3.4 Explain AI Governance Considerations (policy, Risk Management, Compliance) AI-TECHNICAL-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An insurance company is using an AI model to set premiums. The model is a complex deep learning system that performs well on historical data but is difficult to interpret. Regulators have asked the company to explain how premiums are calculated. Which action best addresses this regulatory concern?

   • AProvide the regulator with the model's source code and training data.
   • BImplement a model interpretability tool to generate explanations for individual premium decisions.
   • CReplace the deep learning model with a simpler linear regression model that is inherently interpretable.
   • DHire a third-party auditor to certify the model's fairness.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A tech company is developing an AI assistant that can generate code. The company is concerned about the risk of the assistant generating insecure code that could be used in production. The development team wants to ship the feature quickly, but the security team wants a thorough review. Which governance decision best balances speed and security?

   • ACancel the project because the security risk is too high.
   • BShip the assistant without any warnings to maximize user adoption.
   • CDelay the launch until the assistant can be proven to generate only secure code.
   • DDeploy the assistant with a warning that generated code must be reviewed by a human developer before use.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A global e-commerce company is developing an AI recommendation system. The company operates in multiple countries with varying data protection laws. The policy team must create a single AI policy that is compliant across all jurisdictions. The policy must address data handling, user consent, and algorithmic transparency. What is the most effective approach?

   • AFollow the laws of the country where the company is headquartered.
   • BUse a minimal policy that meets the lowest common denominator.
   • CAdopt the most stringent data protection requirements from any jurisdiction as the global standard.
   • DCreate separate policies for each country to address local laws.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A hospital deploys an AI triage system that recommends patient priority levels. During a review, the data science team discovers the model was trained on historical records that under-represent minority ethnic groups, producing biased recommendations. The hospital's governance committee must decide the immediate next step to manage this risk while continuing to use the system. What should they do first?

   • AContinue using the system but add a disclaimer to the output that results may be biased.
   • BSuspend the system and conduct a formal risk assessment to document the bias and determine mitigation options.
   • CDelete the model and revert to manual triage permanently.
   • DRetrain the model immediately with a more balanced dataset and redeploy it without further review.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare AI startup is developing a diagnostic tool that will process patient data from EU citizens. The startup is based in the US and plans to store data in a US cloud. The legal team warns that this arrangement may violate GDPR. What is the most appropriate compliance action?

   • AStore the data in the EU but allow US employees remote access.
   • BConduct a Data Protection Impact Assessment (DPIA) and implement appropriate safeguards for the international data transfer.
   • CIgnore the warning because the startup is not an EU company.
   • DAnonymize all patient data before processing so GDPR does not apply.
   Reveal Solution Discussion Select an answer first