During a design review, an architect asks which choice best matches the IBM guidance. What is the best way to handle AI risk management while staying aligned with the certification objectives?

Here's the deal: think of AI risk management like labeling the cables before you close the rack door. If you skip that discipline, troubleshooting gets ugly fast. In this scenario, answer B is the practical move because it keeps the implementation tied to the real IBM capability instead of chasing a shortcut. The other choices sound tempting, but they either skip governance, ignore operational reality, or solve the wrong problem.

The correct answer is B. Identify regulatory, ethical, operational, and reputational risks before and during AI deployment. That aligns with the 1.0 AI Governance Overview objective because it applies the feature or practice in the context where IBM expects a practitioner to use it. It also keeps the design reviewable, supportable, and realistic for a production environment.

Let's examine why the other options are incorrect: - Option A is incorrect because it narrows the solution to one artifact or metric and misses the broader AI risk management requirement. - Option C is incorrect because it uses an overbroad rule instead of matching the design to the actual workload and risk. - Option D is incorrect because it skips the control or validation that makes AI risk management reliable in production. For the exam, connect the feature to the operational outcome: the right answer is the one that preserves control, accuracy, and maintainability instead of relying on a brittle shortcut. The incorrect options — such as 'Assess risk only after a regulator asks' and 'Classify every AI use case as low risk' — describe either out-of-sequence steps or unrelated configuration tasks. This concept falls under the 1.0 AI Governance Overview domain of the IBM watsonx.governance certification.