The risk plan for a generative AI writing assistant contains no entry for ethical or reputational risk, only a security checklist. What gap does this reveal?
Select an answer to reveal the explanation.
Short Explanation
A security checklist tells you whether the system can be broken into. It doesn't tell you whether the words it writes will embarrass anyone.
Full Explanation
The gap is that the plan treated risk identification as purely technical, missing the ethical and reputational exposure that generative text output introduces. Security assessment addresses a narrow slice of operational risk; it does not evaluate whether generated content could be biased, misleading, or damaging if published, which is ethical and reputational territory. The claim that a security checklist already covers every risk category is incorrect because security controls address unauthorised access and technical vulnerabilities, not content generated during legitimate use. The claim that ethical and reputational risk only apply to models trained on personal data is incorrect because generative text can create exposure regardless of personal data. The claim that the gap is documentation formatting is incorrect because the problem is a missing category of assessment, not checklist layout. For the exam, do not let a security review stand in for the full set of risk categories.