A city updates its incident response plan after a permitting chatbot may have leaked resident PII. Which action best establishes AI-specific incident handling?

AI-enabled municipal services introduce incident types that classic malware playbooks do not cover: prompt or response leakage of resident PII, model misuse, poisoned inputs, and unsafe outputs that must be contained before they propagate into permitting records. Establishing AI-specific containment, notification, escalation, eradication, and recovery steps in the city's IR plan creates a repeatable path when a permitting chatbot may have exposed personal data. Containment may include isolating the chatbot channel, freezing related prompt/response stores, and blocking further outbound disclosures. Notification and escalation connect security, privacy, legal, and system owners on defined timelines. Eradication and recovery remove the unsafe configuration or component and restore approved service with evidence that PII exposure has stopped.

Adding AI-specific inventory, lineage documentation, and procurement approval steps to the IR plan is governance and procurement, not incident handling; it adds no AI-specific containment, notification, escalation, eradication, or recovery steps to the IR plan. Adding AI-specific adversarial testing, bias evaluation, and pre-release approval steps to the IR plan is proactive pre-release evaluation, not incident handling; it does not establish containment, notification, escalation, eradication, or recovery steps for the current PII leak. Adding AI-specific backup restoration, service restart, and performance monitoring steps to the IR plan is a narrow recovery and operations step; it skips AI-specific containment, notification, escalation, and full eradication, and performance monitoring may miss recurring PII disclosure.

Exam caveat: adding AI steps to the IR plan does not replace privacy breach notification law or records-retention rules; those obligations still bind the municipality once scope is known. Operational check: confirm the live IR plan names AI containment owners, lists which chatbot logs and model artifacts are preserved as evidence, and includes a tested escalation path to privacy/legal for suspected resident PII disclosure.