A technology company is developing a strategic artificial intelligence (Al)-driven application that has high potential business value. At what point should the enterprise risk profile be updated?

Updating the risk profile after UAT is too late, as significant risks should have been identified and considered much earlier in the project lifecycle before substantial investment.

The approval of a business case signifies the formal decision to proceed with a project, committing organizational resources and accepting the inherent strategic, operational, and financial risks. At this point, the potential impact of the new AI application, including its associated risks and opportunities, becomes a tangible factor that must be incorporated into the overall enterprise risk profile to ensure a comprehensive and up-to-date view of the organization's risk landscape.

User stories are developed early in the design phase, but before the business case is formally approved, the project's strategic commitment and resource allocation are not yet solidified to warrant an enterprise-level update.

A post-implementation review evaluates the project's success and remaining risks after it's already live, which is too late for proactive enterprise risk profile management regarding the initial decision to pursue the initiative.