A county wants generative AI to draft situation reports only after containment is confirmed. Where should that assist sit in the IR lifecycle?

A county that wants generative AI to draft situation reports only after containment is confirmed should place generative sitrep drafting after containment confirmation, not before critical response steps finish. Containment is a factual operational state; sitreps that describe it before it exists risk briefing executives, elected officials, and mutual-aid partners with fiction. Sequencing generative assist after confirmed containment keeps AI in a documentation and communication role while humans and approved playbooks finish the high-stakes IR work that changes system state.

Why the other options fail by concept: Placing generative sitrep drafting after containment confirmation, during recovery after reviewed restoration notes delays timely reporting until restoration, so confirmed containment status reaches executives, elected officials, and mutual-aid partners too late to guide eradication and next decisions. Placing generative sitrep drafting after containment confirmation, during lessons review after facilitated debrief shifts operational sitreps into post-incident improvement, so reporting arrives after the response is over when it can no longer support active coordination. Placing generative sitrep drafting after containment confirmation, using detection triage notes after analyst review still sources pre-containment suspicion from detection, so it violates the only-after-containment rule and risks presenting uncontained scope as settled status.

Exam caveat: even post-containment drafts need human review for accuracy, classification, and public-records implications before external release. Operational check: gate the generative sitrep action on a SOAR or IR field that only flips after containment verification, require analyst approval of the draft, and sample county incidents to confirm no sitrep left the system before that gate.