City GRC wants AI controls to stay current when guidance shifts. What practice best supports continuous legal-risk management?
Select an answer to reveal the explanation.
Short Explanation
Rules move—your AI controls should too. A regulatory change log that kicks off control updates beats hallway rumors and scandal-driven scramble.
Full Explanation
City GRC keeps AI controls current when guidance shifts by maintaining a regulatory change log that triggers control updates. Continuous legal-risk management is a feedback loop: detect relevant AI guidance or statute changes, record them, assess impact on deployed municipal systems, and update policies, technical controls, and evidence on purpose. A change log creates traceability from external obligation to internal control action—essential when multiple departments run AI under shared GRC oversight.
Never revisiting controls after the first policy draft fails by concept because static first drafts decay as rules and systems evolve. Relying solely on hallway rumors about new rules fails because informal chatter is neither authoritative nor auditable intake. Updating controls only after a public scandal fails because scandal-driven remediation is lagging risk management and damages public trust.
Exam caveat: the change log must distinguish applicable obligations from noise; not every global headline requires a control rewrite, but material AI guidance affecting city uses must be dispositioned with a named owner. Operational check: assign intake ownership, require impact assessment within a defined SLA for each logged item, and link closed change-log entries to versioned control updates in the AI inventory.