AI Regulatory Compliance and Legal Considerations AAIR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A manufacturing company uses an AI system to optimize supply chain logistics. The system is not used in any regulated industry, and it does not process personal data. The company's legal counsel is reviewing applicable regulations. Which regulatory framework is most likely to apply?

   • AEU AI Act as a mandatory regulation for all AI systems
   • BGDPR because the system may indirectly process personal data
   • CNIST AI RMF as a voluntary framework to guide risk management
   • DNo regulations apply because the system is not in a regulated industry
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When transferring personal data used in an AI system from the EU to a non-EU country, which of the following is a valid mechanism under the GDPR?

   • AStandard Contractual Clauses (SCCs)
   • BThe data subject's implied consent from using the AI system
   • CThe organization's internal policy that data is safe
   • DThe fact that the AI system is used globally
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A nonprofit organization uses an AI system to screen job applicants. The system is deployed in the EU. The organization's board is reviewing applicable regulations. Which regulation is most directly applicable to the AI system's use?

   • AGDPR, because the system processes personal data of applicants
   • BNIST AI RMF, because it is a voluntary framework for AI risk management
   • CNo regulations apply because the organization is a nonprofit
   • DEU AI Act, because the system is used for recruitment, which is a high-risk use case
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A retail company uses an AI chatbot to recommend products to customers in the EU. The chatbot collects personal data, including purchase history and browsing behavior. The company's data protection officer (DPO) is reviewing compliance with GDPR. Which action is most directly required by GDPR?

   • AObtain explicit consent for all data processing, regardless of the legal basis
   • BAppoint a Data Protection Officer (DPO) because the company is a retailer
   • CAnonymize all personal data before using it in the chatbot
   • DConduct a Data Protection Impact Assessment (DPIA) because the chatbot involves systematic and extensive evaluation of personal aspects
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following best describes the concept of 'accountability' in AI governance?

   • ATransferring all responsibility to the AI vendor
   • BKeeping the AI system's decision-making process secret to avoid scrutiny
   • CEnsuring the AI system is technically flawless and never makes errors
   • DClearly defining who is responsible for the AI system's outcomes and decisions
   Reveal Solution Discussion Select an answer first