AI Regulatory Compliance CRAGE Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A European healthcare startup is developing an AI system that triages patient messages and assigns urgency levels. The system will process personal health data of EU residents. The compliance lead wants to ensure the system meets both the EU AI Act and GDPR requirements from the start. Which combination of actions best addresses the core requirements of both regulations?

   • AConduct a data protection impact assessment (DPIA) and classify the system as high-risk under the EU AI Act, then implement a risk management system and technical documentation.
   • BObtain explicit consent from each patient and publish a public statement that the AI system is compliant with the EU AI Act.
   • CAnonymize all patient data before processing and register the system with the national data protection authority to avoid GDPR obligations.
   • DUse a third-party AI vendor that claims GDPR compliance and rely on the vendor's certification to cover all regulatory obligations.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A social media company is deploying an AI content moderation system. The system is used to remove harmful content. The company operates globally. Which regulatory framework is most directly applicable to the AI system's decision-making?

   • AThe EU AI Act's transparency and risk management requirements for AI systems
   • BThe GDPR's right to be forgotten only
   • CThe Digital Services Act, but only for user data, not AI decisions
   • DThe NIST AI RMF as a legally binding standard
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A multinational company is auditing an AI system used for resume screening. The system is deployed in the EU and is considered high-risk under the EU AI Act. The audit team discovers that the system's training data includes personal data of EU citizens that was collected without a lawful basis. The team must decide how to proceed. Which action is most appropriate?

   • AReport the issue to the EU AI Act authority but continue operations.
   • BStop using the system immediately, document the finding, and work with the data protection officer to determine a lawful basis or remove the affected data.
   • CRetrain the model using only synthetic data, but keep the original data in storage.
   • DContinue using the system but add a disclaimer to the privacy policy.
   Reveal Solution Discussion Select an answer first
5. 49expert · medium

   A technology company is developing an AI system for autonomous vehicles. The system will be deployed in the EU and the US. The company must ensure compliance with the EU AI Act and US federal regulations. The company has a team of compliance experts but limited time before the product launch. Which approach is most effective?

   • ADelay the product launch until all regulations are harmonized
   • BConduct a gap analysis between EU AI Act and US regulations, and design the system to meet the stricter requirements where they overlap
   • CComply only with US regulations because the EU AI Act is not yet fully enforced
   • DComply only with EU AI Act because it is more comprehensive
   Reveal Solution Discussion Select an answer first