A library AI sends research-query embeddings to a cloud service without reviewing residency or encryption standards. What should the auditor recommend?

The auditor should recommend assessing data residency and encryption requirements for AI embeddings in transit and at rest before continued cloud use. Library research-query embeddings can encode sensitive patron research interests, and simply deferring residency review while relying on existing cloud TLS defaults for transfers in use leaves privacy and security controls unverified. Municipal libraries should confirm where embeddings are stored, how they are encrypted, and whether contracts match civic standards before ongoing transfer.

Deferring residency review and relying on existing cloud TLS defaults to protect embedding transfers in use fails because TLS alone does not address where data resides or whether encryption and contractual terms meet civic standards, and embeddings can support re-identification or sensitive-topic inference and remain regulated data in many privacy programs. Encrypting stored embeddings at rest with library-managed keys and continuing current cloud transfers fails because it does not first assess residency and in-transit encryption requirements, and ongoing transfers may still violate privacy or contractual standards. Approving continued cloud use after reviewing catalog availability metrics and regional backup retention schedules for existing systems fails because availability and backup schedules do not verify embedding residency, encryption, or contractual compliance for AI data.

Exam caveat: vendor claims of “encrypted” must be checked for TLS in transit, encryption at rest, key custody, and residency regions—checkbox marketing is insufficient. Operational check: obtain the embedding data-flow diagram, residency attestations, and encryption details (in transit and at rest); suspend noncompliant cloud embedding transfers until standards and contract language are satisfied.