# Civic QA Questions for AI Procurement

## Purpose and authority

1. What exact decision or task is the system allowed to affect?
2. What public purpose and legal or policy authority support that use?
3. Which uses are prohibited?
4. Who owns the decision and who has independent stop authority?

## Data and model

5. What data enters, from where, under what permission, and with what lineage?
6. What outcome or objective is optimized, and what important values are not represented by it?
7. Where are missingness, proxies, historical policy, reporting intensity, and population shift tested?
8. Which claims come from vendor evidence, independent evidence, live evidence, or inference?

## Evaluation and action boundary

9. What baseline and population were used?
10. What adversarial, distribution, reliability, security, human-factors, and live-workflow tests were run?
11. What actions, tools, data, transactions, or communications are technically allowlisted?
12. What binding condition stops or narrows the system?

## People and recourse

13. Who pays first for false positives, false negatives, delay, surveillance, or over-reliance?
14. What notice, explanation, appeal, remedy, and recovery are actually usable?
15. How are human overrides logged and reviewed without pressuring operators into rubber-stamping?

## Operations, correction, and retirement

16. What drift, incident, security, distribution, and reliance monitoring runs after launch?
17. Who publishes incidents, corrective actions, and effectiveness results?
18. What evidence triggers rollback, suspension, retraining, vendor remedy, or retirement?
19. What would prove continuation is not earned?
20. What public receipt will exist before any expansion?