In the context of an AI implementation, which of the following actions is MOST critical for an organization's change management program?

A comprehensive, AI-specific risk assessment is the most critical foundational action within a change management program for AI implementation. AI systems introduce unique and complex risks, such as algorithmic bias, model drift, data poisoning, and lack of explainability, which differ significantly from traditional IT systems. Conducting a risk assessment allows the organization to identify, analyze, and evaluate these potential negative impacts before a change is deployed. This proactive step informs all other change management activities, including the level of scrutiny required, testing protocols, stakeholder communication, and the necessary governance approvals, ensuring the change is managed effectively and responsibly.

A. Ensuring the organization has a dedicated AI governance committee: This establishes an oversight structure, which is crucial for strategy, but it is not a direct action within the change management process for a specific implementation.

B. Reviewing documentation for AI system changes, updates, and patches: This is a necessary procedural step in change management, but the risk assessment (C) determines the critical areas to scrutinize within that documentation.

D. Verifying that all employees have completed mandatory AI ethics training: While important for user adoption and responsible use, training is a supporting activity and does not address the core technical and operational risks of the system change itself.

1. ISACA. (2023). Auditing Artificial Intelligence. The document emphasizes a risk-based approach throughout the AI lifecycle. Section 3

"AI Governance and Risk Management

" highlights that "a risk management process should be established to identify

assess

manage

monitor and communicate AI risks" (p. 21)

which is the core of any change management activity for AI.

2. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). The entire framework is predicated on the continuous identification and management of AI-specific risks. The "MANAGE" function specifically calls for allocating risk management resources and actions based on assessed risks (p. 22

Section 4.3).

3. Mittelstadt

B. (2019). Principles alone cannot guarantee ethical AI. Nature Machine Intelligence

1(11)

501-507. https://doi.org/10.1038/s42256-019-0114-4. This article underscores that principles (like those taught in ethics training) are insufficient without concrete governance and risk assessment processes to translate them into practice during development and deployment (i.e.

change).