Identify AI Adoption Risks CAIPM Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A multinational retail company is planning to deploy an AI chatbot that handles customer service inquiries. The chatbot will process personal data of customers from multiple countries, including the European Union. The legal team has flagged that the AI system must comply with GDPR requirements for data protection and cross-border data transfers. The company also plans to use a cloud service provider that stores data in a data center located outside the EU. What is the most critical legal risk the program manager must address?

   • AThe company must store all customer data on-premises in each country to avoid any cross-border transfer issues.
   • BThe company must obtain explicit consent from every customer before the chatbot processes their data, or the system cannot be deployed.
   • CThe chatbot's responses may be considered legally binding contracts, exposing the company to liability.
   • DThe cross-border transfer of personal data to a non-EU data center may violate GDPR unless appropriate safeguards are in place.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A multinational corporation is evaluating two AI projects: Project A automates invoice processing (high impact, low likelihood of failure, moderate cost), and Project B develops a customer-facing recommendation engine (medium impact, high likelihood of bias, high cost). The company has limited resources and must choose which project to prioritize for risk mitigation. Which project should be prioritized, and why?

   • AProject B, because the high likelihood of bias poses a significant ethical and reputational risk that could outweigh the lower impact of Project A.
   • BProject A, because it has lower cost and is easier to mitigate.
   • CProject A, because its high impact means failure would be more damaging to the organization.
   • DBoth projects equally, because each has its own risks that need attention.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   An AI system is trained on proprietary data that the organization does not have the right to use. Which type of risk does this present?

   • AOperational risk
   • BFinancial risk
   • CIntellectual property risk
   • DTechnical risk
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A global e-commerce company is adopting an AI system that uses customer data from multiple countries. The legal team has identified that the AI system may violate the EU's GDPR if data is transferred across borders without proper safeguards. The company also needs to comply with local data residency laws in several countries. Which mitigation strategy best addresses these legal and compliance risks?

   • ACentralize all data in the company's headquarters country to simplify management.
   • BAnonymize all customer data before processing to avoid GDPR applicability.
   • CImplement a data residency strategy that stores data in each region and uses approved transfer mechanisms like Standard Contractual Clauses for cross-border transfers.
   • DUse a single cloud provider with servers in the EU for all data.
   Reveal Solution Discussion Select an answer first