Which statement best summarises how AI risk identification should be approached across a system's lifecycle?

The correct statement is that regulatory, ethical, operational, and reputational risks should all be identified, both before deployment and continuously during it. Each risk category tracks a different kind of failure, and each can emerge at a different point in the lifecycle, so a complete practice covers all four categories and continues past the launch gate. The view that a single risk category, chosen based on the industry, is sufficient is incorrect because no single category, however dominant for a given industry, substitutes for the others; a system can fail on a category no one expected. The view that risk identification is complete once a pre-launch checklist has been signed off is incorrect because conditions after launch can introduce risks a pre-launch checklist could not have captured. The view that risk identification should be triggered only by an external event, such as a regulatory inquiry or a public complaint, is incorrect because it makes identification reactive rather than proactive, allowing harm to occur before it is assessed. For the exam, be ready to name all four categories and both time windows together.