To reinforce organization-wide ethical norms and risk recognition, which of the following is MOST important to integrate into AI user training?

Effective AI user training must go beyond policy acknowledgment and compliance instruction to

equip employees with the practical skills needed to identify ethical risks and report them

appropriately. This builds an active risk-aware workforce.

Why B is Correct: The ISACA AAIR framework identifies that training on ethical risk indicators and

reporting mechanisms directly reinforces ethical norms by enabling employees to recognize real-

world signs of AI misuse, bias, or harmful outputs. When staff can identify specific risk signals and

know how to escalate them, the organization builds a proactive risk culture grounded in practical

ethical literacy.

Why A is Wrong: Acceptable use policy acknowledgment is a compliance activity, not a culture-

building measure. Acknowledging a document does not ensure employees understand how to apply

ethical principles in practice.

Why C is Wrong: Cyber threat identification addresses security risk, which is narrower than the full

scope of ethical AI risk. Security training does not develop ethical judgment regarding fairness, bias,

or societal impact.

Why D is Wrong: Regulatory compliance checklists address legal obligations but do not develop the

ethical reasoning and risk recognition skills needed to reinforce organizational norms.