What should organizations do to manage AI-related risks?

• A. Establish policies and procedures addressing IP-related concerns and ensure lawful data sourcing.
• B. Focus only on model accuracy.
• C. Avoid documenting data lineage.
• D. Hire external auditors only after incidents.

Answer: (A)

At the heart of AI risk management is putting formal governance in place that covers how data is sourced and used, including intellectual property and licensing considerations. Establishing policies and procedures ensures that training data is acquired lawfully, properly licensed, and used in ways that respect IP rights and privacy. This proactive framework helps prevent legal exposure, data misuse, and compliance failures, while also clarifying roles, responsibilities, and controls for ongoing monitoring and accountability.

Focusing only on model accuracy ignores these broader risks and can leave IP, licensing, data provenance, and governance gaps unaddressed. Not documenting data lineage hampers traceability and auditability, making it difficult to prove that data rights were respected or to identify sources of potential issues. Waiting to hire external auditors only after incidents is reactive; effective AI risk management uses proactive assurance, continuous monitoring, and governance reviews to reduce risk before problems arise.