Responsible Vision, Product Strategy and Emerging Directions

Introduction and Context

Computer vision systems now influence decisions about access, safety, employment, mobility, healthcare, retail, policing, and online communication. Their strategic value is substantial: visual inspection can reduce manufacturing defects, medical image analysis can support clinicians, and perception systems can help robots operate in complex environments. However, vision systems also observe people, infer sensitive attributes, and act under uncertainty. A technically accurate model can therefore still produce unacceptable social, legal, or business outcomes.

Responsible computer vision is the disciplined design, deployment, monitoring, and retirement of vision systems so that they are useful, lawful, secure, explainable, inclusive, and accountable. It extends beyond model accuracy. A responsible system considers the purpose of data collection, consent, proportionality, affected communities, human authority, operational failure, and the distribution of benefits and harms.

This chapter connects technical practice with product strategy. It examines privacy, surveillance, biometrics, bias, accessibility, security, explainability, copyright, regulation, governance, business cases, build-versus-buy decisions, and emerging directions including robotics, autonomous systems, synthetic data, and embodied AI.

Learning Objectives

By the end of this chapter, students should be able to:

1. Identify major ethical, legal, technical, and societal risks in computer vision.

2. Distinguish privacy, surveillance, biometric, fairness, accessibility, security, and explainability concerns.

3. Design a proportionate governance and human-oversight process.

4. Evaluate a vision product using value, risk, feasibility, and lifecycle criteria.

5. Analyse build-versus-buy decisions and define meaningful success measures.

6. Explain how robotics, autonomous systems, synthetic data, and embodied AI are shaping future vision research.

1. A Responsible-Vision Framework

A useful assessment begins with five questions:

• Purpose: What decision or task is the system intended to support?
• Necessity: Is computer vision required, or would a less intrusive method work?
• Impact: Who may benefit, be burdened, excluded, or wrongly classified?
• Control: Who can review, challenge, correct, or stop the system?
• Evidence: What tests demonstrate safety, fairness, robustness, and usefulness in the actual deployment context?

These questions should be asked throughout the system lifecycle:

1. Problem definition: specify the decision, users, affected persons, and unacceptable outcomes.

2. Data and design: establish provenance, consent or lawful basis, representativeness, retention, and annotation quality.

3. Development: evaluate accuracy, calibration, subgroup performance, robustness, privacy, and security.

4. Pre-deployment: conduct impact assessment, user testing, red-team evaluation, and operational rehearsals.

5. Deployment: provide documentation, training, human escalation, monitoring, and incident response.

6. Retirement: delete or archive data appropriately, revoke access, assess residual effects, and communicate discontinuation.

A model is not the whole product. A camera, data pipeline, model, interface, human workflow, policy, and physical environment form a sociotechnical system. Risks frequently arise at their boundaries. For example, a face detector may be accurate in laboratory tests but become harmful when its output is treated as proof of identity by an untrained operator.

2. Privacy, Surveillance, and Biometrics

2.1 Privacy as contextual control

Privacy is not simply secrecy. It concerns appropriate control over personal information and appropriate information flows in context. A photograph may be harmless in a public art project but sensitive when used to infer a person’s identity, health status, emotions, or political activity.

Vision data may include direct identifiers, such as faces and license plates, and indirect identifiers, such as clothing, location, gait, or routines. Even if names are removed, images can often be re-identified. Consequently, anonymisation claims must be tested against realistic linkage and reconstruction attacks rather than assumed from removal of metadata.

Good practice includes purpose limitation, data minimisation, short and justified retention, access controls, encryption, secure deletion, and clear communication. Systems should process data locally where feasible, transmit only necessary features, blur or mask irrelevant persons, and avoid collecting high-resolution imagery when lower resolution is sufficient.

2.2 Surveillance and proportionality

Surveillance involves systematic observation that can influence behaviour, autonomy, or participation. The central question is not merely whether a system is technically capable, but whether its use is necessary and proportionate to a legitimate aim. Continuous facial recognition in a public space, for example, creates different risks from a person-controlled camera used to unlock a device.

A proportionality analysis asks:

• Is the objective legitimate and clearly specified?
• Is the proposed vision capability necessary to achieve it?
• Are less intrusive alternatives available?
• Are accuracy, error, retention, and access limitations adequate?
• What safeguards protect bystanders and vulnerable groups?

Function creep occurs when data collected for one purpose is later used for another without appropriate review. Governance should therefore prohibit unapproved secondary uses and require a new impact assessment when the purpose, population, environment, or decision consequence changes.

2.3 Biometric risk

Biometrics identify or authenticate people using physiological or behavioural characteristics, including faces, fingerprints, irises, voices, and gait. Biometric information is particularly sensitive because it is difficult to replace after compromise. A password can be changed; a face cannot.

Important distinctions include:

• Verification: one-to-one comparison, such as checking whether a claimed identity matches a reference.
• Identification: one-to-many search against a database.
• Detection: locating a face or object without determining identity.
• Classification: assigning a category, which may involve sensitive or questionable inferences.

Biometric systems can generate false matches and false non-matches. The consequences are asymmetric: a false rejection may inconvenience a user, whereas a false match may cause detention, denial of service, or reputational harm. Threshold selection should therefore reflect the context, not simply maximise an aggregate accuracy score. Independent testing, human review, appeal channels, liveness protection, template security, and strict retention limits are essential.

3. Bias, Fairness, and Accessibility

3.1 Sources of bias

Bias can enter at every stage:

• sampling that underrepresents groups or environments;
• labels that reflect subjective or historically unequal judgments;
• image quality differences caused by lighting, cameras, or geography;
• proxy variables that encode protected characteristics;
• deployment conditions unlike the training distribution;
• workflows in which operators rely excessively on model outputs.

A representative dataset is not automatically a fair dataset. Representation must be evaluated in relation to the task, error consequences, and deployment population.

3.2 Measuring subgroup performance

Evaluation should report subgroup-specific measures rather than only overall accuracy. For binary classification, let:

• TP be true positives,
• TN be true negatives,
• FP be false positives,
• FN be false negatives.

Then:

\[

\text{TPR} = \frac{TP}{TP+FN}, \qquad \text{FPR} = \frac{FP}{FP+TN}

\]

TPR is the true-positive rate, also called sensitivity or recall; FPR is the false-positive rate. These measures are meaningful only when the positive class, labels, threshold, and evaluation population are clearly defined.

Suppose a system is evaluated on two groups. Group A has 90 true positive cases, of which 81 are detected, and 910 true negative cases, of which 864 are correctly rejected. Group B has 90 true positive cases, of which 72 are detected, and 910 true negative cases, of which 819 are correctly rejected. For A, TPR = 81/90 = 0.90 and FPR = (910−864)/910 ≈ 0.051. For B, TPR = 72/90 = 0.80 and FPR = (910−819)/910 = 0.10. The overall score could conceal meaningful disparities in both error types.

Fairness criteria can conflict. Equalising TPR and FPR may be incompatible with equal positive predictive value when groups have different base rates, unless special conditions hold. Therefore, fairness is not a single metric-selection exercise. Stakeholders must determine which errors matter, why, and what remedies are acceptable. Possible remedies include better data, task redesign, threshold policies, abstention, human review, or not deploying the system.

3.3 Accessibility and inclusion

Accessibility means that people with different abilities can use, understand, and benefit from the system. Vision products should not assume typical sight, hearing, mobility, dexterity, language, or cognitive processing. Examples of inclusive design include audio and haptic alternatives to visual alerts, captions and transcripts, high-contrast interfaces, keyboard or switch access, adjustable text, plain-language explanations, and manual alternatives.

Accessibility also concerns the system’s perception. A pedestrian-detection system should be evaluated with mobility aids, wheelchairs, service animals, varied clothing, and diverse movement patterns. Testing should involve disabled users rather than treating them only as data categories.

4. Security, Robustness, and Explainability

4.1 Security threats

Vision systems face conventional and machine-learning-specific threats:

• Data poisoning: malicious or corrupted training examples alter learned behaviour.
• Evasion: an input is modified to cause an incorrect prediction.
• Presentation attacks: photographs, masks, screens, or replicas attempt to fool biometric systems.
• Model extraction: repeated queries are used to approximate a proprietary model.
• Membership inference: an attacker attempts to determine whether an image was in training data.
• Prompt or pipeline attacks: in multimodal systems, malicious content manipulates downstream instructions.
• Supply-chain compromise: models, datasets, libraries, or sensors contain hidden vulnerabilities.

Defences include secure dataset provenance, access control, threat modelling, adversarial testing, rate limiting, input validation, liveness checks, monitoring, signed model artifacts, dependency management, and incident response. Robustness is context-dependent: a model for warehouse inventory may tolerate some missed objects, while an autonomous vehicle cannot safely tolerate systematic failure under rain or glare.

4.2 Explainability and contestability

Explainability concerns the ability to understand and appropriately question a system’s output. A saliency map may show which pixels influenced a prediction, but it does not necessarily provide a causal explanation or prove that the reasoning is correct. Similarly, a confidence score is not a guarantee of correctness unless it is calibrated and validated in the deployment environment.

Useful forms of explanation include:

• Global explanations: what patterns the model generally uses.
• Local explanations: why a particular input received an output.
• Example-based explanations: similar training or reference cases.
• Counterfactual explanations: what change might have produced a different result.
• Process explanations: how the output enters a human workflow and what action follows.

Explanations must match the audience. Engineers need diagnostics; affected persons need understandable reasons and routes for correction; regulators may need records of data, purpose, testing, and accountability. Human review is not meaningful if the reviewer lacks time, authority, competence, or independence. Automation bias can cause people to accept erroneous outputs simply because they appear objective.

5. Copyright, Data Rights, and Regulation

Vision projects may involve copyrighted photographs, commercial datasets, trademarks, personal data, and confidential material. Law differs across jurisdictions, and technical teams should not assume that publicly accessible images are free to use. A dataset licence may restrict commercial use, redistribution, facial recognition, or derivative models. Documentation should record source, licence, consent conditions, geographic scope, collection date, transformations, and known restrictions.

Legal analysis commonly considers:

• the purpose and lawful basis for collection and processing;
• rights of subjects, creators, and data controllers or processors;
• copyright and database rights;
• biometric and employment restrictions;
• cross-border transfer and retention;
• transparency, access, correction, deletion, and objection rights;
• sector-specific obligations in healthcare, finance, education, transport, or public services.

Regulatory regimes differ, but a general trend is risk-based governance. High-impact uses may require documentation, risk management, data governance, logging, human oversight, accuracy and robustness controls, and post-market monitoring. Organisations should consult current law and qualified legal professionals because requirements change and jurisdictional details matter. Compliance is a baseline, not proof that a deployment is ethical or socially desirable.

6. Governance and Human Oversight

A practical governance structure assigns responsibility rather than treating ethics as an informal aspiration. A system inventory should record owner, purpose, model version, data sources, affected populations, decision authority, performance evidence, dependencies, and retirement date.

A responsible approval process may include:

1. Impact assessment: describe benefits, harms, affected groups, alternatives, and residual risks.

2. Data review: verify provenance, permissions, representativeness, quality, and retention.

3. Technical evaluation: test accuracy, subgroup performance, calibration, robustness, security, and accessibility.

4. Operational review: examine staffing, escalation, user training, failure handling, and auditability.

5. Go/no-go decision: document acceptance criteria and accountable sign-off.

6. Continuous monitoring: track drift, incidents, complaints, overrides, and subgroup outcomes.

Human oversight should be designed as a control loop. The human must receive relevant information, understand limitations, be able to override or pause the system, and be accountable for the decision. For high-consequence decisions, the system should often recommend or prioritise rather than autonomously determine an outcome. A stop condition should be defined before deployment—for example, suspension after a verified security breach, unacceptable subgroup disparity, or environmental shift beyond validated conditions.

Documentation tools such as model cards, dataset statements, system cards, decision logs, audit trails, and incident reports improve institutional memory. They do not replace testing, but they make claims and responsibilities inspectable.

7. Product Strategy and Business Cases

A strong computer-vision business case links a real problem to measurable value. Potential benefits include reduced inspection time, fewer defects, lower injury exposure, improved accessibility, earlier diagnosis, reduced energy use, or improved service availability. Costs include sensors, data collection, labelling, model development, cloud or edge hardware, integration, cybersecurity, compliance, maintenance, human review, and retirement.

Useful success measures should include both value and responsibility:

• task-level precision, recall, latency, and availability;
• cost per processed image or event;
• reduction in defects, incidents, or processing time;
• subgroup error rates and accessibility outcomes;
• privacy incidents, security events, complaints, and override rates;
• user trust and operational adoption.

A model can have high accuracy but negative return on investment if integration and review costs are ignored. Conversely, a modestly accurate system may be valuable if it safely filters routine cases and leaves difficult cases to experts.

Build-versus-buy analysis

Build is attractive when the task is strategically differentiating, proprietary data are central, requirements are unusual, or long-term control is essential. It requires expertise in data, modelling, deployment, security, compliance, and maintenance.

Buy is attractive when the capability is standard, time-to-market matters, a supplier has strong evaluation evidence, or internal expertise is scarce. Risks include vendor lock-in, opaque updates, data transfer, licensing restrictions, weak customisation, and uncertain responsibility when failures occur.

A hybrid approach may use a commercial detector or foundation model while retaining internal control of data governance, thresholds, workflow, monitoring, and critical decision logic. Procurement should require documentation, evaluation access, service-level expectations, breach notification, audit rights, update controls, data-use restrictions, portability, and exit arrangements.

8. Case Study: Illustrative Warehouse Safety System

Background

A logistics company considers cameras and computer vision to detect whether workers enter a restricted zone while an automated vehicle is operating. The proposed system would trigger a warning and, where necessary, stop the vehicle.

Problem

The company expects fewer collisions and less reliance on manual monitoring. However, workers are concerned about continuous surveillance, disciplinary use of footage, and poor detection of people wearing protective equipment. A false negative could cause serious injury; excessive false positives could stop operations and encourage workers to ignore alarms.

Analysis

The team defines the purpose narrowly as real-time safety intervention, not productivity measurement or identity tracking. It considers alternatives, including physical barriers, warning lights, and wearable tags. Cameras remain necessary in some areas because workers and visitors may not carry compatible devices.

Testing uses staged scenarios across lighting conditions, camera angles, clothing, mobility aids, occlusion, and crowded scenes. Performance is reported separately for workers, visitors, and relevant equipment configurations. Privacy analysis concludes that identity is unnecessary: the system should detect a person and location, not identify individuals. Video is processed at the edge; only event metadata and short clips associated with alarms are retained, with access limited to safety investigators.

Approach and solution

The system issues an immediate local warning and sends a structured event to a trained safety operator. Automatic vehicle stopping is permitted only when multiple sensors agree or when a conservative safety threshold is met. Operators can pause the system, but they cannot dismiss repeated alerts without investigation. A worker can report a missed detection or harmful alert through a documented process. The company prohibits using the footage for attendance or performance scoring.

Before launch, the organisation conducts adversarial tests, accessibility checks, cybersecurity review, and emergency drills. It establishes monitoring for missed detections, nuisance alarms, equipment changes, and environmental drift.

Outcome

In this illustrative case, the value of vision is not judged by a single accuracy number. The deployment is approved conditionally because it reduces a defined safety risk while limiting identity collection and preserving human accountability. Expansion to other sites requires fresh validation because layouts, lighting, equipment, and work practices differ.

Learning points

The case demonstrates purpose limitation, data minimisation, alternative analysis, context-specific evaluation, layered sensing, human oversight, and conditional deployment. It also shows that product design can reduce risk more effectively than attempting to make one model perfect.

9. Emerging Directions

9.1 Robotics and autonomous systems

Robots combine perception with planning and action. Errors therefore have physical consequences. Safety engineering requires redundancy, conservative behaviour under uncertainty, geofencing, fail-safe states, simulation, controlled testing, and clear responsibility when autonomy is limited or transferred to a human.

Autonomous systems face distribution shift: weather, road layouts, objects, people, and sensor conditions change. A model that performs well on benchmark data may fail in rare but dangerous situations. Evaluation should include scenario coverage, near misses, recovery behaviour, and graceful degradation rather than only average accuracy.

9.2 Synthetic data

Synthetic images can provide rare objects, privacy-preserving alternatives, and controllable variations. They are useful for simulation, augmentation, and testing. However, synthetic data may contain unrealistic textures, biased assumptions, or generator artefacts. A model trained only on synthetic scenes may fail on real images because of a domain gap. Synthetic data should be validated against real deployment conditions and clearly documented.

9.3 Embodied and multimodal AI

Embodied AI integrates vision, language, action, memory, and physical interaction. A household robot, for example, must interpret ambiguous instructions, recognise objects, reason about affordances, and act safely around people. New risks include persistent environmental memory, inference about household activities, instruction conflicts, and unsafe generalisation from language models.

Grounding, uncertainty estimation, reversible actions, permission boundaries, and explicit confirmation for high-impact actions are important design principles. A system should distinguish what it sees, what it infers, and what it has actually verified.

9.4 Future research priorities

Important research directions include privacy-preserving learning, federated and on-device inference, uncertainty-aware perception, causal and compositional models, robust adaptation, energy-efficient vision, accessible interaction, watermarking and provenance, evaluation of foundation models, and methods for measuring real-world social impact. Progress should be judged not only by benchmark improvements but also by safety, reproducibility, resource consumption, and public legitimacy.

Challenges and Limitations

Responsible vision has no universal checklist that resolves every conflict. Fairness measures can disagree; privacy protection can reduce data utility; explainability can create false confidence; human oversight can become symbolic; and regulation may lag behind technical change. Small organisations may lack specialist staff, while large organisations may diffuse responsibility across vendors and departments.

Benchmark performance is also an imperfect guide to deployment. Datasets can be stale, labels can encode social assumptions, and average metrics hide rare failures. Governance processes themselves can become bureaucratic if they do not influence design decisions. Effective responsibility therefore requires technical competence, domain expertise, affected-community participation, independent challenge, and willingness not to deploy.

Best-Practice Checklist

Before deployment, a team should be able to answer yes to the following questions:

• Is the purpose specific, necessary, and communicated?
• Have less intrusive alternatives been considered?
• Are data sources, licences, consent conditions, and retention documented?
• Have performance and error consequences been evaluated by relevant subgroups and environments?
• Are security, accessibility, robustness, and privacy tested?
• Can an authorised human understand, challenge, override, and stop the system?
• Are incidents, model updates, drift, complaints, and vendor changes monitored?
• Is there a documented retirement and deletion plan?

Chapter Summary

Responsible computer vision treats a model as part of a larger sociotechnical product. Privacy and proportionality require purpose limitation, minimisation, retention controls, and consideration of less intrusive alternatives. Biometric identification creates special risks because errors can affect liberty and biometric characteristics are difficult to replace. Bias must be examined through data, labels, deployment conditions, subgroup metrics, and error consequences. Accessibility requires inclusive interfaces and testing with disabled users.

Security involves threats to data, models, sensors, and supply chains. Explainability should support understanding, contestability, and appropriate human action rather than merely provide attractive visualisations. Copyright, data rights, and regulation require documented provenance and current jurisdiction-specific advice. Governance depends on impact assessment, accountable ownership, human oversight, monitoring, incident response, and retirement planning.

Product strategy requires a complete business case that includes integration, review, compliance, and lifecycle costs. Build-versus-buy decisions should consider differentiation, control, vendor risk, portability, and evidence. Robotics, autonomous systems, synthetic data, and embodied AI expand the value and danger of vision by connecting perception to physical action and persistent interaction. The most responsible strategy is often not to maximise automation, but to design a proportionate system whose benefits, limitations, and accountability are clear.

Key Terms

Privacy: Appropriate control over personal information and its use in context.

Surveillance: Systematic observation that may affect autonomy, behaviour, or participation.

Biometrics: Physiological or behavioural characteristics used for recognition or authentication.

Verification: One-to-one comparison between a claimed identity and a reference.

Identification: One-to-many search for an identity in a database.

Purpose limitation: Restricting collection and use to a specified legitimate purpose.

Data minimisation: Collecting and processing only information necessary for the purpose.

Fairness: The principled evaluation and reduction of unjust or unacceptable disparities.

True-positive rate: The proportion of actual positive cases correctly detected.

False-positive rate: The proportion of actual negative cases incorrectly classified as positive.

Accessibility: Designing products so people with diverse abilities can use them effectively.

Adversarial attack: An intentional manipulation designed to cause an incorrect model output.

Explainability: The ability to understand and question a system’s outputs or behaviour.

Human oversight: Meaningful human authority to review, intervene in, or stop a system.

Model drift: Degradation caused by changes in data, environments, or operational conditions.

Synthetic data: Artificially generated data designed to represent or augment real data.

Embodied AI: AI that perceives and acts through interaction with a physical or simulated environment.

Build-versus-buy: A strategic choice between internal development and external procurement.

Impact assessment: Structured analysis of a system’s benefits, risks, affected groups, and safeguards.

Review Questions

Short Answer Questions

1. Why is a computer-vision model best understood as part of a sociotechnical system?

2. Distinguish biometric verification from biometric identification.

3. Define purpose limitation and data minimisation.

4. Why should subgroup performance be reported alongside aggregate accuracy?

5. State two requirements for meaningful human oversight.

Long Answer Questions

1. Explain how privacy, surveillance, and proportionality should influence the design of a public-space vision system.

2. Discuss the sources of bias in a computer-vision pipeline and propose corresponding mitigations.

3. Compare global, local, example-based, and counterfactual explanations.

4. Analyse the main strategic factors in a build-versus-buy decision for a vision product.

5. Explain the governance lifecycle for a high-impact computer-vision deployment.

Analytical / Application Questions

1. A face-recognition system has lower false-positive rates but also lower true-positive rates for one subgroup. Explain why one aggregate accuracy figure is inadequate and recommend an evaluation plan.

2. Design a privacy-preserving vision solution for monitoring safety in a factory. Specify what the system should detect, what it should not collect, and how human escalation would work.

3. A supplier offers a foundation vision model but refuses audit access and may use customer images for improvement. Analyse whether procurement should proceed and identify contract or design safeguards.

Multiple Choice Questions with Answers

Question 1

Which distinction is correct?

A. Verification is one-to-one comparison, while identification is one-to-many search.

B. Verification always requires continuous surveillance, while identification never does.

C. Verification classifies objects, while identification detects edges.

D. Verification is only used for research, while identification is only used in retail.

Correct Answer: A. Verification is one-to-one comparison, while identification is one-to-many search.

Question 2

Which practice best reflects data minimisation?

A. Collecting high-resolution video indefinitely in case future uses arise

B. Processing only the information necessary for a specified purpose and retaining it for a justified period

C. Sharing all raw images with every project partner

D. Replacing names with numbers while keeping unlimited access to images

Correct Answer: B. Processing only the information necessary for a specified purpose and retaining it for a justified period

Question 3

If a group has 72 true positives out of 90 actual positive cases, what is its true-positive rate?

A. 0.72

B. 0.80

C. 0.90

D. 1.25

Correct Answer: B. 0.80

Question 4

Why can aggregate accuracy conceal fairness problems?

A. Accuracy cannot be calculated for image models

B. Aggregate accuracy may hide different error rates across groups

C. Accuracy always measures privacy rather than performance

D. Fairness only concerns hardware cost

Correct Answer: B. Aggregate accuracy may hide different error rates across groups

Question 5

Which is an example of a presentation attack?

A. A model update improving recall

B. A printed photograph presented to fool a biometric system

C. Deleting expired video files

D. Adding captions to an interface

Correct Answer: B. A printed photograph presented to fool a biometric system

Question 6

Which condition is necessary for meaningful human oversight?

A. The human must be able to understand limitations and intervene or stop the system

B. The human must accept every model recommendation

C. The human must never see model confidence information

D. The human role must be limited to signing deployment paperwork

Correct Answer: A. The human must be able to understand limitations and intervene or stop the system

Question 7

Which factor most strongly supports a build decision?

A. The capability is a standard commodity and internal expertise is absent

B. The task is strategically differentiating and depends on proprietary data

C. The supplier offers strong audit rights and portability

D. The organisation wants to avoid all maintenance responsibility

Correct Answer: B. The task is strategically differentiating and depends on proprietary data

Question 8

What is a significant limitation of synthetic data?

A. It can never represent rare events

B. It may contain unrealistic features and fail to match real deployment conditions

C. It automatically eliminates all bias

D. It cannot be used for testing

Correct Answer: B. It may contain unrealistic features and fail to match real deployment conditions

Question 9

What does purpose limitation require?

A. Using collected data for any profitable future activity

B. Restricting collection and use to a specified legitimate purpose

C. Avoiding documentation of data uses

D. Retaining data until storage capacity is exhausted

Correct Answer: B. Restricting collection and use to a specified legitimate purpose

Question 10

Why are autonomous vision systems evaluated for graceful degradation?

A. Because all sensors are guaranteed to fail simultaneously

B. Because systems may encounter conditions outside their validated distribution

C. Because autonomous systems do not require safety testing

D. Because average benchmark accuracy is always zero in practice

Correct Answer: B. Because systems may encounter conditions outside their validated distribution