All municipal staff complete shadow-AI awareness training before using any generative tools. What control does this represent?

Awareness training is an organizational responsible-AI control that educates staff about risks such as shadow AI, data leakage, and unsanctioned plugins before generative tools are used on municipal work. Completing that training for all municipal staff prior to any generative-tool use is preventive control: people learn what must stay out of public LLMs, which tools are sanctioned, and how to escalate. An acceptable-use policy that defines approved tools and handling rules for AI use is not the preventive awareness control the stem describes; it tells staff which tools are sanctioned but does not prepare them to recognize and avoid shadow-AI risks before use, nor does it scale risk culture across departments.

Preventive technical enforcement that blocks unapproved AI tools for municipal staff fails by mechanism: technical blocking stops access at the system level, not the organizational awareness training the stem describes that prepares all staff to recognize and avoid unsanctioned AI risks before any generative-tool use. An acceptable-use policy that defines approved tools and handling rules for AI use fails the timing and mechanism of the stem: setting approved-tool rules is not the same as requiring all staff to complete awareness training before any generative-tool use. Continuous usage monitoring that reviews prompts to detect unsanctioned AI activity fails differently: it is a detective control that watches activity after tools are already in use, not the preventive awareness training staff must complete before any generative-tool use.

Exam caveat: awareness training prepares recognition and avoidance; it does not by itself authorize tool use—sanctioned-tool policy and technical blocks still apply. Do not equate technically blocking unapproved tools with training staff to recognize and avoid shadow-AI risk.

Operational check: track completion before granting generative-tool access, include shadow-AI and data-handling scenarios in the curriculum, and re-train when sanctioned-tool lists or high-risk use cases change.