Define export categories: What should procurement require?

Termination controls must cover usable exports and verifiable deletion across the processor’s actual information categories.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Retain the vendor’s raw-document export as the termination deliverable.

   Raw files may omit extracted fields, prompts, logs, and other information needed for continuity, accountability, and risk management.
2. Define export categories, usable formats, deletion scope, responsibilities, and completion evidence contractually. ✓

   The identified gaps concern both recoverability and disposal, requiring explicit categories, formats, responsibilities, scope, and evidence.
3. Test whether exported files open successfully before accepting the vendor’s standard termination process.

   Usability testing addresses one export concern but leaves extracted data, logs, deletion scope, and completion evidence unresolved.
4. Request a vendor statement describing its general deletion practices after termination.

   General practices do not define the specific data categories, export format, timing, responsibilities, or evidence required for this service.

How to remember it

Termination controls must cover usable exports and verifiable deletion across the processor’s actual information categories.

More Understanding How to Govern AI Deployment and Use questions

• Require change notice: What is the decisive governance requirement? →
• Add harm monitoring and escalation alongside: Under the organization’s internal risk-management policy, which →
• Verify permission for external delivery: Before approval, what evidence must procurement verify under the →
• All 424 Understanding How to Govern AI Deployment and Use questions →