A regional energy utility uses an AI system, built with Amazon SageMaker AI, to recommend which substations need maintenance based on sensor data. The system has been in production for a year with no formal process for checking its recommendations against what actually happens in the field. What is the most important risk control the utility is missing?
Select an answer to reveal the explanation.
Short Explanation
A smoke detector that never gets tested isn't really protecting anyone — you only know it works if you actually check. The utility needs a defined feedback loop that compares what the model recommended against what actually happened in the field, so drift and bad calls get caught and escalated instead of just quietly piling up.
Full Explanation
Closing the loop between what the model recommends and what actually happens in the field is what lets the utility detect when recommendations are becoming unreliable and route problems to the right owner — that periodic review-and-escalation process is the missing control. Documenting where the training data came from describes a good governance record, but it is a one-time artifact; it does not itself detect anything going wrong after deployment. Requiring field crews to confirm they read a recommendation ensures they engage with the output, but it does not verify whether the recommendation was accurate, so a bad recommendation could still be confirmed and acted on. A monthly report of how many recommendations were generated counts volume, not quality, and reveals nothing about whether the recommendations are becoming less accurate over time. The underlying principle is that production risk controls must compare AI outputs to real-world results on an ongoing basis, not just track that the system is running or was built responsibly.