A public-health GenAI program has no clear owner for model risk versus application security risk. What RACI clarification best supports strategic AI risk management?
Select an answer to reveal the explanation.
Short Explanation
You can keep incidents from bouncing between teams by naming accountable owners for model risk and application security, with escalation paths. A RACI makes that clearer than informal shared oversight, assuming text-only chatbots need no owners, or making the help desk solely accountable for foundation-model risk.
Full Explanation
Strategic AI risk management needs named accountable owners for both model risk and GenAI application security, with escalation paths to public-health leadership. A RACI or equivalent clarifies who handles model evaluation, drift, safety filters, and vendor model changes, and who handles application security, including authentication, prompt and tool surfaces, logging, secrets, and integrations. This gives incidents, exceptions, and residual-risk decisions a clear destination instead of letting them bounce between teams. Informally sharing oversight without named owners or escalation paths leaves accountability unclear and makes it harder to manage risk consistently. Saying chatbots need no owners because they only generate text understates their impact: generated text can influence clinical or operational decisions, expose sensitive content, and create liability even without classic binary exploits. Making the help desk solely accountable for foundation-model risk misassigns responsibility; help desks handle tickets, not model governance, evaluation standards, or acceptance of residual risk. Exam caveat: RACI labels can vary by jurisdiction; the essential requirement is named accountability and escalation, not a particular template. Practical check: publish a program RACI naming accountable owners for model risk and application security, listing consult and inform roles, and specifying an escalation path to an executive risk owner within a defined SLA.