A 45-person software company uses a generative AI service to draft customer appointment reminders. It has no AI policy or dedicated AI staff but runs security and privacy reviews. It has moderate risk tolerance and wants to ship quickly.
Which governance approach is MOST appropriate?
- A
Appoint a chief AI officer and an external ethics board.
- B
Name an accountable executive and add AI use cases to existing reviews.
- C
Make ISO/IEC 42001 certification its first AI milestone.
- D
Pause new AI features until a formal AI risk framework is adopted.


