An organization's AI policy states that AI systems must comply with 'applicable laws and regulations.' A risk manager notes this language is insufficient for an effective AI governance policy. What specific gap does this general language create?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because 'applicable laws and regulations' without specificity provides no actionable guidance—employees don't know which laws apply, who monitors for new regulations, or how to assess compliance. Effective policy names specific applicable frameworks, assigns monitoring responsibilities, and establishes compliance assessment processes.
Full explanation below image
Full Explanation
B is correct because 'applicable laws and regulations' without specificity provides no actionable guidance—employees don't know which laws apply, who monitors for new regulations, or how to assess compliance. Effective policy names specific applicable frameworks, assigns monitoring responsibilities, and establishes compliance assessment processes. A is incorrect; legal enforceability of a policy is an internal governance concern, not a statute citation issue. C (definition of AI system) is also a valid gap but is not the gap identified in the specific language criticized. D (enforcement mechanisms) is a separate policy element, though also important; the question asks about the gap in the specific language cited.