A company's AI governance policy requires all AI systems to have documented 'intended use' and 'out-of-scope use' definitions. Which risk does this documentation most directly mitigate?

Why D is correct

Documenting intended and out-of-scope uses (required by model cards, EU AI Act technical documentation under Article 11, and ISO 42001) directly mitigates the risk that deployers or end users apply an AI system in contexts where it was not validated. Models often perform poorly outside their training distribution - a diagnostic AI trained on adult patients may perform unreliably on pediatric cases. Explicit out-of-scope documentation guides deployers and creates accountability when systems are misused. Prompt injection, poisoning, and credential theft are security threats addressed by different controls.