County GRC wants responsible AI to be operational rather than a post-hoc slide. Where should responsible-AI checklists be integrated?
Select an answer to reveal the explanation.
Short Explanation
You’re right to make responsible AI part of the work that reaches production, not a post-hoc presentation. Put the checklist in change-control so each operational release clears its ethics gate.
Full Explanation
Integrating responsible-AI checklists into change-control is the right approach because it makes ethics gates part of operational releases. To make responsible AI operational rather than a post-hoc slide, County GRC should place checklist items in the processes where AI changes are reviewed and released, such as change tickets, release approvals, and deployment gates. Making ethics, privacy, and safety questions mandatory alongside security and rollback planning means teams must address them before promoting an AI change. In contrast, using responsible AI only in end-of-year party speeches is rhetoric and does not gate production changes. Keeping a static policy poster on the intranet, separate from release workflows, communicates policy but does not make checklist completion a control or provide evidence that a release was reviewed. Waiting until auditors arrive with findings is reactive: gaps may already have reached production before the checklist is used. Exam caveat: operationalization questions favor embedding controls in existing SDLC and change processes rather than keeping them separate from release work. Practical check: add a responsible-AI checklist to the change-management template, require complete ethics fields before CAB approval of AI-impacting releases, and sample closed tickets quarterly to assess checklist quality.