County counsel asks security to place GenAI platform risks on the existing municipal enterprise risk register. What is the sound strategic move?
Select an answer to reveal the explanation.
Short Explanation
Enterprise risk is the city’s shared scoreboard — GenAI belongs on it, not in a hidden side spreadsheet. Map platform risks with owners and treatments into the civic ERM. Vendor-liability hand-waving or a lone GPU-cost line will not satisfy counsel.
Full Explanation
Strategic GenAI risk management places platform risks on the same enterprise risk register the municipality already uses for cyber, privacy, and operational risk. Mapping GenAI risks into the civic ERM with named owners, inherent and residual ratings, and treatment plans ensures executive visibility, budget alignment, and committee oversight. Benefits, transit, housing, and other GenAI uses then compete for attention with other city risks under one governance cadence rather than drifting as informal IT concerns.
A secret shadow spreadsheet that never reaches the enterprise risk committee defeats the purpose of ERM: concentration of accountability and decision rights. Shadow registers create duplicate, stale, or conflicting views and hide material AI risk from counsel and executives. Refusing to document AI risk because LLM vendors “already carry all liability” misunderstands procurement and tort reality—municipalities retain duties over how they deploy systems that touch residents, even when vendors warrant certain behaviors. Listing only GPU procurement costs as the sole GenAI risk entry mistakes a budget line for a risk register: cost is one input, but safety, privacy, availability, model failure, and third-party concentration are the strategic entries that need owners and treatments.
Exam caveat: ERM integration does not replace technical controls; it ensures GenAI risks are prioritized and tracked at the same altitude as other enterprise risks. Operational check: for each major GenAI platform or use case, confirm a register row with owner, rating methodology, treatment (mitigate/accept/transfer/avoid), next review date, and linkage to the risk committee agenda.