A telecom company is beginning to build its first AI risk classification framework to prioritize governance across dozens of AI initiatives already in use. What is the most appropriate first step?
Select an answer to reveal the explanation.
Short Explanation
Before you can sort anything into piles, you need to agree on what the piles mean — that's the whole idea behind building a risk framework. Setting shared criteria like impact, regulatory exposure, and autonomy first means every department gets measured the same way, instead of each team guessing on its own.
Full Explanation
Defining consistent risk tiers and criteria — potential impact, regulatory exposure, autonomy, and similar factors — gives the company a common yardstick to evaluate dozens of existing initiatives consistently, which is the necessary foundation before any prioritization or oversight decisions can be made. Immediately shutting down any initiative deployed without prior review is a drastic overcorrection that disrupts existing operations before the company has even assessed which initiatives actually pose meaningful risk. Letting each department self-report risk without common criteria produces inconsistent, unreliable classifications, since different departments will apply different standards to similar situations. Waiting until all current initiatives are complete before classifying anything defeats the purpose of a framework meant to guide ongoing governance and compliance decisions across an active portfolio, not just future ones. The general principle: building a risk classification framework starts with defining shared, consistent criteria — only then can existing and future initiatives be evaluated and prioritized fairly.