An elections office is offboarding a chatbot vendor. Which control best protects AI-related civic data at exit?

An elections office offboarding a chatbot vendor should require certified destruction or return of municipal prompt logs and related AI data per contract. That control best protects AI-related civic data at exit because ending a subscription does not automatically purge vendor-held prompts, embeddings, fine-tunes, or backups that may contain election-sensitive or voter-service content. Certified destruction or return closes the residual data custody gap.

Disabling vendor API keys and rotating shared election system credentials upon exit per contract fails as the best control because it addresses system access, not the custody or destruction of vendor-held municipal prompt logs and AI-derived data at exit. Retaining anonymized chatbot metrics in vendor analytics portal per contract for trend review fails because it leaves data in the vendor portal for trend review rather than requiring the return or certified destruction of election prompt logs and related AI data still held by the vendor. Updating the AI asset inventory and reassigning chatbot stewardship to elections staff per contract fails because those are internal administrative steps that do not compel the vendor to destroy or return municipal prompt logs and related AI data.

Exam caveat: “destruction” must cover backups, subprocessors, and derived artifacts (embeddings, fine-tuned weights), or residual copies remain. Operational check: invoke contractual exit clauses, obtain certificates covering primary and subprocessor stores, verify return/destruction of prompt logs and derivatives, and record completion in the elections vendor offboarding checklist before closing the ticket.