City GRC maps how privacy and AI obligations reach vendors. Which flow-down expectation is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Your DPIA and audits don’t stop at the city firewall. Flow those duties to vendors—they must help with inputs and evidence when you ask.
Full Explanation
City GRC mapping how privacy and AI obligations reach vendors must define flow-down duties that keep the city audit-ready. Vendors must support DPIA inputs and audit evidence on request is correct because the city remains responsible for privacy impact assessments and oversight even when processing is outsourced to AI vendors. Flow-down clauses and operating expectations ensure vendors supply processing descriptions, security measures, subprocessors, and evidence the city needs for DPIAs and audits.
Vendors need not support any DPIA inputs or audit evidence fails by concept: withholding DPIA/audit support blocks the city’s legal and governance obligations. Flow-down applies only to landscaping subcontractors, never AI vendors fails by concept: AI vendors that process personal or civic data are squarely in flow-down scope. Vendors may refuse all evidence requests after the PO is issued fails by concept: post-PO refusal would gut ongoing assurance and auditability.
Exam caveat: flow-down must be contracted and operationalized—policy language alone may not compel a resistant vendor. DPIA support means timely, accurate inputs about processing, not the vendor writing the city’s entire DPIA unaided.
Operational check: in AI vendor agreements, require DPIA input cooperation and audit-evidence production on request; test the obligation with a sample evidence request during onboarding; escalate non-response; and confirm GRC can complete DPIA and audit packages without gaps caused by vendor silence.