Within the ISACA Advanced in AI Risk framework, program management connects risk identification, control selection, treatment, monitoring, resilience, third-party oversight, and reporting to enterprise risk objectives. When ethical and legal exposures exceed tolerance and the AI system is non-critical, avoidance is the most proportionate response. Acceptance is inappropriate above tolerance, transfer cannot remove all accountability, and mitigation is suitable only if effective controls can reduce exposure sufficiently. This makes option D, Avoidance, the strongest answer. The other choices describe narrower technical, operational, performance, or administrative considerations and do not address the primary risk-management objective in the scenario as directly. A risk practitioner should select the response that most effectively reduces the stated exposure while preserving appropriate oversight, traceability, and alignment with organizational risk tolerance and business requirements.