A permitting office wants assurance that chatbot owners keep AI security controls current. Which program cadence best supports that goal?

Establishing a quarterly AI control attestation process for chatbot owners managed under the security program is the accountability mechanism that keeps AI security visible to leadership. Quarterly attestation means: chatbot owners certify in writing that their assigned controls (access logging, model monitoring, escalation procedures) are in place and functioning, and the security program reviews those attestations, investigates gaps, and escalates unresolved deficiencies to senior leadership. This creates a formal audit trail and forces owners to confront problems they might otherwise hide. Quarterly cadence allows progress and re-assessment; annual cycles are too slow for AI systems that drift quickly.

Relying on a quarterly AI awareness newsletter distributed by the communications team creates no accountability: chatbot owners can read about AI without certifying that controls are in place, incidents go unreported to security, and leadership has no verified visibility into whether controls are actually current. A quarterly vulnerability review meeting for chatbot infrastructure led by IT operations staff has the same gap as no owner attestation: it examines infrastructure rather than the owner's assigned AI security controls, and nothing requires the owner to certify or remediate missing controls, so gaps go unfixed. An annual vendor SOC 2 report review coordinated through the procurement office is a governance gap: it evaluates suppliers, not the chatbot owner's in-scope controls, and its once-a-year cadence cannot confirm that owner-operated AI security controls stay current as models drift. Attestation must include a consequence: if a control is missing, the owner must fix it or escalate risk to the governance committee.

Operational check: publish a quarterly AI control attestation form listing required controls (access logging enabled, monthly model accuracy check, escalation procedures tested), have each chatbot owner sign it and submit it to the security program, and establish a process: (1) the security program reviews attestations monthly, (2) any 'no' answer triggers an investigation, (3) unresolved deficiencies escalate to the AI steering committee by the end of the quarter.