Public works compares open-weight self-host versus closed API AI vendors. How should security requirements be applied?

Public works comparing open-weight self-host versus closed API AI vendors should apply a consistent AI security requirements matrix across both delivery models. That approach works because packaging differences change how controls are implemented, not whether confidentiality, integrity, access control, logging, residency, and incident response still matter. Assessing self-hosted deployment hardening and API vendor SOC 2 documentation separately fails because it splits security review by delivery model instead of applying one consistent AI requirements matrix to both, and SOC 2 documentation alone does not verify AI-specific controls for municipal data. Prioritizing SOC 2 reports as proxy for AI-specific security controls validation fails because SOC 2 attests to general controls, not AI-specific risks such as model leakage, prompt injection, or municipal data residency. Adapting cloud infrastructure security benchmarks to both delivery models equally fails because generic infrastructure benchmarks do not verify AI-specific controls, so both paths can pass while still missing model, data, and logging requirements from the shared AI matrix. Exam caveat: consistent requirements do not mean identical controls—self-host may emphasize host hardening while APIs emphasize contractual telemetry and isolation, mapped to the same objectives. Operational check: score both options against the shared AI requirements matrix, document compensating controls where implementation differs, and prohibit selection of any path that fails mandatory matrix items.