A bank's AI governance team is applying a risk classification framework to decide which oversight level to apply to three AI use cases: (1) an internal tool that summarizes meeting notes, (2) a customer-facing chatbot that answers general product questions, and (3) an AI system that determines credit-approval decisions. Which use case warrants the highest level of governance and oversight?
Select an answer to reveal the explanation.
Short Explanation
Think of it like this: a typo in meeting notes is annoying, but a wrong call on someone's credit application can upend their life and land you in front of a regulator. The credit-approval system carries the highest impact, and impact — not how often something's used — is what should drive the oversight level.
Full Explanation
The credit-approval system warrants the highest governance level because its decisions directly and materially affect customers' financial outcomes and fall under significant regulatory scrutiny — this is exactly the kind of high-impact, high-consequence use case a risk classification framework is designed to flag for the heaviest oversight. Frequency of internal use doesn't drive risk tier; the meeting-notes tool may be used constantly but carries low stakes if it makes a mistake. Volume of customer interactions likewise isn't the same as impact — a chatbot answering general product questions has far lower consequences per error than a system deciding whether someone gets credit. Treating all three identically because they run on the same underlying platform ignores the entire purpose of risk classification, which is to differentiate oversight by actual impact and consequence, not by shared technology. The general principle: risk tier should track potential impact and regulatory exposure, not usage volume or platform commonality.