A design review raises the question of how AI risk should be identified before deployment. What is the right approach?

The right approach is to identify regulatory, ethical, operational, and reputational risks across the whole lifecycle, before and during deployment, not just one category at one point in time. AI systems carry regulatory, ethical, operational, and reputational risk simultaneously, and each can emerge at a different lifecycle stage, so identification has to cover all four categories continuously rather than one category at a single checkpoint. Focusing risk identification on regulatory compliance is incorrect because narrowing to regulatory exposure leaves ethical, operational, and reputational risk unassessed, even though any of them can cause real harm or a costly failure. Focusing risk identification on operational risk is incorrect for the same reason in the other direction: operational stability says nothing about whether the system is fair, defensible, or compliant. Deferring risk identification until after deployment is incorrect because waiting for post-deployment data means the highest-risk decisions, the ones made before launch, go unassessed until it is too late to prevent the resulting harm. For the exam, remember all four risk categories together, and that identification spans the whole lifecycle, not a single gate.