13. Enterprise AI Strategy and Digital Transformation

Introduction and Context

Artificial intelligence has moved from isolated experimentation in laboratories and innovation teams to a strategic capability influencing how organizations compete, operate, and create value. Machine-learning systems support forecasting, recommendation, fraud detection, customer service, industrial maintenance, medical diagnosis, software development, and managerial decision-making. Yet the existence of a technically impressive model does not guarantee business value. Many AI initiatives fail because they begin with a technology rather than a clearly defined organizational problem, lack reliable data, underestimate process change, or ignore the people and governance required for sustained adoption.

Enterprise AI strategy addresses this gap. It connects organizational purpose and competitive priorities with decisions about data, algorithms, platforms, talent, investment, operating models, and risk. Digital transformation is the broader organizational process through which digital technologies alter value propositions, operating processes, structures, relationships, and capabilities. AI is therefore not synonymous with digital transformation. It is one powerful component of transformation, and its impact depends on the digital foundations surrounding it.

A strategic approach asks questions such as: Which business problems deserve AI investment? Is the required data available and usable? Should the organization build, buy, or partner? How will benefits and risks be measured? Which jobs and processes will change? Who is accountable when an AI-supported decision causes harm? These questions require technical understanding together with economic reasoning, organizational analysis, leadership, and ethical judgment.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the relationship between enterprise AI strategy and digital transformation.

2. Identify and evaluate AI opportunities using strategic, technical, economic, and ethical criteria.

3. Assess data readiness, organizational capability, and implementation feasibility.

4. Compare build, buy, and partnership approaches for AI solutions.

5. Construct a reasoned business case using value, cost, risk, and return measures.

6. Analyze process redesign, workforce effects, leadership requirements, and change-management issues.

7. Recommend governance and responsible-AI practices for enterprise deployment.

8. Apply these ideas to an industry case and make defensible strategic decisions.

From AI Experimentation to Enterprise Capability

An AI experiment usually has a limited objective, a small team, and a short time horizon. An enterprise capability is repeatable, governed, scalable, and integrated into work. The transition between the two is often more difficult than building the initial prototype. A model may perform well in a development environment but fail when data distributions change, users do not trust its recommendations, response times are inadequate, or the surrounding process cannot act on the prediction.

Enterprise AI can be understood through four interacting layers. The first is the strategic layer, which defines the organizational outcomes sought, such as lower operating cost, improved customer retention, resilience, safety, or new revenue. The second is the data and technology layer, including data architecture, computing infrastructure, models, application programming interfaces, cybersecurity, and monitoring. The third is the operating-model layer, which determines ownership, skills, workflows, decision rights, and funding. The fourth is the governance layer, which addresses legality, fairness, transparency, privacy, security, accountability, and risk management.

A weakness in one layer can undermine the others. A strong model cannot compensate for poor data governance. A well-funded platform may produce little value if business units do not adopt it. A profitable use case may be unacceptable if it violates privacy or systematically discriminates against a protected group. Strategic alignment therefore requires treating AI as a socio-technical capability rather than as a software component alone.

Important Concepts and Terminology

An AI use case is a specific application of AI to a business activity or decision. Business value is the measurable contribution of an initiative to organizational outcomes, including financial and non-financial benefits. Data readiness describes whether relevant data is available, accessible, sufficiently accurate, representative, governed, and legally usable. Model risk is the possibility that a model produces erroneous, unstable, biased, or misinterpreted results. AI maturity refers to the organization’s level of capability in strategy, data, technology, talent, processes, and governance.

A minimum viable product (MVP) is the smallest usable solution that can test a value proposition under controlled conditions. Proof of concept (PoC) demonstrates technical feasibility but does not necessarily establish operational or economic viability. Productionization is the process of integrating a model into reliable, secure, monitored business operations. MLOps comprises practices and tools for developing, deploying, monitoring, retraining, and governing machine-learning systems. Human-in-the-loop design retains meaningful human review or intervention in an AI-supported process. Responsible AI refers to the design and use of AI in ways consistent with principles such as fairness, transparency, privacy, safety, accountability, and human autonomy.

Strategic Alignment and Portfolio Choice

AI investment should begin with the organization’s strategy, not with a list of fashionable technologies. A firm pursuing operational efficiency may prioritize demand forecasting, intelligent scheduling, or predictive maintenance. A firm competing through superior customer experience may emphasize personalization, conversational service, and service recovery. A regulated institution may value compliance automation and risk reduction more than experimental revenue opportunities.

A useful alignment chain is:

Strategic objective → business capability → process constraint → AI intervention → measurable outcome.

For example, a logistics company may have the strategic objective of improving delivery reliability. The relevant capability is network planning; the process constraint is poor visibility of demand and transport capacity; the AI intervention is probabilistic demand forecasting and dynamic routing; and the outcome is improved on-time delivery with controlled transportation cost.

Organizations should manage AI initiatives as a portfolio rather than as unrelated projects. A portfolio can contain:

• Efficiency initiatives, which reduce time, waste, errors, or operating expense.
• Decision-support initiatives, which improve forecasting, diagnosis, prioritization, or risk assessment.
• Customer and employee experience initiatives, which improve responsiveness and personalization.
• Growth initiatives, which create products, services, or revenue channels.
• Capability-building initiatives, such as data platforms, reusable model services, and governance infrastructure.

Portfolio thinking recognizes that infrastructure and governance projects may not generate immediate revenue but enable later applications. It also balances short-term returns with longer-term strategic positioning.

Evaluating and Prioritizing Use Cases

A disciplined use-case assessment considers at least six dimensions: strategic importance, value potential, feasibility, risk, time to impact, and scalability. A simple scoring model may assign each dimension a rating from 1 to 5 and apply weights reflecting organizational priorities. The numerical score should support discussion, not replace judgment.

Value potential includes revenue growth, cost reduction, risk avoidance, quality improvement, speed, customer retention, employee experience, and social or environmental outcomes. Feasibility includes data availability, technical complexity, process compatibility, integration requirements, talent, and leadership sponsorship. Risk includes privacy, security, discrimination, safety, legal exposure, reputational damage, and the consequences of incorrect decisions.

The organization should distinguish between augmentation and automation. Augmentation assists a human decision-maker, whereas automation allows a system to execute an action with limited or no human intervention. Augmentation is often more suitable where decisions are complex, accountability is important, or errors have serious consequences. Automation may be justified in repetitive, high-volume, low-risk activities with clear controls.

Data Readiness and the Foundations of Scale

Data is not merely fuel for an AI model; it is an organizational asset requiring ownership, standards, and stewardship. Readiness involves more than volume. Relevant data must be sufficiently accurate, complete, timely, representative, interoperable, secure, and lawfully collected. Historical data may encode past discrimination, operational exceptions, or measurement practices that are unsuitable for future decisions.

A data-readiness assessment examines:

1. Availability: Does the necessary data exist, and can it be accessed?

2. Quality: Are values accurate, complete, consistent, and current?

3. Meaning: Are definitions and business rules shared across departments?

4. Lineage: Can the organization identify the origin, transformations, and users of data?

5. Representativeness: Does the dataset reflect the populations and situations in which the system will operate?

6. Rights and restrictions: Is collection, processing, and reuse legally and ethically permissible?

7. Operational access: Can data be delivered reliably to models and applications?

Data governance assigns accountability for data domains, quality standards, access permissions, retention, classification, and issue resolution. Master-data management can reduce conflicting records about customers, products, suppliers, or assets. Metadata and lineage help analysts and auditors understand how data has been used. These practices may appear administrative, but they directly influence model reliability and organizational trust.

Build, Buy, Partner, or Combine

The build-versus-buy decision is not simply a comparison of software prices. It concerns strategic differentiation, control, speed, capability development, risk, integration, and total cost of ownership.

Building internally may be appropriate when the capability is strategically differentiating, proprietary data provide an advantage, requirements are highly specialized, and the organization possesses the necessary expertise. It offers greater control but requires continuing investment in engineering, security, maintenance, monitoring, and talent.

Buying a packaged solution can reduce time to deployment and provide tested workflows, support, and regulatory features. It may be suitable for common functions such as document processing, customer-service assistance, or standard forecasting. However, the organization may face vendor lock-in, limited customization, opaque models, data restrictions, and recurring costs.

Partnering with a specialist, cloud provider, research institution, or systems integrator can fill capability gaps and accelerate learning. Partnership contracts should define data ownership, confidentiality, service levels, model performance, audit rights, incident responsibilities, portability, and exit arrangements.

A hybrid approach is common: an organization may buy foundational infrastructure, build domain-specific data assets and workflows, and partner for specialized components. The correct question is not “build or buy AI?” but “which parts of the value chain should the organization control, acquire, or share?”

Economics, Business Cases, and Return on Investment

AI business cases should connect assumptions to measurable outcomes. A basic net-benefit model is:

Net benefit = realized benefits − total costs − expected risk costs.

Total costs include data preparation, software or cloud services, model development, integration, cybersecurity, training, process redesign, change management, monitoring, maintenance, and eventual replacement. Expected risk costs can be represented as the probability of an adverse event multiplied by its estimated impact, although many ethical and reputational effects cannot be reduced reliably to a monetary number.

Common financial measures include return on investment (ROI), payback period, net present value (NPV), and internal rate of return (IRR). ROI can be expressed as:

ROI = (net benefit ÷ investment cost) × 100.

These measures require a credible baseline. If a forecasting system reduces inventory, the comparison must account for demand changes, supplier policies, and other interventions. Benefits should be separated into gross potential, adoption-adjusted benefit, and realized benefit. A model may be accurate, but if only 40 percent of recommendations are used, the economic effect will be correspondingly limited.

Sensitivity analysis is essential. Decision-makers should test the business case under different assumptions about adoption, model accuracy, labor savings, implementation time, and failure rates. Strategic initiatives may also create option value: a modest initial project can establish data, skills, and learning that enable future opportunities. Such value should be stated explicitly rather than hidden in exaggerated forecasts.

Process Redesign and Operating-Model Change

AI rarely creates value by being placed on top of an unchanged process. If a system predicts equipment failure but maintenance teams cannot obtain parts or schedule technicians, the prediction has limited value. Process redesign identifies where information is produced, who acts on it, what decisions are delegated, and how exceptions are managed.

A redesigned process should specify:

• the decision or task supported by AI;
• the data and prediction available at the point of action;
• the responsible human or team;
• escalation rules and override authority;
• documentation and audit requirements;
• feedback mechanisms for errors and unusual cases; and
• performance measures for both the model and the process.

The operating model must clarify whether AI capability is centralized, federated, or hybrid. A centralized center of excellence can provide standards, platforms, specialist skills, and governance. Business units contribute domain knowledge, prioritize use cases, and own outcomes. A federated model combines central enablement with local delivery. Whichever structure is selected, accountability for business results should remain clear; responsibility should not disappear behind a technology team or external vendor.

Workforce, Leadership, and Change Management

AI changes tasks, roles, authority, and skill requirements. It may eliminate some routine activities while increasing demand for judgment, relationship management, system supervision, data interpretation, and exception handling. Workforce analysis should therefore distinguish between job displacement, task transformation, job redesign, and job creation.

Employees may resist AI because they fear job loss, surveillance, loss of professional autonomy, unfair evaluation, or increased workload. Resistance is not always irrational; it can reveal defects in the proposed process or governance. Effective change management involves early participation, transparent communication, training, role redesign, pilot testing, and mechanisms for reporting errors or harmful effects.

Leadership has several responsibilities. Executives must articulate why AI matters, allocate resources beyond experimentation, model responsible behavior, and make trade-offs visible. Middle managers translate strategy into workflows and often determine whether adoption occurs. Technical leaders ensure reliability and security, while legal, compliance, human-resources, and risk leaders contribute to responsible deployment.

A mature organization develops AI literacy broadly, not only among data scientists. Users need to understand system capabilities, limitations, uncertainty, appropriate reliance, and escalation procedures. Senior leaders need enough technical literacy to challenge unsupported claims and ask whether performance metrics reflect real organizational value.

Governance, Ethics, and Responsible Deployment

AI governance establishes decision rights and controls across the system life cycle: ideation, data acquisition, development, validation, deployment, monitoring, modification, and retirement. Governance should be proportionate to risk. A recommendation engine for low-stakes content does not require the same controls as a system influencing credit, employment, health, safety, or public benefits.

Important controls include documented purpose and scope, data-protection assessments, access control, security testing, bias and fairness assessment, validation by independent reviewers, explainability appropriate to the users and decision, human oversight, incident reporting, audit trails, and periodic reassessment. Generative AI introduces additional concerns, including fabricated outputs, confidential-data leakage, copyright issues, prompt injection, and unreliable reasoning.

Fairness cannot be established by a single statistical test. Organizations must identify the relevant groups, harms, decision context, and trade-offs. Transparency may involve communicating that AI is used, explaining the principal factors influencing an outcome, and providing a meaningful route for challenge or appeal. Human oversight must be substantive rather than ceremonial: a reviewer needs authority, time, competence, and information to disagree with the system.

Regulatory obligations vary by jurisdiction and sector, but organizations should not treat compliance as the whole of responsible AI. Lawful use can still damage trust or create unacceptable social effects. Ethical review should consider autonomy, dignity, inclusion, safety, accountability, environmental cost, and the distribution of benefits and burdens.

An Illustrative Case: Meridian Mutual Insurance

Background

Meridian Mutual is a fictional regional insurer serving retail and small-business customers. Claims adjusters manually classify incoming claims, estimate severity, and route cases to specialist teams. Processing time is long, experienced adjusters are scarce, and customers receive inconsistent updates.

Situation and Problem

The executive committee proposes an AI system to classify claims, identify possible fraud, estimate initial loss, and generate customer communications. A technology vendor offers a packaged platform promising rapid deployment. The claims department supports the idea, but compliance officers are concerned about unfair treatment, explainability, and the use of historical claims data.

Analysis

The strategic objective is faster, more consistent claims service without weakening fairness or regulatory compliance. The highest-value initial use case is not fully automated claim denial. It is triage and document summarization, with adjusters retaining authority over coverage and payment decisions. Data analysis reveals inconsistent historical labels and under-representation of some customer groups. Consequently, a model trained directly on past decisions could reproduce existing patterns rather than identify legitimate risk.

The business case includes reduced administrative time, improved service-level performance, and better allocation of specialist expertise. It excludes speculative savings from staff reduction. Risks include privacy breaches, erroneous fraud flags, unequal referral rates, vendor dependence, and customer distrust.

Approach and Strategy

Meridian chooses a staged hybrid strategy. It buys secure document-processing components but builds its own claims taxonomy, evaluation datasets, workflow integration, and governance controls. A pilot is limited to two claim types with relatively low safety risk. The system provides summaries and routing recommendations; adjusters must review the source documents and record the final decision.

Before launch, Meridian establishes data-retention rules, access controls, subgroup performance tests, a human appeal process, vendor audit rights, and an incident procedure. Employees participate in design workshops and receive training on appropriate reliance. The pilot measures processing time, accuracy, override rates, customer complaints, subgroup differences, and employee workload rather than model accuracy alone.

Outcome

The pilot demonstrates operational improvement, but it also reveals that the fraud-screening component generates disproportionately more referrals for one customer segment because historical investigation practices were uneven. Meridian postpones automated fraud prioritization, corrects the dataset, and retains the function as a limited investigative signal subject to review. Document summarization and routing proceed to broader deployment because their benefits are clearer and risks are more controllable.

Learning Points

The case illustrates that strategic AI deployment requires selecting the right level of automation, distinguishing technical feasibility from organizational readiness, and treating fairness as a design and monitoring issue. It also shows why a vendor solution does not transfer accountability. The organization remains responsible for its data, decisions, workforce effects, and customer outcomes.

Common Failure Modes and Practical Safeguards

A frequent mistake is pursuing AI because competitors or vendors use persuasive language. The safeguard is to begin with a measurable business problem and a credible baseline. Another is conducting a PoC without planning integration, ownership, or funding for production. A staged life-cycle plan should be established before experimentation begins.

Organizations may also overestimate data quality, confuse correlation with causation, measure model accuracy without measuring process outcomes, or assume that deployment ends the project. Continuous monitoring is necessary because data, customer behavior, regulations, and operating conditions change. Model drift, concept drift, cybersecurity attacks, and silent degradation should be detected through predefined thresholds and review procedures.

Other failures include treating training as a one-time event, ignoring frontline knowledge, using automation to conceal process defects, and calculating benefits from untested labor assumptions. Governance can fail through excessive bureaucracy as well as insufficient control. Risk-based review, reusable documentation, and clear approval routes help maintain proportionate governance.

Current Developments and Emerging Directions

Enterprise AI is increasingly shaped by foundation models, generative AI, retrieval-augmented systems, AI agents, synthetic data, and specialized edge models. These technologies can lower the cost of experimentation and expand access to language, vision, coding, and reasoning capabilities. They also increase the importance of evaluation, provenance, access control, prompt security, human oversight, and content verification.

Organizations are moving toward AI platforms that provide reusable services for identity, data access, model deployment, monitoring, evaluation, and policy enforcement. Smaller domain-specific models may be preferred where latency, privacy, cost, or explainability matters. AI regulation and standards are developing unevenly across regions, making cross-border governance a strategic concern. Environmental considerations are also gaining importance as organizations assess energy use, hardware life cycles, and the efficiency of model choices.

The likely direction is not universal automation but more tightly integrated human-machine work. Competitive advantage will depend less on possessing a model that others can access and more on combining proprietary data, trusted processes, domain expertise, organizational learning, and responsible execution.

Best Practices for Enterprise AI Strategy

A practical strategy should:

1. Link every major AI initiative to an explicit organizational outcome.

2. Maintain a ranked portfolio rather than a collection of disconnected pilots.

3. Assess data, process, technology, talent, economics, and risk together.

4. Use small, controlled experiments with predeclared success and stop criteria.

5. Select build, buy, and partnership choices according to strategic control and total cost.

6. Measure realized business and human outcomes, not model metrics alone.

7. Redesign processes and roles before scaling automation.

8. Establish accountable owners, independent review, and continuous monitoring.

9. Involve employees, affected customers, legal experts, and domain specialists early.

10. Treat responsible AI, security, privacy, and resilience as design requirements.

Chapter Summary

Enterprise AI strategy connects artificial-intelligence initiatives with organizational purpose, capabilities, processes, economics, people, and governance. Successful transformation begins with strategically important problems and evaluates use cases through value, feasibility, risk, time, and scalability. Data readiness includes quality, meaning, lineage, representativeness, rights, and operational access. Build, buy, and partnership decisions should consider differentiation, control, speed, capability, integration, and total cost of ownership.

A credible business case uses baselines, realized benefits, adoption assumptions, risk costs, sensitivity analysis, and appropriate financial measures. AI creates value only when processes, decision rights, workflows, and workforce capabilities are redesigned. Leadership and change management are essential because AI transforms tasks and authority as well as technology. Responsible deployment requires proportionate governance, privacy and security controls, fairness assessment, explainability, human oversight, auditability, and continuous monitoring. The central strategic lesson is that enterprise AI is a socio-technical and organizational capability, not merely a model placed inside an application.

Key Terms

AI Strategy: A coordinated plan for using artificial intelligence to advance organizational objectives.

Digital Transformation: Organizational change produced by integrating digital technologies into value creation, operations, and relationships.

AI Use Case: A defined application of AI to a business activity, process, or decision.

Data Readiness: The extent to which data is available, usable, reliable, representative, governed, and legally permissible.

AI Maturity: The level of organizational capability in AI strategy, data, technology, talent, operations, and governance.

Proof of Concept: A limited demonstration that a technical idea is feasible.

Minimum Viable Product: The smallest usable solution capable of testing a value proposition.

Productionization: Integration of an AI system into reliable operational use.

MLOps: Practices for developing, deploying, monitoring, maintaining, and governing machine-learning systems.

Build-Buy Decision: Evaluation of whether to create, acquire, or obtain an AI capability through partnership.

Total Cost of Ownership: All direct and indirect costs incurred across the life of a solution.

Return on Investment: Net benefit expressed relative to the investment required.

Process Redesign: Deliberate restructuring of tasks, decisions, roles, controls, and workflows.

Human-in-the-Loop: A design in which humans retain meaningful review, intervention, or decision authority.

Responsible AI: AI designed and operated with attention to fairness, safety, privacy, transparency, accountability, and human autonomy.

Model Risk: The possibility that a model produces erroneous, unstable, biased, or misused results.

Model Drift: Decline in model performance caused by changes in data or operating conditions.

AI Governance: Structures, policies, controls, and responsibilities governing AI across its life cycle.

Review Questions

Short Answer Questions

1. Why is enterprise AI broader than the development of a machine-learning model?

2. What dimensions should be considered when prioritizing an AI use case?

3. Define data readiness and identify four of its elements.

4. Distinguish between a proof of concept and productionization.

5. Why should AI benefits be adjusted for user adoption?

Long Answer Questions

1. Explain how an organization can align AI investments with its competitive strategy and capability priorities.

2. Compare building, buying, and partnering for AI solutions, including the strategic trade-offs of each.

3. Discuss the role of process redesign and operating-model change in achieving AI value.

4. Explain how leadership and change management influence workforce adoption of enterprise AI.

5. Describe a risk-based governance approach for responsible AI deployment.

Analytical / Application Questions

1. A bank has a highly accurate loan-default model but inconsistent historical decisions and limited explanations for customers. Should it automate approval decisions, provide decision support, or postpone deployment? Justify your recommendation.

2. A manufacturer proposes predictive maintenance but has fragmented sensor data and no process for obtaining replacement parts. Analyze the readiness gaps and recommend a phased strategy.

3. An organization estimates that an AI chatbot will save 30 percent of service costs but has no baseline, adoption estimate, or plan for handling unsafe responses. Develop a framework for evaluating the proposal.

22. Multiple Choice Questions with Answers

Question 1

Which sequence best represents strategic alignment for an enterprise AI initiative?

A. Technology → vendor → model → strategy → outcome

B. Strategic objective → business capability → process constraint → AI intervention → measurable outcome

C. Data volume → algorithm → user training → organizational purpose → profit

D. Pilot → procurement → automation → governance → business problem

Correct Answer: B. Strategic objective → business capability → process constraint → AI intervention → measurable outcome

Question 2

Which condition most directly indicates strong data readiness?

A. A large dataset with unknown origins and inconsistent definitions

B. Historical data that is accurate but collected without legal permission

C. Accessible, governed, representative, sufficiently accurate, and lawfully usable data

D. A proprietary dataset that cannot be monitored after deployment

Correct Answer: C. Accessible, governed, representative, sufficiently accurate, and lawfully usable data

Question 3

Which statement best describes productionization?

A. Demonstrating that a model can run in a laboratory

B. Integrating an AI system into reliable, secure, monitored business operations

C. Purchasing a model from an external vendor

D. Increasing the size of a training dataset

Correct Answer: B. Integrating an AI system into reliable, secure, monitored business operations

Question 4

An organization should usually prefer a hybrid build-buy approach when it wants to:

A. Avoid all internal accountability for AI decisions

B. Purchase every component without customization

C. Control strategically important data and workflows while acquiring commoditized components

D. Eliminate the need for governance and monitoring

Correct Answer: C. Control strategically important data and workflows while acquiring commoditized components

Question 5

Which item is most appropriate for a realistic AI business case?

A. Potential labor savings with no adoption assumptions

B. Model accuracy without a business baseline

C. Realized benefits, implementation costs, adoption, maintenance, and expected risk costs

D. Vendor marketing estimates treated as guaranteed outcomes

Correct Answer: C. Realized benefits, implementation costs, adoption, maintenance, and expected risk costs

Question 6

Why might augmentation be preferred to full automation in a high-consequence decision?

A. It removes the need for process redesign

B. It preserves meaningful human judgment and accountability while using AI assistance

C. It guarantees that the model will be unbiased

D. It prevents the need for employee training

Correct Answer: B. It preserves meaningful human judgment and accountability while using AI assistance

Question 7

In the Meridian Mutual case, why was automated fraud prioritization postponed?

A. The vendor refused to provide document-processing software

B. The model was too slow for all insurance applications

C. Historical investigation practices produced disproportionate referrals for one customer segment

D. Customers preferred longer claims-processing times

Correct Answer: C. Historical investigation practices produced disproportionate referrals for one customer segment

Question 8

Which governance practice provides a route for a person affected by an AI-supported decision to challenge it?

A. Model compression

B. Human review and appeal procedures

C. Increasing training epochs

D. Vendor lock-in

Correct Answer: B. Human review and appeal procedures

Question 9

What is model drift?

A. The deliberate replacement of a model by a newer vendor product

B. Decline in model performance caused by changing data or operating conditions

C. A method for encrypting training data

D. A financial measure of project profitability

Correct Answer: B. Decline in model performance caused by changing data or operating conditions

Question 10

Which approach best reflects responsible enterprise AI?

A. Deploying rapidly and evaluating social effects only after complaints arise

B. Measuring model accuracy alone and assigning accountability to the vendor

C. Using proportionate controls, human oversight, monitoring, privacy protection, and clear accountability

D. Automating all repetitive work regardless of risk or employee impact

Correct Answer: C. Using proportionate controls, human oversight, monitoring, privacy protection, and clear accountability