A city AI board wants executive visibility into vendor AI risk. Which dashboard content best fits?
Select an answer to reveal the explanation.
Short Explanation
Boards don’t need snack polls—they need KRIs. Show critical findings, overdue remediations, and whether attestations are current.
Full Explanation
A city AI board needs executive visibility into third-party AI risk through decision-useful KRIs, not vendor branding. The best dashboard content surfaces critical findings from assessments or continuous monitoring, overdue remediations against agreed due dates, and attestation status for AI vendors (current, expired, or missing). Those signals let executives prioritize which vendors threaten resident services, which findings are aging into unacceptable residual risk, and whether assurance artifacts are actually in force. Aggregating severity, aging, and attestation health turns vendor sprawl into a governable portfolio for civic oversight.
Dashboards limited to vendor logo colors and preferred office snack brands convey no risk posture. A blank page because third-party AI risk “never needs board reporting” contradicts board fiduciary and public-accountability duties for AI that touches residents. Counting only marketing webinars hosted last quarter measures vendor outreach activity, not control effectiveness or remediation discipline.
Exam caveat: board reporting should be risk-oriented (findings, overdue fixes, attestations), not vanity metrics. Attestation without tracking overdue remediations can still hide active exposure.
Operational check: publish a recurring third-party AI risk dashboard to the board with critical finding counts by vendor, aging of open remediations, and attestation currency; assign owners for red items and verify closure evidence before the next board cycle.