Inventorying the current state of AI systems, use cases, and processes is the first step because an organization must understand where and how generative AI is being used before it can effectively define governance, assess risks, establish ethical expectations, or apply regulatory requirements.

Within AAISM's privacy governance, consent is a lawful basis that authorizes processing of personal data for defined purposes. Its principal significance is granting the organization the authority to process user data in AI workflows in line with stated purposes and limits. While fairness (A) and security controls (C) are essential, they are distinct obligations; data subject rights such as rectification/erasure (B) exist regardless of consent and are not "enabled" by it. Therefore, the greatest significance of consent is that it legally permits processing under declared purposes and constraints.
References: AI Security Management™ (AAISM) Body of Knowledge - Privacy & Data Protection in AI; Lawful Basis and Purpose Limitation. AAISM Study Guide - Consent, Transparency, and Data Subject Rights; Privacy-by-Design Controls in AI Pipelines.

Per AAISM, an AI policy is a governance instrument that defines objectives, principles, roles, responsibilities, accountability, and control requirements for AI systems across their lifecycle. It establishes the framework within which performance, compliance, ethics, risk appetite, security, privacy, and sustainability objectives are set and operationalized. Environmental considerations (A), accuracy optimization (B), and regulatory compliance (D) are important outcomes addressed under the policy, but the primary purpose is to provide the overarching framework for objectives and controls.
References: AI Security Management (AAISM) Body of Knowledge - AI Governance Frameworks; Policies, Standards, and Procedures; Roles and Accountability in AI Programs.

AAISM emphasizes data lineage, provenance tracking, and inventory completeness as essential controls to ensure data security and accountability across all AI data life-cycle phases. This enables detection of unauthorized modifications, improper use, and compliance violations.

Employee performance ranking involves evaluating individuals and making decisions that can directly affect employment outcomes. In foreign markets, this type of processing is often subject to strict labor laws, anti-discrimination regulations, and data protection requirements, creating the highest regulatory compliance risk.