AI Regulatory Compliance CRAGE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A law firm is assessing an AI legal research tool for compliance with professional responsibility rules and data protection laws. The tool was developed by a third-party vendor. The firm wants to ensure the tool does not violate client confidentiality. Which step should the firm take?

   • ARely on the vendor's compliance certifications without further review
   • BAsk the vendor to sign a non-disclosure agreement only
   • CReview the vendor's data processing agreement and conduct a DPIA to assess risks to client data
   • DProhibit the use of any AI tools in the firm
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of identifying compliance risks in an AI system?

   • ATo understand potential legal and regulatory exposures
   • BTo increase the number of AI features
   • CTo ensure the AI system is as fast as possible
   • DTo reduce the cost of AI development
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has implemented an AI system for employee monitoring. The system is not high-risk under the EU AI Act, but it processes employee personal data and is subject to GDPR. The company wants to ensure ongoing compliance while respecting employee privacy. Which monitoring practice is most appropriate?

   • AMonitor employees' productivity metrics daily and store the data indefinitely.
   • BUse the system only during business hours and delete all data at the end of each day.
   • CRely on employee consent obtained at hiring and never revisit it.
   • DConduct regular privacy impact assessments and update them when the system's data processing changes, while providing employees with clear notices about the monitoring.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An auditor is evaluating an AI system used for loan approval. The system is high-risk under the EU AI Act and subject to GDPR. The auditor finds that the system's technical documentation is incomplete—it lacks a description of the risk management system. The company argues that the system has been operating for two years without issues. What should the auditor do?

   • AAccept the system's operational record as evidence of safety and close the audit.
   • BRecommend that the company apply for an exemption from the EU AI Act.
   • CSuggest that the company hire a third-party to certify the system retroactively.
   • DFlag the missing documentation as a compliance gap and require the company to produce the documentation before the audit can be closed.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a key step in implementing compliance measures for an AI system?

   • ARemoving all human involvement in the AI lifecycle
   • BDocumenting the compliance policies and procedures
   • CUsing only open-source AI models
   • DDisabling logging to protect privacy
   Reveal Solution Discussion Select an answer first