A city CIO briefs the mayor’s cabinet on anchoring the municipal AI charter. Which action best aligns stakeholder expectations with industry AI security governance?

Selecting a recognized industry AI security framework family as the municipal AI charter's governance reference is the action that best anchors stakeholder expectations. City cabinets, auditors, and department leads need a durable, shared vocabulary for roles, control families, residual risk, and oversight cadence. Industry framework families—whether NIST AI RMF–style functions, ISO AI management companions, or peer AI security guidance—provide that common map so the mayor's charter is not reinvented with every vendor briefing. Anchoring the charter this way lets the CIO translate cabinet priorities into measurable governance obligations without inventing a private dialect of controls.

Selecting a recognized industry AI security framework family as the charter’s vendor procurement catalog confuses a governance reference with a buying list; a framework family provides roles, control families, and oversight cadence, not an approved-product list, and procurement still requires separate market evaluation and purchasing rules. Selecting a recognized industry AI security framework family as the charter’s incident response playbook confuses governance with operations; a framework family defines oversight functions and expectations, not step-by-step containment, escalation, communication, and recovery procedures that a playbook must provide. Selecting a recognized industry AI security framework family as the charter’s vendor risk assessment form confuses governance with assurance execution; a framework family establishes shared vocabulary and oversight obligations, not a scored questionnaire and evidence checklist for vetting individual vendors.

Exam caveat: recognition of a framework family does not mean wholesale copy-paste of every control without tailoring to municipal scale, nor does it grant legal safe harbor by itself. Frameworks guide; statutes, procurement rules, and the city’s own risk appetite still bind.

Operational check: before the next cabinet vote, confirm the charter cites a named industry AI security framework family, maps cabinet oversight roles to that vocabulary, and keeps procurement catalogs, incident response playbooks, and vendor assessment forms as separate operational artifacts rather than substituting the framework for them.