An organization's AI policy states that AI systems must comply with 'applicable laws and regulations.' A risk manager notes this language is insufficient for an effective AI governance policy. What specific gap does this general language create?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — 'applicable laws and regulations' is too vague to guide anyone. You need to name the specific legal frameworks that apply, say who monitors regulatory changes, and spell out how new AI deployments get assessed against those requirements.
Full Explanation
The correct point is that 'applicable laws and regulations' without specificity provides no actionable guidance—employees don't know which laws apply, who monitors for new regulations, or how to assess compliance. Effective policy names specific applicable frameworks, such as the EU AI Act, GDPR, and sectoral regulations, assigns accountable parties for monitoring regulatory changes, and establishes processes for assessing new AI deployments against specific requirements. The claim that the policy is legally unenforceable because it does not cite specific statute numbers is incorrect; legal enforceability of a policy is an internal governance concern, not a statute citation issue. The gap about lacking a definition of 'AI system' is also a valid gap but is not the gap identified in the specific language criticized. The gap about not establishing enforcement mechanisms or penalties for non-compliance is a separate policy element, though also important; the question asks about the gap in the specific language cited.