An elections office ends a GenAI pilot that held civic corpora. Which offboarding actions are most responsible?

An elections office ending a GenAI pilot that held civic corpora must offboard access and data with proof, not convenience leftovers. Revoke keys, delete civic corpora, and verify destruction certificates is correct because pilots still create credentials and data stores; leaving them live extends breach and misuse exposure after the business need ends. Responsible municipal AI vendor offboarding pairs technical revocation with contractual deletion and evidence that civic corpora were destroyed.

Leave API keys active indefinitely for convenience fails by concept: convenience retention of keys prolongs unauthorized-access risk after the pilot ends. Keep civic corpora on the vendor platform with no deletion proof fails by concept: retaining election-related corpora without proof contradicts data minimization and offboarding. Skip destruction certificates because the pilot was short fails by concept: short duration does not erase the need to prove deletion of civic data.

Exam caveat: destruction certificates are evidence artifacts—still verify scope (which datasets, which regions, backups/replicas). Key revocation should include service accounts, personal tokens, and any shared SSO app assignments used for the pilot.

Operational check: at pilot end, revoke all elections GenAI API keys and app access; issue a deletion demand for civic corpora; obtain and file destruction certificates covering primary and backup stores; spot-check that pilot endpoints no longer accept old credentials; and record completion on the vendor offboarding checklist before closing the project.