AI Regulatory Compliance CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A bank has implemented an AI system for fraud detection. The system was approved by regulators. The bank must now ensure ongoing compliance. Which activity is essential for continued compliance?

   • ARegularly update the system's risk assessment and monitor for changes in regulatory requirements
   • BOnly monitor the system's performance, not regulatory changes
   • CKeep the system unchanged to maintain regulatory approval
   • DConduct a full audit every five years
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A hospital is auditing its AI diagnostic support system, which is classified as high-risk under the EU AI Act and processes patient data under GDPR. The audit team must verify that the system's human oversight is adequate. Which audit evidence is most relevant?

   • ADocumentation showing that a qualified clinician reviews and can override the AI system's recommendations before final decisions.
   • BLogs showing the AI system's uptime and response time.
   • CA list of all patients whose data was used to train the model.
   • DA certificate from the AI vendor stating that the system is safe.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A government agency is procuring an AI system for public benefits eligibility determination. The agency is in a jurisdiction that has adopted the NIST AI Risk Management Framework (AI RMF) as a guideline, but no specific AI law exists. The agency wants to demonstrate responsible AI governance. Which approach best aligns with the NIST AI RMF?

   • AAdopt the EU AI Act's requirements even though the agency is not in the EU.
   • BImplement the AI RMF's core functions—govern, map, measure, and manage—to identify risks and establish governance practices.
   • CWait for a specific AI regulation to be enacted before taking any compliance actions.
   • DFocus only on data privacy compliance because no AI law exists.
   Reveal Solution Discussion Select an answer first
5. 39expert · medium

   A bank has an AI system for credit scoring that is subject to GDPR and the EU AI Act. The system was recently updated with new training data. The bank must ensure the updated system remains compliant. The bank's compliance team is small and has other responsibilities. Which action is most appropriate?

   • AConduct a full compliance audit of the entire system from scratch
   • BRely on the previous compliance approval without reviewing the changes
   • CDeploy the updated system immediately and review compliance later
   • DConduct a targeted compliance review of the changes, including a bias test and documentation update, before deployment
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An insurance company is auditing its AI claims-processing system. The audit team discovers that the system's training data includes biased historical decisions. The team must decide how to address this finding. Which action is most appropriate?

   • ADocument the finding, assess the impact on fairness, and implement corrective measures such as retraining or bias mitigation
   • BReport the finding to the data protection authority but take no further action
   • CDelete the biased training data and retrain the model immediately without documenting
   • DIgnore the finding because the system is not a high-risk AI system
   Reveal Solution Discussion Select an answer first