A county adopts ISO/IEC 42001-aligned AI risk treatment. Which set of options should decision records support?
Select an answer to reveal the explanation.
Short Explanation
Risk treatment isn’t vibes. Mitigate, transfer, avoid, or accept—with a written why. Hope-based or blanket choices aren’t ISO/IEC 42001-style management.
Full Explanation
A county adopting ISO/IEC 42001-aligned AI risk treatment should support decision records that allow mitigate, transfer, avoid, or accept—with documented rationale. Structured treatment options force explicit choices: reduce risk with controls, shift via contracts/insurance where appropriate, decline or discontinue the use case, or accept residual risk with justification and approval. Documented rationale creates an auditable decision trail for municipal AI programs.
Only “hope the risk goes away” with no rationale fails by concept because hope is not a treatment option and leaves no decision record. Only “accept everything” to accelerate every pilot fails because blanket acceptance abandons risk treatment and accountability. Only “avoid all AI forever” without case-by-case analysis fails because categorical avoidance without analysis is not risk-based decision-making under a management-system approach.
Exam caveat: acceptance is valid only as an explicit, authorized residual-risk decision—not as silent inaction; transfer does not remove all accountability for civic outcomes. Operational check: use a standard treatment decision form per AI risk, require approving authority by residual severity, and revisit accepted risks on a calendar when context or controls change.