Which statement best summarises how AI use cases should be classified in the governance inventory?
Select an answer to reveal the explanation.
Short Explanation
You classify each AI use case by impact, regulation, data sensitivity, automation level, and user population together. That five-dimension assessment sets an accurate risk tier, not a default label, a developer's tag, or a vendor's brochure.
Full Explanation
The best summary is classifying each use case by impact, regulation, data sensitivity, automation level, and user population, assessed together to set an accurate risk tier. The five dimensions taken together give a defensible, repeatable basis for setting risk tier, which is the point of formal classification.
Classifying by whichever tag the original developer chose when the project was created is incorrect because a developer's informal tag was not derived from any consistent criteria. Classifying as low risk by default and upgrading only if an incident occurs is incorrect because defaulting to low risk and waiting for an incident means classification happens too late to prevent harm. Classifying using the vendor's marketing description of the model is incorrect because vendor marketing material is not an objective source for risk assessment.
For the exam, hold onto all five classification dimensions as the standard basis for setting risk tier.