An AI product team argues that their machine learning model does not need governance oversight because it is a 'recommendation system,' not a decision-making system. How should the AI risk manager respond?

The correct answer is that governance applicability depends on the practical impact of recommendations, not their label; if recommendations have a material influence on consequential decisions, they require appropriate oversight. A recommendation that is almost always accepted has functionally the same impact as a binding decision, and must be governed accordingly. Many AI risks, such as bias, drift, and error propagation, are present regardless of whether outputs are labeled as recommendations or decisions. The option that agrees because recommendation systems are advisory by nature and carry no liability for outcomes is incorrect; advisory systems can still cause harm and create liability. The option that applies governance controls only to the downstream decision, not to the recommendation model itself, ignores the upstream risk in the recommendation model itself. The option that requires the team to formally document that the system is advisory to limit the organization's liability addresses legal liability cosmetically, not the underlying risk.