City counsel reviews who must own residual risk statements on the AI risk register. What accountability rule fits?

City counsel reviewing who must own residual risk statements on the AI risk register is testing accountability assignment for leftover risk after treatment. Risk owners—not vendors—own residual risk statements on the register is correct because the municipality remains accountable for accepting, monitoring, and escalating residual civic AI risk that affects residents and city operations. Vendors supply products and may share contractual duties, but they do not replace named city risk owners on the municipal register.

Vendors alone own residual risk because they sold the software fails by concept: purchasing does not transfer governmental accountability for residual risk acceptance to the seller by default. No one owns residual risk if the model score looks confident fails by concept: confidence scores are not an ownership substitute and can be wrong. Ownership may be left blank to avoid political visibility fails by concept: blank ownership defeats governance and hides accountability rather than managing risk.

Exam caveat: vendor contracts can allocate operational responsibilities and remedies, but residual risk ownership on the city’s register still names an internal accountable owner. Confidence of a model output never nullifies the need for a human risk owner.

Operational check: inspect the city AI risk register entries for residual statements; verify each has a named municipal risk owner with authority; reject vendor-only or blank ownership; and confirm counsel/GRC can produce the owner’s acceptance or treatment decision during audit without relying on the vendor to “own” the city’s residual risk line.