Emergency management is updating its annual security program maturity assessment. How should AI systems be included?

When emergency management updates its annual security program maturity assessment, AI systems must be included by bringing AI system owners and AI control coverage into that assessment. Generative and predictive tools used in emergency workflows affect confidentiality, integrity, and availability of civic response; maturity scoring that ignores them understates risk and capability before the next incident season. Excluding AI owners because tools are experimental pretends pilot status removes program accountability while those tools already influence operational decisions. Assessing only network firewalls while ignoring AI ownership coverage measures a subset of traditional IT and misses model, prompt, and data controls. Limiting the assessment to paper policies without interviewing AI owners validates documentation theater rather than operating reality. Exam caveat: include both in-house and vendor-hosted emergency AI, and score control domains such as inventory, access, monitoring, and incident playbooks. Operational check: add AI owner interviews and control evidence requests to the maturity assessment plan, score AI coverage explicitly, and feed gaps into the remediation roadmap before the next emergency season.