A county board asks whether GenAI security investment should wait until federal AI rules fully settle. What is the best strategic response?
Select an answer to reveal the explanation.
Short Explanation
You can protect residents from known GenAI threats now without waiting for every federal rule to settle: put proportionate controls in place and update them as rules evolve. Delaying safeguards, disabling logging forever, or handing all legal judgment to an anonymous public chatbot without counsel review leaves the county without a sound strategy.
Full Explanation
Waiting for federal AI rules to fully settle is not a sound county strategy while GenAI is already in use. Implement proportionate controls now based on known threats, including access control, logging, data handling, threat modeling, acceptable use, and vendor diligence, then update them as statutes and guidance evolve. This protects residents and the county’s risk posture without treating legal uncertainty as a reason to do nothing. Delaying safeguards until rules are finalized accepts exposure to known threats and leaves foreseeable harms unmitigated, weakening the county’s duty of care. Disabling logging forever destroys accountability and evidence that future auditors may need to review. Outsourcing all legal judgment to an anonymous public chatbot with no counsel review substitutes an unaccountable model for professional legal and risk advice. Exam caveat: “proportionate” means controls should be tiered to use-case risk; it does not mean applying maximal controls to every demo or waiting with zero controls until rules are final. Practical check: adopt a living GenAI control baseline now, schedule periodic policy updates against emerging rules, and document residual-risk acceptance with counsel involvement.