A 311 GenAI tool scrapes the open-data portal plus unpublished citizen emails without classification checks. What should audit recommend?

Audit should recommend enforcing data-classification and allowable-source controls before content is used for AI training or retrieval. A 311 GenAI that scrapes the open-data portal plus unpublished citizen emails without classification checks mixes public and non-public sources. Municipal open data and private mailbox content differ in sensitivity, consent, and allowable use; classification and source allowlists must gate what the model may train on or retrieve.

Requiring automated PII redaction of citizen emails during post-training evaluation and output logging fails because it addresses exposure only after the fact instead of gating allowable sources and classification before content is used for AI training or retrieval. Retaining citizen emails in the retrieval index with access logging to support traceability of generated responses fails because logging does not make unpublished mail allowable for retrieval, and leaving it in the index leaves the exposure intact. Applying open-data portal reuse licenses to citizen emails to authorize model training and redistribution fails because open-data reuse licenses do not cover unpublished citizen correspondence, and a license label cannot convert private mail into allowable training data.

Exam caveat: allowlists must cover both training corpora and RAG/retrieval indexes—blocking training while still embedding private mail into retrieval leaves the exposure intact. Operational check: inspect GenAI data connectors and corpora for classification tags and approved-source evidence; quarantine any unpublished email content found in training or retrieval stores until approved under policy.