Every AI use case on the intake list has been marked low risk, including a new generative model used to draft customer-facing correspondence. What should the engineer reviewing the list flag?

The correct answer is the option saying blanket low-risk classification is itself a risk, because it skips the assessment step that would catch a use case, like customer-facing generative output, that warrants closer scrutiny. Marking every use case low risk without differentiated assessment defeats risk identification, and customer-facing generative content carries real reputational and ethical exposure that a real assessment would surface. The option saying nothing is wrong because a text-only generative model carries no meaningful risk is incorrect: generated text reaching customers can misinform, offend, or misrepresent the organisation, so producing text is not producing no risk. The option saying nothing is wrong because risk classification only matters for automated decisions, not drafting text, is incorrect because reputational and ethical risk arise from what a system outputs and who sees it, not only from automated decision-making. The option saying the list should be reordered alphabetically is incorrect because it addresses formatting rather than the substantive gap of missing risk assessment. For the exam, be alert to blanket low-risk labelling as a red flag, and remember generative output carries risk even without an automated decision.