AI Regulatory Compliance CRAGE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An insurance company is conducting a compliance audit of its AI-based claims processing system. The system is subject to GDPR and is considered high-risk under the EU AI Act. The audit team has limited time and must prioritize audit activities. Which activity should be prioritized first?

   • AReview the marketing materials to ensure they do not overstate the AI system's capabilities.
   • BCheck the system's uptime and response time over the past year.
   • CVerify that the system's technical documentation is complete and up to date, including the risk management system description.
   • DInterview the claims adjusters to see if they trust the AI system's recommendations.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A multinational corporation is auditing its AI HR system that screens job applicants. The system was developed in-house and uses historical hiring data. The audit team finds that the system has a disparate impact on certain demographic groups. The company is subject to GDPR and various anti-discrimination laws. The audit team must decide on a remediation plan. Which plan is most appropriate?

   • ADocument the disparate impact, conduct a root-cause analysis, and implement a remediation plan that includes retraining the model and ongoing bias monitoring
   • BAdjust the system's decision thresholds to achieve demographic parity without retraining
   • CReport the finding to the data protection authority and take no further action
   • DImmediately delete the system and all applicant data to avoid liability
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Why is AI regulatory compliance important for organizations deploying AI systems?

   • AIt eliminates the need for human oversight of AI
   • BIt ensures AI systems are faster than human workers
   • CIt guarantees that AI systems will be profitable
   • DIt helps avoid legal penalties and builds stakeholder trust
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A European healthcare provider is deploying an AI system that triages patient messages and assigns urgency levels. The system processes personal health data and will be used in clinical workflows. The compliance team is mapping applicable requirements. Which combination of regulatory obligations must the team prioritize?

   • AOnly GDPR, because the system is not a standalone medical device
   • BGDPR data protection principles and the EU AI Act's risk classification for high-risk AI systems
   • COnly the EU AI Act transparency obligations, since the system is an AI system
   • DNIST AI RMF and ISO/IEC 42001, as these are legally binding in the EU
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A multinational corporation is deploying an AI system for employee performance evaluation. The system will be used in the EU, where it may be considered high-risk under the EU AI Act. The company also has operations in countries without specific AI laws. The compliance team is deciding how to approach compliance. Which approach is most appropriate?

   • AApply the EU AI Act requirements to the system globally, as a baseline for responsible AI governance.
   • BComply only with the local laws of each country where the system is deployed.
   • CAvoid deploying the system in the EU to sidestep the EU AI Act.
   • DWait for the EU AI Act to be fully enforced before taking any action.
   Reveal Solution Discussion Select an answer first