County IT is offered an AI vendor contract that claims privacy risk is fully transferred to the vendor. Which conclusion best reflects sound AI risk treatment?

Contractual clauses that claim privacy risk is fully transferred to an AI vendor do not eliminate municipal accountability for resident data. Sound treatment recognizes that contracts shift some commercial risk but do not fully transfer AI privacy risk without ongoing verification of controls—assessments, audit rights, evidence of encryption and access control, breach cooperation, and monitoring that the county still performs or commissions.

Requiring a signed municipal data processing addendum with monthly vendor self-attestations of AI controls still confuses vendor-claimed documentation with independently verified control operation. Accepting an annual vendor SOC 2 Type II with quarterly access reviews as ongoing AI privacy monitoring still mistakes periodic attestations and point-in-time reviews for continuous assurance of AI privacy controls. Recording vendor privacy assurances in the county risk register with yearly policy reviews of AI data use substitutes paperwork review for control verification and leaves residual privacy risk unaddressed between reviews.

Exam caveat: strong contracts remain valuable—they enable remedies and clarify roles—but they complement, rather than replace, verification and residual-risk ownership. Operational check: for each AI vendor processing resident data, confirm the county retains a verification cadence (report review, questionnaire, or audit) and that residual privacy risk remains on the municipal risk register with a named owner.