and monitoring for each system before an external audit. What compliance practice is this?
Select an answer to reveal the explanation.
Short Explanation
Auditors ask for purpose, data, oversight, and monitoring—not Slack folklore. Keep a city-owned package ready like a fire-exit plan, not a scramble when the whistle blows.
Full Explanation
Preparing audit-ready documentation for civic AI systems is the correct compliance practice when the AI register package lists purpose, data sources, human oversight, and monitoring for each system before an external audit. That works because auditors and oversight bodies need city-owned evidence of why a system exists, what data it uses, who oversees outcomes, and how it is monitored—not folklore in chat threads or a vendor one-pager. Assembling that package before the audit arrives demonstrates control maturity and reduces scramble-induced gaps or inaccurate statements.
Keeping purpose and oversight details only in informal chat threads fails by concept: ephemeral chat is not a durable, attributable record for audit or continuity when staff turn over. Documenting monitoring after auditors arrive to save time fails by concept—after-the-fact documentation suggests monitoring was not operating as claimed and invites findings. Providing auditors only a vendor one-pager with no city-owned records fails by concept: the city remains accountable and must show its own register, decisions, and controls.
Exam caveat: audit-ready means current and complete for in-scope systems—not a one-time binder that ignores retired or shadow AI. Keep AI register / external audit framing. Operational check: maintain a register entry per system with purpose, data sources, oversight, and monitoring; version and date entries; assign owners; refresh before known audits and on major changes; and store packages in city-controlled repositories with access logs.