After a housing-authority chatbot leak, the post-incident review never updates the AI risk register. What strategic feedback-loop step was missed?

After a housing-authority chatbot leak, strategic learning requires feeding incident lessons into the AI risk register with revised ratings, owners, and treatments. The post-incident review should update likelihood and impact where evidence warrants, reassign accountability if ownership gaps contributed, and add or strengthen treatments such as DLP, approved-tool mandates, logging, or vendor controls. That feedback loop keeps the enterprise view of GenAI risk current and prevents the same failure mode from recurring under a green-but-stale register—exactly the Domain 8 continuous-improvement expectation for municipal AI risk management.

Issuing commemorative stickers for the incident response team only rewards morale without changing strategic risk posture. Closing the incident ticket without changing ratings, owners, or treatments ends the workflow while leaving the register wrong for the next budget and audit cycle. Celebrating that the leak “raised awareness” with no register updates confuses narrative and training theater with governance action.

Exam caveat: not every incident must raise ratings—some may confirm that controls worked as designed—but the register must be reviewed and explicitly updated or reaffirmed with documented rationale. Skipping the review is the failure. Operational check: within the PIR window, update AI risk register entries related to the leak, assign treatment owners and due dates, brief the risk committee, and schedule verification that new or revised controls are effective in production.