AI Regulatory Compliance CRAGE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a typical first step in assessing an AI system for regulatory compliance?

   • ATraining the model on more data
   • BDeploying the system to production
   • CIdentifying applicable regulations and standards
   • DDeleting all training logs
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company has deployed an AI chatbot that handles customer service inquiries. The chatbot is not high-risk under the EU AI Act, but it processes personal data and is subject to GDPR. The company wants to implement ongoing monitoring but has a small compliance team. Which monitoring strategy is most efficient?

   • AConduct a comprehensive manual audit every six months.
   • BAutomate the logging of data processing activities and integrate them with the company's existing privacy management platform to generate compliance reports.
   • CSet up a monthly meeting to review the chatbot's conversation logs.
   • DRely on the chatbot vendor's annual compliance certification.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A healthcare company is developing an AI system to predict patient readmission risk. The system will be deployed in the EU and is likely to be classified as high-risk under the EU AI Act. The company also processes health data, which is a special category under GDPR. The compliance team must design a risk management plan. Which approach best addresses both regulations?

   • AUse only synthetic data to avoid GDPR obligations and skip the EU AI Act risk management.
   • BImplement a risk management system that includes bias monitoring, data protection impact assessment, and continuous human oversight.
   • COutsource the risk management to a third-party auditor and rely on their report.
   • DFocus only on GDPR compliance because the EU AI Act is not yet fully enforced.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has implemented an AI system for personalized marketing. The system is not high-risk under the EU AI Act, but it processes customer data and is subject to GDPR. The company wants to establish ongoing compliance monitoring but has a limited budget. Which approach is most cost-effective?

   • AHire a full-time compliance officer dedicated solely to this AI system.
   • BRely on the marketing team's self-assessment at the end of each campaign.
   • CConduct a comprehensive external audit every month.
   • DUse existing GDPR compliance tools to automate data mapping and generate compliance reports, and schedule quarterly reviews of the system's data processing.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is developing an AI system for predictive maintenance in manufacturing. The system is not high-risk under the EU AI Act, but it collects data from sensors that may include personal data of workers. The company operates in the EU and in a country with no specific AI regulations. The compliance team is deciding how to handle the differing requirements. Which approach is most balanced?

   • ATreat the system as high-risk under the EU AI Act in all locations to be safe.
   • BApply GDPR requirements to all personal data collected, and use the EU AI Act as a voluntary framework for the system's design in all locations.
   • CComply only with the local laws of the non-EU country to reduce costs.
   • DStop collecting personal data from sensors to avoid GDPR entirely.
   Reveal Solution Discussion Select an answer first