A pharmaceutical company is building a risk classification framework to prioritize its GenAI governance efforts. Which factor should most heavily influence how a given AI use case is classified?
Select an answer to reveal the explanation.
Short Explanation
Risk isn't measured by how many people use a tool or what it costs — it's measured by what happens when the tool gets something wrong. For your pharmaceutical company, that means weighing the potential harm to patient safety and regulatory standing above budget, headcount, or how new the request is.
Full Explanation
Risk classification frameworks are built around potential consequences, and for a pharmaceutical company, the potential impact on patient safety, regulatory obligations, and individuals if something goes wrong is precisely the factor that should determine how heavily an AI use case is governed. The number of employees requesting a use case reflects internal demand, not the actual risk the use case poses if it fails. A department's AI budget reflects spending capacity, which has no bearing on how consequential an incorrect output would be. How recently a use case was proposed is a matter of intake order, not a measure of risk at all. The general principle: risk classification should be driven by potential impact and consequence, not by administrative or procedural factors like headcount, budget, or timing, which say nothing about what happens if the AI system gets something wrong.