A county AI risk register tracks 'improper output handling' apart from classic XSS tickets. Why separate those entries?

Tracking improper output handling apart from classic XSS tickets in a county AI risk register distinguishes AI-specific generative output risks from traditional AppSec categories when scoping remediation. LLM outputs can introduce markup, scripts, or untrusted URLs into civic UIs, but the root cause, owners, and fixes often differ from a developer-introduced reflected XSS bug in static application code. Separate register entries clarify that mitigations may include output encoding policies for model text, content-security strategies tuned to assistant channels, allow-listed citations, and model or guardrail changes—not only patching a single web endpoint. They also support distinct test methods: prompt-driven abuse cases and output-sanitizer evaluation versus classic scanner findings. Tracking XSS sanitization coverage in legacy web forms when prioritizing frontend patch cycles, recording model training dataset lineage for audit traceability across ingestion pipelines, or documenting insecure plugin design flaws in downstream tool integrations for coordinated vendor remediation planning are unrelated to remediation scoping for improper output handling and do not improve risk ownership for generative AI failures. Exam questions commonly ask why AI risks are cataloged separately; the answer is scoping remediation and accountability, not recording model training dataset lineage for audit traceability across ingestion pipelines. Caveat: some incidents are hybrid—model text plus a missing encoder—so registries should still allow linkage between related AppSec and AI entries without collapsing them into one ambiguous ticket. Operational check: open the risk register and confirm improper-output-handling items list AI-specific owners, acceptance criteria such as encoding, CSP, and allow-lists, and retest procedures distinct from the classic XSS playbook.