Which of the following is the GREATEST risk when an organization lacks clearly defined accountability mechanisms for AI outputs and decisions?

AI systems make decisions that can affect individuals, organizations, and society. When no individual or function is clearly accountable for those decisions, the organization cannot demonstrate due diligence, remedy harms, or mount a coherent legal defense when challenged. Why D is Correct: The ISACA AAIR framework identifies legal liability as the greatest organizational risk from absent accountability mechanisms. When AI outputs cause harm—discriminatory lending decisions, unsafe autonomous vehicle actions, inaccurate medical diagnoses—the absence of documented accountability makes it impossible to demonstrate responsible governance to courts, regulators, and affected parties. This creates maximum legal exposure across contract, tort, and regulatory law. Why A is Wrong: Intellectual property exposure is a significant risk in AI contexts (particularly around training data and model weights) but is not primarily caused by absent accountability mechanisms. IP risk arises from access controls and contractual protections. Why B is Wrong: Ineffective model training is a technical quality issue. While accountability for model development may influence training quality, ineffective training is not the primary risk from absent accountability for outputs and decisions. Why C is Wrong: Reduced availability is an operational resilience concern. Accountability gaps do not directly cause availability failures, which are driven by architectural and operational factors.