A housing authority tracks AI risks for tenant tools. Which practice best oversees AI risk within the enterprise risk lifecycle?

Overseeing AI risk across the enterprise lifecycle means AI risks for tenant tools appear in the enterprise risk register alongside other material housing-authority risks. Mapping them there gives board and executive oversight visibility into enterprise impact, owners, treatments, and review cadence, instead of logging AI risks in the enterprise risk register at intake so approval records replace ongoing oversight, where they never receive lifecycle review where funding and accountability decisions are made.

Logging AI risks in the enterprise risk register at intake so approval records replace ongoing oversight creates a point-in-time record that bypasses lifecycle governance and hides changing exposure. Reviewing AI risks in the enterprise risk register at procurement so vendor terms define enterprise impact ignores that AI risks are enterprise risks, not merely vendor terms, and can still harm tenants and the authority's mission. Tracking AI risks in the enterprise risk register as model tasks so sprint metrics shape lifecycle oversight lets delivery velocity stand in for governance and prevents aggregation, prioritization, and consistent treatment across properties and programs.

Exam caveat: enterprise registration does not require every trivial chatbot tweak to go to the board; use materiality thresholds so the register stays actionable. Operational check: confirm each production tenant-facing AI system has a risk register ID, owner, residual rating, and next review date aligned with the authority's enterprise risk calendar.