A library requires assurance before buying GenAI for staff research support. What evidence mix best fits?
Select an answer to reveal the explanation.
Short Explanation
Follower counts aren’t controls. Ask for SOC 2-style attestations and AI-specific evidence—marketing slides don’t protect patron-adjacent workflows.
Full Explanation
A library requiring assurance before buying GenAI for staff research support needs written security and AI-control evidence, not marketing theater. SOC 2 or security attestations plus AI-specific control evidence is the best mix because SOC-style attestations speak to organizational security controls, while AI-specific evidence covers model/data governance, logging, abuse monitoring, retention, and change practices that generic IT questionnaires miss. Public libraries still owe residents and staff a defensible vendor assurance standard for GenAI that may touch research workflows and institutional data.
A single marketing slide with no control detail fails by concept: marketing lacks verifiable control descriptions. Verbal assurances only, with no written attestations, fail by concept: unrecorded promises are not durable assurance for procurement or audit. Evidence limited to a vendor’s social media follower count fails by concept: popularity metrics do not demonstrate security or AI controls.
Exam caveat: SOC 2 is not AI-specific by itself—hence the need for AI-specific control evidence in addition. Attestations also have scope and date limits; stale or wrong-scope reports should not be treated as blanket approval.
Operational check: before purchase, collect current SOC 2 (or equivalent) reports and written AI-specific control evidence; map them to library requirements for data handling, logging, and model change; document gaps; and withhold award until gaps are closed or formally accepted as residual risk by an authorized municipal owner.