Question

A risk practitioner learns of an emerging technology risk related to generative AI tools being adopted informally across several business units. The threat is not yet well understood, no loss events have occurred, and the potential impact is highly uncertain. Senior management is pressing for an immediate decision on how to respond. What should the practitioner recommend FIRST?

Accepted Answer

Establish monitoring mechanisms and gather intelligence to better characterize the emerging risk before selecting a response

Answer

Immediately implement a technical control that blocks all generative AI tools across the enterprise

Answer

Formally accept the risk since no loss events have occurred and impact is uncertain

Answer

Transfer the risk to a cyber insurance provider to cover any future AI-related losses