In AI governance, what is the purpose of risk management?

• A. To integrate AI risks into the enterprise risk register and manage ethical, security, and reputational risks.
• B. To replace all regulatory oversight.
• C. To outsource risk management to vendors.
• D. To ignore ethical concerns.

Answer: (A)

In AI governance, the aim is to bring AI-related risks into the organization’s overall risk management program, so they are identified, assessed, and mitigated as part of enterprise risk governance. This approach treats AI risk like other business risks, ensuring there is visibility, ownership, and ongoing monitoring. It also explicitly includes ethical considerations (such as bias and fairness), security concerns (like data protection and system integrity), and reputational risks (trust and public perception). Embedding AI risks in the risk register and governance processes helps leaders set risk appetite, implement controls, and track effectiveness throughout the AI lifecycle, aligning risk response with strategic objectives and regulatory expectations.

Replacing regulatory oversight, outsourcing risk management, or ignoring ethics would undermine accountability and the holistic protection that proper AI governance requires.