Identify three AI-specific risk categories CPMAI requires in risk registers.

Identify three AI-specific risk categories CPMAI requires in risk registers.

• A. Financial risk, market risk, regulatory risk.
• B. Reputational risk, talent risk, vendor risk.
• C. Data risk (quality/privacy), model risk (bias, reliability), and operational risk (availability, security, governance).
• D. Model drift risk, latency risk, environmental risk.

Answer: (C)

In CPMAI risk management, AI risk registers focus on three AI-specific risk areas: data risk, model risk, and operational risk. Data risk covers data quality and privacy, as well as data governance, because the outputs of an AI system hinge on the inputs it receives. If data quality is poor or privacy controls are weak, the model can produce unreliable or harmful results, making it essential to monitor and address this risk. Model risk centers on bias, reliability, and overall behavior of the AI model. Even a well-trained model can behave unexpectedly, produce biased outputs, or fail under certain conditions, so capturing how trustworthy and robust the model is—along with how it’s tested and validated—is critical for risk control. Operational risk looks at how the AI system is deployed and managed in the real world—availability, security, governance, monitoring, and incident response. This ensures that the system remains secure, performantly available, and properly governed throughout its lifecycle. Other risk groupings, like financial or regulatory risks, may be important for broader governance but they don’t capture the three AI-specific risk domains CPMAI prioritizes. Likewise, while issues like model drift or latency can arise, the three foundational categories above—data, model, and operational risk—provide a comprehensive framework for identifying and mitigating AI-related risks in risk registers.

In CPMAI risk management, AI risk registers focus on three AI-specific risk areas: data risk, model risk, and operational risk. Data risk covers data quality and privacy, as well as data governance, because the outputs of an AI system hinge on the inputs it receives. If data quality is poor or privacy controls are weak, the model can produce unreliable or harmful results, making it essential to monitor and address this risk.

Model risk centers on bias, reliability, and overall behavior of the AI model. Even a well-trained model can behave unexpectedly, produce biased outputs, or fail under certain conditions, so capturing how trustworthy and robust the model is—along with how it’s tested and validated—is critical for risk control.

Operational risk looks at how the AI system is deployed and managed in the real world—availability, security, governance, monitoring, and incident response. This ensures that the system remains secure, performantly available, and properly governed throughout its lifecycle.

Other risk groupings, like financial or regulatory risks, may be important for broader governance but they don’t capture the three AI-specific risk domains CPMAI prioritizes. Likewise, while issues like model drift or latency can arise, the three foundational categories above—data, model, and operational risk—provide a comprehensive framework for identifying and mitigating AI-related risks in risk registers.