A county wants to operationalize AI oversight beyond ad-hoc spreadsheets. What should it select?
Select an answer to reveal the explanation.
Short Explanation
Spreadsheets and hallway chats don’t scale. Stand up tooling for inventory, risk register, and evidence so oversight isn’t trapped in someone’s inbox.
Full Explanation
Operationalizing county AI oversight beyond ad-hoc spreadsheets requires a governance tooling stack that supports an AI inventory, a risk register, and an evidence repository. Inventory tooling records systems, owners, purposes, and review currency; the risk register tracks tier, treatments, and residual risk; the evidence repository retains policies, assessments, approvals, monitoring outputs, and exception records in retrievable form. Together these tools replace hallway memory with durable, auditable workflow that boards, privacy officers, and auditors can actually use when municipal AI scales across departments.
Relying only on hallway conversations forever fails because oral coordination does not produce durable inventory, risk, or evidence artifacts and collapses under staff turnover. Using a social-media scheduler as the sole AI risk register fails by concept: campaign tools are not designed for risk treatment tracking, control owners, or residual-risk status. Personal email folders as the only evidence repository fail chain-of-custody and shared access—evidence trapped in individual inboxes is neither discoverable for audits nor resilient to departures.
Exam caveat: “tooling stack” can be an integrated GRC platform or a deliberately integrated set of inventory, risk, and document systems; the exam point is functional coverage, not a single brand. Operational check: confirm the county can export a current AI inventory, open risk-register entries with owners and tiers, and retrieve evidence packages (assessments, approvals, monitoring) for a sample of high-risk systems within a defined retrieval SLA.