A municipal vendor pushes continuous model updates with no customer-visible change log. What should the auditor recommend?

When a municipal vendor continuously updates models with no customer-visible change log, the city cannot assess impact on civic services, retest critical paths, or explain outcome shifts to residents and oversight bodies. The auditor should recommend vendor change transparency obligations—such as customer-visible change logs, notice for material model changes, and cooperation on regression testing—for civic AI services under contract.

Reviewing vendor updates quarterly and applying them only after verifying they do not degrade outputs fails because a quarterly cadence still leaves the city blind to interim model changes the vendor pushes continuously between review cycles, with no customer-visible change log driving the review. Tracking vendor model changes in a log but assessing their impact only against SLA compliance metrics fails because uptime and SLA figures measure availability, not whether a model change degraded decision quality, fairness, or content safety for residents. Limiting vendor updates to scheduled maintenance windows to ensure stability fails because a fixed window controls timing, not visibility; it does not give the city the customer-facing change log and regression-testing cooperation needed to assess what actually changed in the model.

Exam caveat: vendor-managed AI still requires customer-side visibility and change assessment—uptime SLAs alone are insufficient exam answers. Operational check: review the contract and operational process for model-change notices and a municipal intake that evaluates civic impact before or promptly after material updates, with a recorded customer-visible change history.