14. Digital, Data, Cybersecurity, and AI Governance

Introduction and Context

Digital transformation has altered the location and nature of corporate power. Competitive advantage increasingly depends on data, software, digital platforms, cloud infrastructure, automated decisions, and artificial intelligence (AI). These technologies create value by improving prediction, coordination, personalization, efficiency, and innovation. They also create new governance problems. A company may depend on an algorithm that few directors understand, process personal information across jurisdictions, rely on a third-party cloud provider, or deploy a generative-AI system whose outputs are inaccurate, biased, confidential, or impossible to explain.

Corporate governance must therefore extend beyond financial reporting, legal compliance, and traditional internal controls. It must address the design, ownership, use, and consequences of digital systems. The central question is not merely whether a technology works. It is whether the organization is using it lawfully, securely, fairly, transparently, and consistently with its stated purpose and responsibilities to stakeholders.

Digital governance concerns decision rights, accountability, architecture, investment, and risk across the organization’s technology environment. Data governance concerns the quality, ownership, access, protection, retention, and ethical use of data. Cybersecurity governance concerns resilience against unauthorized access, disruption, manipulation, and destruction. AI governance concerns the full lifecycle of models and automated systems, including design, training, testing, deployment, monitoring, human oversight, and retirement.

These domains overlap but are not identical. A system may be secure but ethically objectionable; a model may be accurate but discriminatory; data may be legally collected but used for an unexpected purpose; and a platform may comply with regulation while still producing harmful social effects. Effective governance consequently requires technical competence, ethical reasoning, institutional independence, and continuous oversight.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the relationship between digital, data, cybersecurity, and AI governance.

2. Evaluate the major risks associated with platforms, algorithms, generative AI, and data-intensive business models.

3. Apply governance frameworks to privacy, cybersecurity, model risk, explainability, bias, intellectual property, and human oversight.

4. Design appropriate board and management responsibilities for technology-related risk.

5. Assess a digital-governance case using stakeholder, rights-based, risk-management, and accountability perspectives.

6. Recommend controls, metrics, and escalation mechanisms for responsible digital transformation.

From Information Technology to Digital Corporate Governance

Traditional information-technology governance focused on infrastructure, systems availability, project delivery, and alignment with business strategy. Digital governance is broader. It includes customer interfaces, digital products, ecosystems, data partnerships, platform rules, automated decisions, cybersecurity, and the social consequences of technology. It asks who may make decisions, what evidence is required, who bears the risk, and how affected parties can challenge an outcome.

A useful distinction is between technology governance and technology management. Management implements systems and operates processes. Governance establishes direction, allocates authority, approves risk appetite, monitors performance, and holds decision-makers accountable. A chief information officer may manage technology delivery, but the board remains responsible for understanding whether the organization’s technology dependence creates material strategic, operational, legal, or reputational exposure.

Digital systems also complicate accountability. A decision may involve a product team, data scientists, an external vendor, a cloud provider, a compliance function, and senior executives. When responsibility is dispersed, each participant may assume that another actor owns the risk. Governance must therefore identify a named accountable executive, define decision rights, document assumptions, and preserve an audit trail.

Data as an Organizational Asset and a Rights-Bearing Resource

Data is often described as an asset, but this description is incomplete. Data has economic value, yet personal data is also connected to identity, dignity, autonomy, and freedom from unjustified intrusion. Treating data solely as a commodity can encourage excessive collection, indefinite retention, and secondary uses that individuals neither expect nor meaningfully authorize.

Data governance establishes rules for the data lifecycle: collection, classification, storage, access, use, sharing, retention, archiving, and deletion. Important concepts include:

• Data ownership: the authority to define permitted use and accountability, although legal ownership may be complex or unavailable for personal information.
• Data stewardship: operational responsibility for quality, access, protection, and appropriate use.
• Data provenance: evidence of where data originated, how it was transformed, and who handled it.
• Data lineage: the traceable movement of data through systems and processes.
• Data minimization: collecting and retaining only what is reasonably necessary for a specified purpose.
• Purpose limitation: restricting use to declared or legitimately compatible purposes.
• Data quality: the accuracy, completeness, timeliness, consistency, and fitness of data for a defined decision.

A mature data-governance program establishes a classification scheme, such as public, internal, confidential, and highly restricted information. It assigns stewards, uses role-based access, maintains inventories, tests quality, and defines retention schedules. It also distinguishes between information that may be used for operational purposes and information suitable for analytics or model training.

Privacy governance is not equivalent to obtaining a consent checkbox. Meaningful privacy protection requires understandable notices, lawful and fair processing, appropriate security, rights of access and correction, procedures for deletion where applicable, and controls over automated decision-making. Organizations should conduct privacy-impact assessments when introducing high-risk processing, combining datasets, monitoring individuals, or transferring information across borders.

Cybersecurity as a Governance and Resilience Problem

Cybersecurity is frequently treated as a technical matter delegated to specialists. That approach is inadequate because cyber risk can interrupt operations, impair safety, expose confidential information, trigger regulatory consequences, and threaten organizational survival. The board must understand the organization’s most important assets, critical dependencies, plausible attack scenarios, recovery capabilities, and residual risk.

Cybersecurity governance commonly rests on five connected activities: identify, protect, detect, respond, and recover. Identification includes asset inventories, threat assessments, business-impact analysis, and dependency mapping. Protection includes identity management, encryption, secure configuration, training, segmentation, patching, and supplier controls. Detection involves logging, monitoring, anomaly analysis, and threat intelligence. Response requires tested roles, communications, containment procedures, legal advice, and evidence preservation. Recovery concerns restoration, continuity, lessons learned, and adaptation.

A strong control environment applies defence in depth rather than relying on a single barrier. It assumes that some controls will fail and limits the consequences through least-privilege access, multifactor authentication, network segmentation, backups, secure development, and continuous monitoring. The principle of zero trust further rejects the assumption that users or devices should be trusted merely because they are inside a corporate network.

Cybersecurity metrics should communicate risk rather than produce comforting activity counts. Useful measures may include the proportion of critical assets inventoried, time to detect and contain incidents, recovery-point and recovery-time performance, unresolved critical vulnerabilities, privileged-account coverage, phishing resilience, supplier-assessment completion, and results of independent tests. Metrics must be interpreted in context: a declining incident count may indicate better security or poorer detection.

Third-party risk is especially significant in digital ecosystems. A vendor may process personal information, host essential systems, provide software libraries, or connect directly to the corporate environment. Contracts should address security standards, incident notification, audit rights, subcontracting, data location, recovery, deletion, and exit assistance. These provisions cannot substitute for oversight; organizations must verify whether controls operate effectively.

Platforms, Ecosystems, and the Distribution of Responsibility

Digital platforms connect multiple groups, such as buyers and sellers, drivers and passengers, advertisers and audiences, or developers and users. Their governance challenge arises from network effects and information asymmetry. Platform operators set rules that influence visibility, pricing, access, speech, competition, and safety. A platform may therefore perform quasi-regulatory functions without being a public institution.

Platform governance should address admission criteria, ranking and recommendation systems, content or transaction rules, complaint procedures, fraud prevention, data sharing, suspension decisions, and conflicts between user groups. Procedural fairness matters. A user affected by an automated suspension or ranking decision should receive an intelligible explanation and an appropriate avenue for review.

Platforms also create accountability gaps. Harm may result from the interaction of users, algorithms, vendors, and platform incentives. A narrow view of responsibility—claiming that the platform merely hosts third-party activity—may be ethically insufficient where the platform designs the architecture, monetizes engagement, or has the capacity to prevent foreseeable harm. Governance should examine both direct conduct and foreseeable systemic effects.

Algorithmic Decision-Making and Model Risk

An algorithm is a set of procedures for producing an output from inputs. A model is a representation of relationships used for prediction, classification, ranking, or generation. Algorithmic systems can support credit assessment, hiring, insurance, fraud detection, medical triage, pricing, and customer service. Their risks arise not only from mathematical design but also from data selection, target definition, deployment context, human use, and feedback effects.

Model risk is the possibility that a model produces harmful results because of incorrect assumptions, poor data, implementation errors, misuse, or changes in the environment. Model-risk governance should include:

1. A documented purpose, scope, decision owner, and risk classification.

2. Data-quality, representativeness, and provenance assessment.

3. Independent validation of assumptions, performance, robustness, and limitations.

4. Testing for disparate effects across relevant groups.

5. Controls over changes, versions, access, and deployment.

6. Monitoring for drift, error rates, complaints, and unexpected outcomes.

7. Defined thresholds for human review, suspension, and retirement.

Accuracy alone is not a sufficient ethical criterion. A model can achieve high aggregate accuracy while imposing disproportionate errors on a minority group. Fairness is also not a single universal formula. Possible approaches include equal error rates, equal opportunity, demographic parity, individual consistency, and procedural fairness. These criteria can conflict, particularly where base rates differ. Organizations must therefore make the relevant value judgment explicit rather than presenting a technical metric as a complete solution.

Explainability concerns the ability to communicate how a system operates or why a particular result occurred. Explanations should be appropriate to the audience. A board may need information about risk, validation, and limitations; a regulator may require documentation and test evidence; an affected individual may need the principal factors behind a decision and a method of challenge. Explainability does not necessarily require disclosing proprietary source code. It does require truthful, useful, and non-misleading information.

Human oversight must be substantive rather than symbolic. A reviewer who lacks authority, time, training, or access to relevant information may simply approve automated recommendations. Effective oversight defines when human intervention is mandatory, ensures that reviewers can reject or override outputs, monitors automation bias, and prevents responsibility from being transferred to “the algorithm.” In high-impact decisions, human review should occur before adverse action where practicable.

Generative AI and the New Governance Boundary

Generative AI systems produce text, images, audio, software, and other outputs from prompts. They can support research, drafting, coding, translation, customer service, and scenario analysis. Their distinctive risks include hallucinated information, prompt injection, disclosure of confidential data, embedded bias, copyright disputes, insecure code, fabricated citations, and uncertain training-data provenance.

Governance should distinguish between low-risk productivity assistance and high-impact use. A system used to summarize internal meeting notes requires different controls from one used to recommend employment, credit, medical treatment, or termination. Organizations should maintain an approved-use register, classify applications by risk, and prohibit uses that cannot meet legal, ethical, or security requirements.

Generative-AI controls should include confidential-data restrictions, secure interfaces, logging, output review, fact verification, intellectual-property review, model and vendor assessment, access controls, and incident escalation. Employees should understand that a fluent output is not evidence of truth. Professional accountability remains with the person and organization using the output.

Intellectual-property governance is particularly important. Organizations should determine whether prompts or outputs contain protected information, whether training or retrieval sources are authorized, and who may approve external publication. AI-assisted work may require attribution, documentation of human contribution, and verification of licenses. The safest policy is not an absolute ban or unrestricted use, but risk-based authorization supported by clear accountability.

Theories and Frameworks for Responsible Technology Governance

Several theoretical perspectives help boards and executives evaluate digital decisions.

Agency theory emphasizes monitoring managers whose interests may diverge from those of owners. In technology governance, it highlights the danger that executives may overstate transformation benefits, conceal weaknesses, or pursue fashionable projects. Independent assurance, transparent reporting, and incentives linked to risk-adjusted outcomes address these problems.

Stakeholder theory broadens the analysis to employees, customers, suppliers, communities, regulators, and groups affected indirectly. It is essential where digital systems create externalities that are not reflected in short-term financial results.

Rights-based ethics focuses on privacy, autonomy, equality, due process, and freedom from unjustified discrimination. It places limits on actions that might be profitable but violate fundamental interests.

Consequentialist reasoning evaluates expected benefits and harms. It is useful for comparing security investments or evaluating a model’s aggregate effects, but it may underweight the rights of minorities if only total outcomes are considered.

Virtue ethics asks what a trustworthy organization would do and what character is expressed by its choices. It emphasizes honesty about limitations, restraint in surveillance, courage to report defects, and responsibility for foreseeable consequences.

A practical governance architecture can combine the three lines of responsibility: operational teams own risks and controls; risk, compliance, privacy, and security functions provide challenge and standards; internal audit offers independent assurance. For AI, this architecture should be supplemented by model inventories, impact assessments, validation, monitoring, and board reporting.

The three dimensions of responsible AI—capability, compliance, and legitimacy—provide a useful evaluative lens. Capability asks whether the system performs its intended task. Compliance asks whether it satisfies applicable law and policy. Legitimacy asks whether stakeholders can reasonably accept its purpose, process, and effects. A system that passes only the first test is not governance-ready.

Board Competence and Accountability

Boards need not become software engineers, but they must possess or obtain sufficient digital literacy to challenge management. A competent board can ask:

• Which decisions and services depend on critical data or models?
• What would happen if a key system were unavailable or compromised?
• Who is accountable for each material technology risk?
• What evidence supports model accuracy, fairness, and security?
• Which uses involve personal data, vulnerable groups, or significant rights?
• How are vendors, open-source components, and cloud dependencies controlled?
• What is the organization’s tolerance for privacy, cyber, model, and reputational risk?
• How will customers or employees challenge an automated decision?

Boards can develop competence through recruitment, education, independent advisers, technology committees, executive briefings, simulations, and direct engagement with technical and ethical specialists. A technology committee should not become a substitute for full-board responsibility. Material digital risks should appear in enterprise-risk reporting, capital allocation, remuneration discussions, crisis planning, and strategic review.

An Integrated Governance Process

A practical lifecycle for governing a new digital or AI initiative begins with problem definition. The organization should identify the business objective, affected stakeholders, alternatives to automation, and the harms that could arise. It should then classify the initiative by risk and determine whether a privacy, human-rights, cybersecurity, or algorithmic-impact assessment is required.

The next stage is design and procurement. Requirements should include security, accessibility, explainability, auditability, data minimization, interoperability, and exit. Vendor claims must be tested rather than accepted at face value. During development, teams should document data sources, assumptions, testing methods, known limitations, and approval decisions.

Before deployment, an independent review should assess performance, fairness, resilience, privacy, legal compliance, and operational readiness. Deployment should be phased where uncertainty is material. After implementation, monitoring should examine drift, incidents, complaints, override rates, disparate impacts, and changes in the operating environment. Finally, the system should be retired safely, with data deletion, archival decisions, access revocation, and lessons learned.

This process reflects a central governance principle: accountability must continue after launch. Many harms arise not from initial design but from changed data, new uses, new threats, or gradual normalization of exceptional practices.

Illustrative Case: Automated Credit Decisions at Meridian Finance

Background

Meridian Finance, a fictional regional lender, introduced an AI-supported credit-screening system for small-business loans. The system combined traditional financial information with transaction histories, digital-payment activity, and selected behavioral indicators. Management expected faster decisions, lower processing costs, and improved fraud detection.

Situation and Problem

After six months, approval rates increased overall, but complaints rose among businesses operating in rural and lower-income areas. Applicants received generic rejection messages. Relationship managers could not explain individual outcomes and were reluctant to override the system because performance evaluations emphasized processing speed. An external researcher reported that businesses serving certain communities were rejected more frequently even after controlling for revenue.

Analysis

The board initially focused on aggregate accuracy and loss rates. A deeper review identified several governance weaknesses. Data provenance was incomplete; some behavioral variables acted as proxies for location and socioeconomic status; validation had not tested subgroup performance; the vendor’s contract limited audit access; and no clear executive owned fairness risk. The system also used a historical outcome variable that reflected earlier lending practices, thereby reproducing past patterns.

From an agency perspective, management had incentives to emphasize efficiency. From a stakeholder and rights-based perspective, applicants faced inadequate explanation and challenge. Technically, the model exhibited potential data and proxy bias. Procedurally, human oversight was nominal because reviewers lacked authority and incentives to disagree.

Approach and Strategy

Meridian paused automatic adverse decisions for higher-risk cases and established a cross-functional committee led by the chief risk officer. It created a model inventory, documented data lineage, removed variables lacking a defensible purpose, and commissioned independent validation. The lender compared error and approval rates across relevant groups and introduced a structured human-review process for borderline cases.

Applicants received clearer explanations of principal factors, information about correction procedures, and a route for reconsideration. The vendor contract was amended to require testing evidence, incident notification, audit cooperation, and assistance with model exit. The board received quarterly reporting on approval rates, error rates, overrides, complaints, drift, and remediation.

Outcome

The revised system was slower than the original but produced more consistent outcomes and improved the quality of applicant communication. Some variables were abandoned because their predictive value did not justify their governance risk. Meridian accepted a modest cost increase as the price of defensible lending. The system remained subject to periodic review rather than being treated as a completed project.

Learning Points

The case demonstrates that model governance is not reducible to accuracy. Data history can encode institutional bias; explainability must support a real remedy; human oversight requires authority and incentives; and vendor dependence does not remove the organization’s accountability. It also shows why boards should evaluate technology through strategic, ethical, legal, and operational lenses simultaneously.

Challenges, Limitations, and Common Governance Failures

Organizations commonly fail by treating compliance as a checklist, appointing a committee without decision authority, relying on vendor assurances, collecting excessive data, or measuring only system performance. Another failure is “ethics washing”: publishing principles that are not translated into controls, incentives, budgets, or consequences.

Technical limitations also matter. Bias testing depends on the availability and quality of demographic information, yet collecting such information may itself raise privacy concerns. Explainability methods can be approximate. Security controls reduce but cannot eliminate attack risk. Privacy-preserving techniques may reduce analytical utility. Human review can introduce inconsistency and automation bias. Governance must acknowledge these trade-offs rather than promising perfect neutrality or zero risk.

A further challenge is organizational culture. Employees may conceal incidents if reporting threatens performance evaluations. Product teams may view review procedures as obstacles to innovation. Executives may approve deployment under commercial pressure. A responsible culture rewards escalation, records dissent, protects whistleblowers, and treats near misses as learning opportunities.

Current Developments and Emerging Directions

Regulatory attention is moving toward risk-based obligations for AI, stronger privacy rights, cybersecurity resilience, software-supply-chain security, and accountability for high-impact automated decisions. Requirements differ across jurisdictions, creating complexity for multinational firms. Organizations must map applicable rules rather than assume that one global policy is sufficient.

Emerging governance issues include synthetic data, autonomous agents, quantum-related security threats, biometric identification, workplace surveillance, deepfakes, open-source foundation models, and AI-enabled cyberattacks. Autonomous agents are especially significant because they can plan and execute actions across systems. Their use requires narrow permissions, transaction limits, human approval for consequential actions, comprehensive logging, and rapid shutdown capability.

The direction of travel is toward continuous assurance. Instead of assessing a system once before launch, organizations will increasingly combine automated monitoring, independent testing, red-team exercises, stakeholder feedback, incident learning, and periodic board review. Trust will depend less on public statements and more on evidence that governance operates in practice.

Best-Practice Principles

A defensible program should follow these principles:

1. Establish clear accountability for every material digital system and model.

2. Govern data according to purpose, necessity, quality, rights, and lifecycle.

3. Treat cybersecurity as enterprise resilience, not merely technical protection.

4. Classify AI uses by impact and apply controls proportionate to risk.

5. Validate models independently and monitor them after deployment.

6. Make explanations useful to affected people and provide meaningful challenge mechanisms.

7. Test for disparate impacts and address bias in data, design, and deployment.

8. Preserve human authority for consequential decisions.

9. Control vendors, cloud services, open-source components, and exit risks.

10. Give boards regular, decision-relevant reporting rather than technical overload.

11. Align incentives with safe, lawful, and sustainable digital performance.

12. Document uncertainty, dissent, incidents, remediation, and lessons learned.

Chapter Summary

Digital, data, cybersecurity, and AI governance extend corporate governance into the systems through which modern organizations create value and exercise power. Data must be managed both as an economic resource and as a source of rights and responsibilities. Cybersecurity requires board-level attention to resilience, dependencies, detection, response, and recovery. Platforms create rule-making responsibilities, while algorithmic systems introduce model risk, bias, explainability, and human-oversight challenges.

Responsible AI governance combines technical capability, legal compliance, and legitimacy. It requires lifecycle controls covering purpose, data, design, validation, deployment, monitoring, and retirement. Generative AI adds risks involving confidentiality, hallucinations, intellectual property, bias, and insecure outputs. Boards need sufficient digital competence to question management, assign accountability, evaluate risk appetite, and demand evidence. Effective governance is continuous, risk-based, stakeholder-aware, and supported by a culture in which concerns can be raised and acted upon.

Key Terms

Data governance: The structures, policies, roles, and controls governing data throughout its lifecycle.

Digital governance: Oversight of digital strategy, systems, platforms, data, technology risks, and accountability.

Cybersecurity governance: Direction and oversight of measures protecting information systems and ensuring resilience.

Data minimization: Limiting collection and retention to what is necessary for a legitimate purpose.

Purpose limitation: Restricting data use to specified or compatible purposes.

Data provenance: Evidence about the origin, handling, and transformation of data.

Data lineage: The traceable path of data through systems and processes.

Platform governance: Rules and accountability mechanisms controlling a digital platform and its participants.

Algorithm: A defined procedure for transforming inputs into outputs.

Model risk: The risk of harmful results arising from model assumptions, data, implementation, misuse, or change.

Explainability: The capacity to communicate how a system operates or why it produced an outcome.

Algorithmic bias: Systematic and unjustified differences in outcomes associated with data, design, or deployment.

Human oversight: Meaningful human authority to review, challenge, override, or stop an automated system.

Generative AI: AI that produces new content such as text, images, audio, or code.

Privacy impact assessment: A structured evaluation of privacy risks and safeguards for proposed processing.

Zero trust: A security approach that continuously verifies users, devices, and access rather than assuming trust.

Defence in depth: Use of multiple overlapping security controls so that one failure does not cause total compromise.

Automation bias: The tendency to accept automated outputs uncritically.

Digital resilience: The ability to withstand, respond to, recover from, and learn from technology disruption.

Review Questions

Short Answer Questions

1. Distinguish between digital governance and technology management.

2. What is the relationship between data provenance and data lineage?

3. Why is cybersecurity a board-level governance issue?

4. Define model risk and identify two sources of it.

5. What makes human oversight substantive rather than symbolic?

Long Answer Questions

1. Explain how stakeholder theory and rights-based ethics influence data and AI governance.

2. Discuss the lifecycle controls required for responsible algorithmic decision-making.

3. Analyze the governance challenges created by digital platforms and network effects.

4. Explain why aggregate model accuracy is insufficient for evaluating fairness.

5. Discuss the board’s responsibilities for cybersecurity, generative AI, and technology competence.

Analytical / Application Questions

1. A retailer proposes using customer location, browsing behavior, and purchase history to determine personalized prices. Design a governance assessment addressing privacy, fairness, explainability, security, and accountability.

2. A hospital uses a generative-AI assistant to draft clinical notes. Identify the principal risks and recommend controls before and after deployment.

3. A cloud provider that hosts a company’s core transaction system suffers a prolonged outage. Develop a board-level response and recovery plan, including third-party oversight, communications, resilience metrics, and lessons learned.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes governance from technology management?

A. Governance concerns only software coding, while management concerns legal compliance.

B. Governance sets direction, accountability, and risk oversight, while management implements and operates systems.

C. Governance is performed only by vendors, while management is performed only by boards.

D. Governance eliminates the need for operational controls.

Correct Answer: B. Governance sets direction, accountability, and risk oversight, while management implements and operates systems.

Question 2

A company collects extensive personal data for possible future uses without defining a specific purpose. Which principle is most directly threatened?

A. Purpose limitation

B. Defence in depth

C. Model validation

D. Network neutrality

Correct Answer: A. Purpose limitation

Question 3

Why should a board treat cybersecurity as an enterprise-resilience issue?

A. Cybersecurity affects only the IT department’s budget.

B. Cyber incidents can interrupt operations, expose information, and threaten organizational survival.

C. Technical staff can eliminate all cyber risk through encryption.

D. Cybersecurity is relevant only when a regulator conducts an inspection.

Correct Answer: B. Cyber incidents can interrupt operations, expose information, and threaten organizational survival.

Question 4

A credit model has high overall accuracy but rejects applicants from one community at a much higher rate. What is the most appropriate governance response?

A. Accept the result because aggregate accuracy is high.

B. Delete all historical data and deploy the model immediately.

C. Investigate subgroup performance, proxy variables, data history, and available remedies.

D. Allow the vendor to decide whether the outcome is fair.

Correct Answer: C. Investigate subgroup performance, proxy variables, data history, and available remedies.

Question 5

Which condition makes human oversight meaningful?

A. Reviewers must approve every output quickly.

B. Reviewers can understand relevant information and reject or override outputs.

C. The organization describes the system as human-in-the-loop.

D. Reviewers are evaluated only on processing speed.

Correct Answer: B. Reviewers can understand relevant information and reject or override outputs.

Question 6

What is a significant governance risk associated with generative AI?

A. Outputs are always too short to be useful.

B. The system cannot produce any creative material.

C. It may disclose confidential information or generate fluent but false content.

D. It removes all intellectual-property concerns.

Correct Answer: C. It may disclose confidential information or generate fluent but false content.

Question 7

Which control best reflects defence in depth?

A. Using one highly trusted password for all administrators.

B. Relying exclusively on an annual security awareness course.

C. Combining multifactor authentication, segmentation, monitoring, backups, and least privilege.

D. Permitting unrestricted access within the corporate network.

Correct Answer: C. Combining multifactor authentication, segmentation, monitoring, backups, and least privilege.

Question 8

In the Meridian Finance case, why was the original model’s historical outcome variable problematic?

A. Historical variables can reproduce patterns created by earlier discriminatory practices.

B. Historical data is never useful for any model.

C. The variable guaranteed perfect fairness.

D. Historical data cannot be stored under any circumstances.

Correct Answer: A. Historical variables can reproduce patterns created by earlier discriminatory practices.

Question 9

Which board question most directly addresses accountability for an AI system?

A. How fashionable is the model’s underlying architecture?

B. Who owns the system’s risks, and what evidence supports its validation and monitoring?

C. Can the system operate without any documentation?

D. How quickly can deployment occur regardless of testing?

Correct Answer: B. Who owns the system’s risks, and what evidence supports its validation and monitoring?

Question 10

Why is vendor assurance insufficient by itself in digital governance?

A. Vendors never provide useful information.

B. The organization remains accountable and must verify whether controls operate effectively.

C. Contracts cannot contain cybersecurity requirements.

D. Third-party systems are outside the organization’s risk profile.

Correct Answer: B. The organization remains accountable and must verify whether controls operate effectively.