AI Regulatory Compliance CRAGE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A government agency has deployed an AI system to assist in processing visa applications. The system is classified as high-risk under the EU AI Act. The agency must establish ongoing monitoring. Which practice should be implemented?

   • AOnly monitor the system when a complaint is filed
   • BConduct a one-time compliance audit and then stop monitoring
   • CSet up periodic reviews of system performance and incident reporting, with logs retained for the required period
   • DRely on the AI vendor's self-assessment without independent checks
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A retail company uses an AI system to personalize marketing emails. The system was trained on customer purchase history. A compliance review reveals that the system may inadvertently infer sensitive attributes (e.g., health conditions) from purchase patterns. The company wants to mitigate this risk. Which measure is most appropriate?

   • ASwitch to a different marketing platform that does not use AI
   • BIgnore the risk because the system only uses purchase history, not health data directly
   • CObtain explicit consent from all customers for marketing emails
   • DConduct a data protection impact assessment (DPIA) and implement technical measures to prevent inference of sensitive data
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A financial services firm is deploying an AI system for fraud detection. The system is not high-risk under the EU AI Act, but it processes personal data and is subject to GDPR. The firm also operates in a country with a new AI law that requires regular bias audits. The compliance team has limited budget and must decide how to allocate resources. Which approach best balances regulatory obligations and resource constraints?

   • AIgnore the local AI law because the system is not high-risk under the EU AI Act.
   • BPrioritize the mandatory bias audits required by the local AI law, while using GDPR compliance processes already in place to cover data protection.
   • CConduct a full EU AI Act compliance assessment even though the system is not high-risk.
   • DAllocate all budget to GDPR compliance and defer bias audits until the next fiscal year.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which regulation specifically addresses the use of personal data and includes provisions relevant to AI systems that process such data?

   • AEU AI Act
   • BNIST AI RMF
   • CGDPR
   • DISO/IEC 42001
   Reveal Solution Discussion Select an answer first
6. 45expert · medium

   A financial services company has deployed an AI system for loan approvals. The system was compliant at launch, but six months later a new regulation requires additional explainability for automated decisions. The company must update the system to maintain compliance. The system's current model is a complex ensemble that is difficult to explain. Which approach is most appropriate?

   • ARequest an exemption from the new regulation
   • BStop using the AI system and revert to manual loan approvals
   • CReplace the ensemble model with a simple linear model to ensure explainability
   • DImplement post-hoc explainability tools (e.g., LIME or SHAP) to generate explanations for each decision, and document the approach
   Reveal Solution Discussion Select an answer first