A multinational bank's compliance team is assessing regulatory risk for a new GenAI-based investment-advice assistant that will operate in several countries. Select the TWO actions that appropriately address regulatory compliance risk. (Select TWO.)

Mapping the regulatory regimes in each jurisdiction acknowledges that investment-advice rules differ across countries, and establishing ongoing monitoring recognizes that regulations and the assistant's use both evolve over time — together these give the bank a defensible, sustainable compliance posture. Assuming home-country compliance transfers automatically is a common but incorrect shortcut; financial services regulation is jurisdiction-specific, and what satisfies one regulator won't necessarily satisfy another. Treating compliance as a one-time review ignores that regulatory guidance and the assistant's own behavior can change after launch, leaving the bank blind to new risk. Postponing any review until after full deployment across all markets is backwards — compliance risk needs to be assessed before or during rollout, not after the assistant is already live everywhere. The general principle: regulatory compliance for a multi-jurisdiction AI system requires both jurisdiction-specific assessment and ongoing monitoring, not a single upfront check assumed to travel across borders.