Governance, Ethics, and Responsible AI in Adoption CAIPM Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which compliance requirement is most directly associated with AI systems that process personal data of EU citizens?

   • ASarbanes-Oxley Act (SOX)
   • BChildren's Online Privacy Protection Act (COPPA)
   • CFederal Information Security Management Act (FISMA)
   • DGeneral Data Protection Regulation (GDPR)
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   At which phase of the AI lifecycle should governance considerations first be introduced?

   • AModel deployment
   • BModel retirement
   • CPost-deployment monitoring
   • DProblem definition and design
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An insurance company is using an AI model to set auto-insurance premiums. The model uses credit score as a feature. A regulator has questioned whether this is fair, because credit score may correlate with race. The company's legal team says the practice is legal under current regulations. The program manager must apply ethical principles. What is the best course of action?

   • AConduct a fairness analysis to measure disparate impact across demographic groups, then decide whether to retain or mitigate the feature.
   • BPublish a public statement explaining that the model is legal and therefore fair.
   • CKeep the feature because it is legal and improves risk prediction accuracy.
   • DRemove credit score from the model to avoid any appearance of bias, even if it reduces accuracy.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare AI program manager is deploying a clinical decision-support system that will process patient data across multiple EU member states. The system will be hosted in a public cloud with data residency options in several EU regions. The compliance team insists on meeting GDPR requirements while the engineering team wants to minimize latency by keeping data processing close to each hospital. What is the most appropriate governance action?

   • ARequire all patient data to be stored and processed only within the EU, and select cloud regions per member state to satisfy data residency while allowing cross-border transfers under GDPR adequacy.
   • BAnonymize all patient data before processing so GDPR no longer applies, eliminating the need for residency planning.
   • CUse a single cloud region outside the EU but rely on standard contractual clauses for all data transfers.
   • DStore all patient data on-premises at each hospital to avoid any cross-border transfer, regardless of cloud capabilities.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manufacturing company is adopting an AI-based predictive maintenance system. The system will recommend when to shut down equipment for servicing. The operations team is concerned about false alarms causing unnecessary downtime, while the safety team is concerned about missed failures leading to accidents. The program manager must implement a risk management process. What is the first step?

   • ADeploy the model in a shadow mode and compare its recommendations with human decisions for one month.
   • BSelect a model with the highest possible recall to minimize missed failures, regardless of false alarms.
   • CConvene a stakeholder workshop to discuss acceptable levels of false alarms and missed failures.
   • DIdentify and categorize potential risks, including safety, operational, and reputational risks, across the AI lifecycle.
   Reveal Solution Discussion Select an answer first