A risk committee inventories all departmental GenAI tools to end shadow-AI sprawl. What governance practice is illustrated?

A risk committee inventorying all departmental GenAI tools to end shadow-AI sprawl illustrates AI inventory and oversight to bring municipal shadow AI under control. The correct answer is AI inventory and oversight to bring municipal shadow AI under control. When staff adopt consumer chatbots, browser plugins, or unapproved SaaS with city data, the organization loses sight of where sensitive information goes, which models touch official work, and what contractual protections exist. An inventory is the foundational control for risk tiering, procurement, and training—you cannot govern what you have not enumerated.

AI inventory and monitoring to keep municipal shadow AI drift controlled fails because it focuses on tracking accuracy degradation and output drift to keep drift controlled over time, rather than discovering and governing unapproved departmental tools to end sprawl. AI inventory and review to keep municipal shadow AI contracts controlled fails because it centers on assessing procurement terms and contractual protections to keep contracts controlled, rather than inventorying and overseeing unapproved departmental tools to end sprawl. AI inventory and training to keep municipal shadow AI use controlled fails because it focuses on building user awareness and skills to keep use controlled, rather than inventorying, classifying, and overseeing the actual GenAI tools in use.

Exam caveat: inventory is not itself a ban on GenAI. The tested practice is discovering and overseeing tools—including dormant or free ones—so leadership can approve, restrict, or replace them deliberately.

Operational check: survey departments for GenAI tools and browser extensions, reconcile with SSO and expense data, classify each tool by data sensitivity and use tier, require registration before further use, offer approved alternatives, and refresh the inventory on a fixed cadence with risk-committee review.