Following significant regulatory changes, what is the recommended organizational action?

• A. Suspend policy updates until further notice
• B. Conduct a periodic review of AI policies
• C. Delegate all decisions to external consultants
• D. Publish a public summary without updates

Answer: (B)

When regulatory changes occur, the best practice is to conduct a periodic review of AI policies. This approach keeps governance documents, controls, and procedures up to date with new requirements, helping to ensure ongoing compliance and effective risk management. A structured review allows you to update data handling rules, model risk management, accountability structures, monitoring practices, and related training, while assigning owners to implement and verify changes. Regular reviews also promote consistency across policies and make evidence of compliance more reliable and auditable.

Suspending policy updates leaves you vulnerable to noncompliance and gaps in controls. Delegating all decisions to external consultants erodes internal accountability and may fail to reflect your organization’s risk tolerance and context. Publishing a public summary without updates can mislead stakeholders by signaling compliance that hasn’t been achieved in practice.