An organization's AI governance framework requires that all AI systems have an 'AI System Owner' accountable for the system's lifecycle. A recently acquired subsidiary has 23 AI systems but has not assigned owners. What is the FIRST governance action the parent organization should take?

B is correct because meaningful ownership assignment requires understanding what each system does and who is accountable for its business function. The first action is assessment and understanding, followed by risk-prioritized ownership assignment—highest-risk systems first. A (shutting down) is disproportionate and would harm business operations without justification. C (CTO as temporary owner) creates nominal ownership without accountability or capacity to manage 23 systems; the CTO is unlikely to have the business domain knowledge for all 23 systems. D (external consultant before ownership) delays an action that can be initiated internally.