An AI system was reviewed and approved at launch eighteen months ago and has not been reviewed since. Governance documentation is complete and accurate as at the launch date. What is the deficiency?

• AThere is none, provided no code has changed since approval.
• BThe documentation should have been published externally as well as held internally.
• CThe system needs recertification against ISO 42001 annually.
• DThere is no review cadence, so drift, data shift and provider model updates have gone unexamined.