City procurement drafts due diligence for an AI vendor RFP. Which questionnaire coverage best fits AI-specific risk?
Select an answer to reveal the explanation.
Short Explanation
AI RFPs aren’t about houseplants or catering. Ask where training data came from, who the subprocessors are, and how often models change.
Full Explanation
City procurement drafting due diligence for an AI vendor RFP must ask AI-specific supply-chain and lifecycle questions, not facilities trivia. Training data provenance, subprocessors, and model update cadence is correct because those topics drive privacy exposure, fourth-party risk, and change-management risk for municipal AI services. Provenance clarifies lawful/appropriate data origins; subprocessors reveal who else touches city or resident data; update cadence frames how often behavior can change without a classic software release the city expects.
Only questions about office plant-watering schedules fail by concept: facilities plant care does not assess AI risk. Only whether the vendor’s logo matches the city’s brand palette fails by concept: branding alignment is not AI due diligence. Only the vendor’s preferred catering menu for kickoff fails by concept: catering preferences do not surface training data, subprocessor, or model-change risk.
Exam caveat: strong questionnaire coverage still needs evidence review and scoring—asking the questions is necessary but not sufficient. Model update cadence should be paired with contractual notice and testing rights when answers reveal frequent opaque changes.
Operational check: embed mandatory RFP/due-diligence questions on training data provenance, subprocessors, and model update cadence for AI vendors; score responses before award; escalate opaque or non-answers; and retain the questionnaire package in the procurement file so city GRC can reuse it at renewal.