AI Supply Chain Risk Management (e.g., Third Party Resources) AAIR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An online retailer relies on a third-party AI recommendation engine and a cloud provider for hosting. A critical failure in the AI engine causes the website to recommend irrelevant products, leading to a drop in sales. The retailer has no plan for such an event. What should the retailer do first to prepare for future incidents?

   • AIncrease the cloud provider's capacity to handle more traffic
   • BRequest a refund from the AI vendor for the downtime
   • CImmediately switch to a different AI vendor
   • DDevelop an incident response plan that includes fallback procedures and communication protocols
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial institution is evaluating a third-party AI model for credit scoring. The vendor claims the model is 'bias-free' and provides only a high-level summary of its training data. The institution's compliance team requires evidence that the model does not discriminate against protected groups. Which action best addresses this requirement during due diligence?

   • ARequire the vendor to sign a contract clause stating the model is compliant with all regulations
   • BAccept the vendor's summary as sufficient because the vendor is a reputable, well-known provider
   • CRequest the vendor's model bias audit report and the underlying training data demographics
   • DConduct a small internal test using only the vendor's marketing examples
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A European company uses a US-based AI vendor that processes personal data of EU citizens. The company must ensure compliance with GDPR when using the vendor's services. What is the most important contractual measure to include?

   • AA clause requiring the vendor to obtain consent from each data subject
   • BA clause requiring the vendor to store all data within the EU
   • CA clause stating the vendor will comply with all applicable laws
   • DA data processing agreement (DPA) with standard contractual clauses (SCCs) for international data transfers
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key component of managing ongoing third-party AI risks?

   • ABudget allocation
   • BContract termination
   • CIncident response planning
   • DInitial vendor selection
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which contractual element is used to define expected performance levels for an AI service?

   • AIndemnification clause
   • BAudit rights
   • CService level agreement (SLA)
   • DData protection clause
   Reveal Solution Discussion Select an answer first