A city water plant plans to roll an anomaly-detection model to every treatment site after a lab pilot, with no soak or canary period. What should the AI auditor emphasize?

Progressive deployment techniques such as soak and canary testing before full plant rollout emphasize controlling blast radius when operational civic AI influences water treatment. The correct approach works because lab-pilot accuracy measures performance under constrained conditions; soak and canary periods expose integration failures, sensor drift, operator workflow friction, and false-alarm load under live plant conditions while only a limited set of sites is at risk. Progressive rollout also produces auditable go/no-go evidence that municipal risk owners can use before expanding coverage across every treatment site.

Skipping progressive rollout because utility operations prefer big-bang cutovers fails conceptually because operational consistency preference does not eliminate the need for limited-exposure validation of AI behavior in production. Treating soak and canary as optional once lab accuracy looks acceptable fails because acceptable offline metrics are not equivalent to plant-floor readiness, especially when anomaly detectors can drive costly or unsafe operational responses. Approving full rollout solely because a vendor warranty covers false alarms fails because contractual risk transfer does not substitute for controlled progressive evidence that the system behaves safely in the city's actual environments.

Exam caveat: progressive deployment reduces—but does not remove—risk; a canary that only covers atypical sites can still miss failure modes present at older plants. Operational check: require a documented progressive plan (sites in scope, success/failure criteria, rollback triggers, operator feedback capture) and retain canary telemetry and decision logs before authorizing citywide activation of the water anomaly-detection model.