A city's 311 AI chatbot change board reviews prompts and model updates but never includes privacy or equity stakeholders. What should an auditor recommend?
Select an answer to reveal the explanation.
Short Explanation
A change board without privacy and equity voices is like a city council that never invites the neighbors. Resident-facing 311 bots touch personal data and fair treatment, so those stakeholders need a seat before releases ship. Broader membership is governance, not red tape for its own sake.
Full Explanation
Expanding the 311 chatbot change board so privacy and equity stakeholders review resident-facing AI changes before release is the sound governance control. Municipal 311 assistants process personal details, neighborhood context, and service dispositions that can create disparate treatment; those risks are not visible to developers alone. Including privacy and equity reviewers at change time forces pre-release scrutiny of prompts, model updates, retention, and fairness impacts while the board still has authority to block or condition go-live.
Keeping board membership technical and circulating privacy and equity impact summaries for awareness fails because summaries are not decision authority; excluding privacy and equity stakeholders from the change board means resident-facing AI changes can still ship without addressing unauthorized data use or inequitable outcomes, and treating review as FYI rather than a gate treats civic harm as an afterthought. Restricting privacy and equity stakeholder review to procurement decisions and excluding routine prompt and model updates fails because the very changes this board reviews—prompts and model updates—are where bias and data risks emerge; limiting stakeholders to procurement leaves day-to-day AI changes unreviewed and lets disparate treatment slip through unchecked. Publishing change-board release notes publicly while retaining technical membership for approval decisions fails because transparency after the fact is not pre-release governance; without privacy and equity stakeholders in the approval process, public notes merely document harms that the board was never structured to prevent.
Exam caveat: adding seats is not enough if reviewers lack mandate, time, or veto authority—token membership can look like governance while releases still ship unchanged. Operational check: verify change records show named privacy and equity sign-offs (or documented waivers with residual-risk acceptance) on recent 311 prompt and model changes, and sample whether any release proceeded without those signatures.