A permitting office accepts a GenAI vendor’s questionnaire answers at face value with no validation of AI-specific controls. What due-diligence improvement is needed?
Select an answer to reveal the explanation.
Short Explanation
A questionnaire checkbox—or even a detailed feature description—is not proof that a safeguard works. You should validate GenAI-specific controls with evidence on data handling, isolation, and abuse prevention; a discount code or glossy brochure cannot replace that diligence.
Full Explanation
Vendor due diligence for municipal GenAI must validate AI-specific controls with evidence, not questionnaire checkboxes alone. Check how training and inference data are handled and retained, tenant isolation, logging and abuse detection, prompt-injection and jailbreak mitigations, subprocessors, geographic processing, and incident notification. Independent assurance—such as attestations, penetration or red-team summaries, and architecture reviews—strengthens trust beyond self-attested forms. This supports Domain 8 strategic supplier risk management for a permitting office. Detailed descriptions of AI features may explain a vendor’s claims, but clear answers do not establish that safeguards are appropriate or operating effectively. A municipal discount code changes the price, not the unvalidated residual risk to resident permitting data. A glossy brochure is marketing collateral, not independent control assurance. Exam caveat: questionnaires remain useful for intake; the failure is accepting answers at face value without sampling evidence or validating GenAI-specific threats. Practical check: before contract signature or production connection, attach evidence artifacts—such as a data-flow diagram, isolation description, abuse-prevention controls, and subprocessor details—to the diligence file, and record who validated them.