A library recommendation AI skips threat modeling because staff say it only suggests books. How should an auditor respond?

The auditor should challenge the underestimation and require proportionate AI threat and risk analysis despite perceived low impact. Library recommendation AI still processes patron behavior signals, can expose reading patterns, and may be manipulated to push harmful or biased content. “It only suggests books” is not a threat-model exemption; proportionate analysis scales depth to impact but does not skip identification of privacy, integrity, and abuse scenarios for municipal library systems.

Accepting vendor security attestations as a sufficient substitute for independent recommender threat analysis fails because vendor attestations do not replace the auditor’s own threat identification for patron data, model abuse, and local trust boundaries. Focusing the assessment on patron borrowing confidentiality and routine system availability metrics fails because it narrows scope to operational indicators and omits AI-specific threats such as recommendation manipulation, data poisoning, and privacy side effects. Deferring detailed structured threat analysis until post-deployment usage telemetry confirms elevated reader risk patterns fails because waiting for observed harm is not preventive risk management and leaves design-time privacy and integrity exposures unexamined.

Exam caveat: proportionate analysis still requires a documented scope decision—calling something low impact without recording assets, data classes, and trust boundaries is dismissal, not proportionality. Operational check: require a short threat/risk note for the recommender covering data inputs, abuse cases, and privacy side effects, with library leadership acceptance before continued production use.