A city attorney office wants AI pilots tracked like other enterprise initiatives. What risk-management practice supports that goal?
Select an answer to reveal the explanation.
Short Explanation
If it’s on the risk register with a real owner, it gets managed—not whispered about in Slack. Informal AI pilots have a habit of becoming informal incidents.
Full Explanation
When a city attorney office wants AI pilots tracked like other enterprise initiatives, the risk-management practice that supports that goal is to add AI projects to the enterprise risk register with named owners and mitigations. Registration forces visibility: purpose, data sensitivity, residual risk, and who is accountable for controls and go-live decisions. Treating AI like other material initiatives prevents informal pilots from becoming unmanaged production dependencies that auditors and counsel cannot see or challenge.
Keeping AI projects informal so they never appear in audits deliberately hides risk and fails governance. Assigning no owners so accountability stays flexible ensures nobody is responsible when harm or leakage occurs. Documenting only successful demos and discarding risk notes creates survivorship bias and erases the hazard record leadership needs for oversight and continuous improvement.
Exam caveat: risk-register entry is governance visibility; it does not by itself complete a DPIA or security review, which may still be required gates before production. Operational check: create register entries for each AI pilot with owner, data classes, mitigations, and review date; refuse production promotion for unregistered AI uses; and report AI risk status alongside other enterprise risks.