A public-health chatbot retains chat logs indefinitely for future training without retention rules. Which control gap is most significant?

The most significant control gap is missing retention and secondary-use controls for civic AI conversational data destined for training. Public-health chatbot logs can contain symptoms, location, and identity cues; indefinite retention “for future training” without schedules or purpose limits creates unbounded privacy exposure. Municipal AI data governance must define how long logs are kept, who may reuse them for training, and when deletion or anonymization occurs.

Citing insufficient encryption and access reviews for stored public-health chatbot transcript systems fails because technical safeguards do not authorize indefinite retention or unbounded secondary use for training; the core gap is retention and purpose governance, not encryption. Citing lack of ongoing accuracy testing and clinical validation for public-health chatbot medical response quality fails because response quality is a separate safety concern and does not cure the absence of retention schedules or purpose limits for logged conversational data. Citing gaps in availability monitoring and failover planning for reliable chatbot service operations fails because service reliability is an operational issue distinct from the privacy control failure of retaining logs indefinitely without secondary-use controls.

Exam caveat: a retention schedule that exists but excludes AI training reuse still leaves secondary-use uncontrolled—training must be an explicit, bounded purpose. Operational check: review chatbot data policies for retention periods, training-use approvals, and deletion jobs; sample log stores for age distribution and confirm no indefinite raw corpus accumulates without documented authority.