Acceptance criteria
Surface the use cases and teams that require additional training on safe usage principles.
Why it matters
Repeat exposure and under-use point to where risk reduction or enablement will pay off.
How to verify
High-risk use cases and the associated users are identified in a pilot.
OWASP adoption context
Risky use and repeat exposure patterns can appear across the listed employee AI settings; low use is not itself proof of risk or failure.
Framework mappings
Team-level risky-use and recurring-exposure patterns provide findings for usage monitoring, AI-risk tracking and evaluation against responsible-use/security objectives. Under-use alone is an enablement signal rather than a security anomaly; assessment and intervention remain necessary beyond surfacing patterns. ISO/IEC 27001: Confirm the need for monitoring and choose the interventions to apply.
Observed risky-use and recurring-exposure patterns provide ongoing operational-monitoring findings for in-scope AI systems or controls. Under-use alone is an enablement signal; surfacing patterns does not establish responsible-use objectives or complete assessment and intervention.