311 leadership learns of a deepfake robocall campaign targeting the city’s phone tree. Which risk action best responds to that external AI-related factor?

A deepfake robocall campaign targeting the city's 311 phone tree is an external AI-related threat factor. Sound AI risk management reassesses relevant AI and telephony risks and updates treatments—caller authentication hardening, staff playbooks for verifying official outreach, public guidance, and monitoring for spoofed civic messages—based on the new threat information rather than simply reassessing risks and routing deepfake reports to incident triage for citizen callback handling without updating treatments. Reassessing 311 transcription accuracy risks and updating call summarization prompts with the campaign samples fails because spoofed robocall content targets caller trust and telephony integrity, not transcription quality, so tuning summarization leaves the impersonation and fraud risk untreated. Reassessing AI and telephony risks and routing deepfake reports to incident triage for citizen callback handling stops at incident handling without updating treatments, which rejects living risk processes that must absorb intelligence and revise controls, playbooks, and monitoring. Reassessing AI telephony risks and deploying internal staff voice authentication on inbound 311 citizen calls misapplies the control because staff authentication does not authenticate external callers or stop spoofed outreach, missing the operational and fraud dimensions the reassessment should have addressed. Exam caveat: not every viral deepfake requires a full enterprise risk reset; triage by relevance to civic channels and likely resident harm. Operational check: after such intelligence, update the 311/telephony risk entry with the new threat, revised likelihood, and at least one concrete treatment change or explicit acceptance with date.