AI Regulatory Compliance CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A logistics company has deployed an AI system for route optimization. The system is not high-risk under the EU AI Act, but it processes driver location data, which is personal data under GDPR. The company wants to implement ongoing compliance monitoring. Which measure is most effective?

   • AEstablish a regular review cycle that checks the system's data processing against the company's records of processing activities (RoPA) and updates them as needed.
   • BAsk drivers to sign a consent form once a year.
   • CSet up an automated alert that notifies the IT team if the system's CPU usage exceeds 80%.
   • DConduct a one-time privacy impact assessment and then archive it.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of ongoing monitoring in AI regulatory compliance?

   • ATo increase the system's processing speed
   • BTo ensure the AI system continues to meet regulatory requirements over time
   • CTo reduce the need for human oversight
   • DTo automate all compliance decisions
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A tech company is developing an AI system that recommends personalized news articles. The system is not high-risk under the EU AI Act, but the company operates in multiple jurisdictions with varying data protection laws. The compliance team is assessing regulatory compliance risks. Which risk is most important to address?

   • AThe system may recommend articles that some users find offensive.
   • BThe system may use too much cloud storage, increasing operational costs.
   • CThe system may not be fast enough to deliver real-time recommendations.
   • DThe system may process personal data in ways that violate GDPR's principles of data minimization and purpose limitation.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A tech startup is developing a chatbot that provides mental health advice. The chatbot uses generative AI and interacts with users. The startup is based in the EU and targets EU users. Which compliance risk should the startup address FIRST?

   • AEnsure the chatbot complies with GDPR for processing health-related data and with the EU AI Act's transparency obligations
   • BConduct a cybersecurity penetration test only
   • CRegister the chatbot as a medical device with the FDA
   • DObtain a patent for the chatbot's algorithm
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is deploying an AI system for hiring that uses facial analysis to assess candidates' emotions. The system is deployed in the EU and is prohibited under the EU AI Act because it infers emotions in the workplace. The company also processes candidate data under GDPR. What should the company do?

   • AStop using the system immediately and remove it from the hiring process.
   • BObtain explicit consent from candidates and continue using the system.
   • CConduct a DPIA and argue that the system's benefits outweigh the risks.
   • DModify the system to use only audio analysis instead of facial analysis.
   Reveal Solution Discussion Select an answer first