A 311 assistant incident involves suspected leakage via prompt logs, but responders do not preserve prompts and outputs for forensics. What gap should the auditor cite?

Citing missing forensic preservation of prompts and outputs unique to AI incident evidence needs emphasizes that suspected leakage via 311 prompt logs cannot be investigated without retaining conversational artifacts. The correct gap works because AI incidents often hinge on what was asked, what the model answered, which model version ran, and what context was retrieved—items traditional server-log checklists may omit. Without preservation, municipal responders lose the ability to confirm leakage scope and remediate.

Limited tracking of model latency metrics for 311 assistant performance monitoring fails as the cited gap because latency tracking is a performance issue, not missing forensic preservation of AI conversational evidence. Gaps in version control records for 311 assistant prompt templates and revisions fails conceptually: template version history is a change-management issue, not the failure to preserve prompts and outputs during a 311 leakage incident. Weak access reviews for 311 analytics dashboards used in monthly service reporting fails because dashboard access reviews are an operational governance issue, unrelated to AI forensic readiness of prompt-log leakage.

Exam caveat: preserve evidence with access controls—unlimited open copying of prompt logs can worsen the very privacy incident under investigation. Operational check: update municipal IR evidence procedures to snapshot prompts, outputs, model/version IDs, retrieval traces, and access logs for AI cases; train 311 responders to trigger preservation immediately when prompt-log leakage is suspected.