The lack of discretionary access control is the greatest concern because unauthorized access to the AI system or its underlying data could compromise patient confidentiality, violate healthcare privacy regulations, and undermine the integrity and reliability of pre-diagnosis outcomes.

Regular security assessments help organizations discover and assess the extent of shadow IT, which includes unauthorized systems, applications, and devices that employees may be using without formal approval. Identifying these systems is the first step in mitigating the associated risks, such as data breaches, non-compliance, and security vulnerabilities.
While policies prohibiting unauthorized systems, employee training, and providing access to approved systems are important, they alone may not be enough to detect or prevent the use of shadow IT. Regular assessments provide a proactive and ongoing approach to identifying and mitigating risks associated with unauthorized technology use.

The best approach is to establish a clear AI acceptable use policy that defines how employees may use AI tools while protecting sensitive information and intellectual property. This ensures governance while enabling safe adoption.
Option B: Reactive and punitive, not proactive governance.
Option C: Monitoring helps but is insufficient alone.
Option D: Overly restrictive and may block beneficial AI use.
Option A: Correct - policies provide structured guidance aligned with business objectives and risk management.