AI Regulatory Compliance CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A manufacturing company uses an AI system for predictive maintenance on factory equipment. The system is not high-risk under the EU AI Act but processes some personal data of employees. The company wants to implement ongoing compliance monitoring. Which measure is most appropriate?

   • AOnly monitor the system when there is a data breach
   • BDelete all employee data to avoid compliance obligations
   • CEstablish a monitoring plan that includes regular data protection reviews and periodic model performance checks
   • DStop monitoring because the system is not high-risk
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A multinational company is deploying an AI recruitment tool that screens job applicants. The tool is being considered for use in the EU, where it may be classified as high-risk under the EU AI Act. The compliance team is identifying regulatory compliance risks. Which risk is most directly tied to the EU AI Act's requirements for high-risk AI systems?

   • AThe tool's cloud provider may store data in a region outside the EU, raising data residency concerns.
   • BThe training data may contain historical biases that lead to discriminatory hiring decisions.
   • CThe tool may have a longer response time than expected, affecting user experience.
   • DThe development team may not have enough budget to retrain the model monthly.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An auditor is assessing an AI system used for credit scoring. The system is high-risk under the EU AI Act and subject to GDPR. The auditor finds that the system's bias monitoring is inadequate—it only checks for bias at deployment, not continuously. The company argues that the system's performance has been stable. What should the auditor recommend?

   • AConduct a one-time bias audit and document it in the technical file.
   • BImplement continuous bias monitoring that runs on a schedule and triggers alerts when bias metrics exceed thresholds.
   • CAccept the stable performance as evidence that bias is not a concern.
   • DRecommend that the system be decommissioned because bias monitoring is too complex.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A hospital is implementing an AI system to predict patient readmission risk. The system uses electronic health records. The hospital's compliance officer is concerned about potential discrimination against certain patient groups. Which risk mitigation strategy is most effective?

   • ARely on the model's overall accuracy as proof of fairness
   • BExclude all demographic data from the model to ensure fairness
   • CUse a more complex model to improve prediction accuracy
   • DConduct a bias audit on the model's predictions across demographic groups and adjust the model if disparities are found
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which framework provides a voluntary, risk-based approach to managing AI risks and is developed by a U.S. government agency?

   • AEU AI Act
   • BGDPR
   • CISO/IEC 42001
   • DNIST AI RMF
   Reveal Solution Discussion Select an answer first