AI, Emerging Technologies and the Future of Cyber Regulation

Introduction

Cyber regulation is increasingly concerned not only with computers and networks, but also with systems that make predictions, identify people, control physical devices, record transactions, and influence decisions. Artificial intelligence (AI), biometric systems, the Internet of Things (IoT), blockchain, quantum technologies, and regulatory technology (RegTech) are changing the distribution of power and responsibility across society.

These technologies create substantial benefits. AI can detect fraud, support medical diagnosis, and identify malicious network activity. IoT devices can improve industrial safety and energy efficiency. Blockchain can provide tamper-evident records. Quantum technologies may transform sensing, communications, and cryptography. RegTech can help organisations monitor compliance at a scale that would be difficult through manual processes.

They also create legal and governance challenges. An automated decision may be difficult to explain. A biometric system may produce unequal error rates across demographic groups. An IoT device may be insecure for years after it is sold. A blockchain record may conflict with data-erasure rights. Quantum computing may make some currently deployed public-key systems obsolete. A compliance dashboard may give a false impression of assurance if the underlying data is incomplete.

The central question is therefore not whether a technology is innovative, but whether its design, deployment, and use are lawful, secure, fair, accountable, and proportionate. This chapter develops a practical framework for assessing that question.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the legal and governance significance of AI, automated decision-making, biometrics, IoT, blockchain, quantum technologies, and RegTech.
2. Distinguish transparency, explainability, accountability, responsibility, and auditability.
3. Assess risks involving bias, privacy, security, safety, human rights, and consumer protection.
4. Apply a technology-neutral governance lifecycle to an emerging-technology project.
5. Identify relevant regulatory instruments and standards without assuming that one law applies globally.
6. Recommend practical controls for organisations developing or procuring emerging technologies.

1. A Technology-Neutral View of Cyber Regulation

Technology-specific laws are sometimes necessary, but technology-neutral principles are more durable. A useful governance analysis asks six questions:

A system should be assessed across its full lifecycle: design, procurement, development, testing, deployment, maintenance, modification, retirement, and disposal. Legal exposure often arises after deployment, when data changes, users adapt their behaviour, suppliers alter models, or an apparently low-risk system is combined with another system.

1.1 Risk-based regulation

Risk-based regulation classifies activities according to their possible impact and applies stronger controls where harm is more serious or more likely. It differs from a purely technology-based approach: the same algorithm may be low risk in a game recommendation system but high risk when used to determine access to employment, credit, education, healthcare, or public benefits.

A simple qualitative risk model is:

Likelihood describes the chance of a harmful event; impact describes the severity of its consequences. This expression is a governance aid, not a precise scientific law. Organisations should define scales, document assumptions, and consider uncertainty. A low-probability event with catastrophic consequences may require controls even when its numerical score is modest. Risk assessment should therefore include scenario analysis, not merely multiplication.

2. Artificial Intelligence and Automated Decisions

AI systems use data and computational methods to produce outputs such as predictions, classifications, recommendations, generated content, or decisions. Machine learning systems learn patterns from data rather than relying only on explicitly programmed rules. Generative AI produces text, images, audio, code, or other content in response to prompts.

An automated decision system can be represented conceptually as:

The model may produce a score, but a person or organisation often converts that score into an operational decision. Legal responsibility must therefore be considered across the whole chain rather than assigned automatically to the model.

2.1 Automated decision-making and human involvement

A decision is not necessarily lawful merely because a human reviews it. Meaningful human involvement requires competence, authority, sufficient information, adequate time, and a genuine ability to disagree with or override the system. A person who can only approve an algorithmic recommendation without understanding its limitations may be acting as a rubber stamp.

Important safeguards include:

• notifying individuals when AI materially influences a decision;
• identifying the responsible organisation and the decision’s purpose;
• providing accessible reasons appropriate to the context;
• offering review, correction, and appeal procedures;
• testing for error and disparate impacts;
• recording the model version, input data, output, reviewer, and final action;
• suspending use when reliability or safety thresholds are exceeded.

Data protection regimes may impose additional requirements. For example, the EU General Data Protection Regulation (GDPR) contains provisions concerning solely automated decisions with legal or similarly significant effects, subject to specified conditions and safeguards. The precise legal position depends on the facts, jurisdiction, lawful basis, exemptions, and sectoral rules. Organisations should not treat a generic “human in the loop” statement as a complete legal analysis.

2.2 Transparency and explainability

Transparency means making relevant information available. It may involve disclosure of purpose, data categories, system capabilities, limitations, affected groups, and responsible parties. Explainability concerns whether an output can be meaningfully understood. These are related but distinct. A technically transparent disclosure of model architecture may not explain why a particular applicant was rejected.

Explanations should be matched to the audience and decision. A data subject may need the principal factors affecting an outcome and a route to challenge it. An auditor may require training-data documentation, validation results, access controls, and logs. A security engineer may need attack-testing results and system dependencies.

2.3 Bias, discrimination, and fairness

Bias can enter through historical data, unrepresentative sampling, inaccurate labels, proxy variables, measurement practices, model design, or deployment context. Removing protected attributes does not necessarily remove discrimination: other variables may act as proxies.

Fairness is not a single universal property. Possible approaches include equal error rates, equal selection rates, calibration, individual consistency, and procedural fairness. These objectives can conflict, particularly where base rates differ between groups. A responsible organisation must identify the relevant legal and social objective rather than claiming that a single metric proves fairness.

A practical assessment should compare performance across relevant groups, examine false-positive and false-negative consequences, consult affected communities, and monitor outcomes after deployment. Small sample sizes and missing demographic information can make statistical comparisons unreliable; uncertainty should be reported rather than hidden.

2.4 Security of AI systems

AI systems introduce familiar security risks and new ones. Examples include:

• data poisoning, in which training or feedback data is manipulated;
• prompt injection and indirect instruction attacks against generative systems;
• model extraction and intellectual-property leakage;
• membership inference and reconstruction of sensitive training data;
• adversarial inputs designed to cause misclassification;
• insecure plugins, tools, or retrieval systems;
• supply-chain compromise involving models, datasets, or libraries.

Controls include threat modelling, access control, data minimisation, secure development, red-team testing, rate limiting, output validation, human review for high-impact actions, incident response, and continuous monitoring. A model card or system card can document intended uses, limitations, evaluation conditions, and known risks, but documentation does not replace testing.

3. Biometrics and the Governance of Identity

Biometric data is information relating to physical, physiological, or behavioural characteristics that can identify a person. Examples include fingerprints, facial patterns, iris characteristics, voice, gait, and behavioural typing patterns. A biometric template is generally a mathematical representation used for comparison, rather than a photograph or raw biological sample.

Biometrics can provide convenience and improve access control, but they have special risks. Passwords can be changed after compromise; a face or fingerprint usually cannot. Biometric identification may occur without a person’s knowledge. False matches can cause wrongful arrest, denial of services, exclusion, or reputational harm. Performance may vary across age, skin tone, disability, lighting conditions, and population groups.

A sound biometric governance programme should address:

1. Necessity and proportionality: Is biometric use required, or would a less intrusive method work?
2. Purpose limitation: Is the data used only for the stated purpose?
3. Consent and lawful authority: Is consent meaningful, revocable where applicable, and not coerced?
4. Template protection: Are templates encrypted, segregated, access-controlled, and protected against replay?
5. Accuracy and demographic performance: Are false-match and false-non-match rates measured in realistic conditions?
6. Retention and deletion: Can records be deleted, and what happens to backups and supplier copies?
7. Human review: Can an individual challenge an adverse identification?
8. Supplier accountability: Are subcontractors, cloud services, and law-enforcement requests governed?

For biometric authentication, organisations should consider multi-factor authentication. A biometric factor should not be treated as automatically superior to a secure device or possession factor. The appropriate choice depends on threat, context, accessibility, and consequences of failure.

4. Internet of Things and Cyber-Physical Accountability

The IoT links sensors, actuators, appliances, vehicles, industrial systems, and cloud services. It expands the attack surface because devices may be numerous, physically accessible, resource-constrained, difficult to patch, and operated by organisations other than their manufacturers.

An IoT system commonly includes:

Security and legal responsibility may be distributed among the manufacturer, software provider, installer, network operator, asset owner, and user. This creates accountability gaps. A vendor may argue that the owner failed to patch; the owner may argue that the vendor provided no update mechanism; a cloud provider may control the data while the device manufacturer controls the firmware.

Baseline IoT controls include unique credentials, secure onboarding, authenticated updates, vulnerability disclosure procedures, asset inventories, encryption in transit and at rest, least privilege, network segmentation, logging, physical protection, secure default settings, support-life declarations, and end-of-life disposal procedures. Safety must be considered alongside confidentiality, integrity, and availability. A compromised industrial actuator may cause physical injury even when no personal data is involved.

The EU Cyber Resilience Act, adopted as a major EU product-cybersecurity measure, illustrates a trend toward placing security obligations across the lifecycle of products with digital elements. Other jurisdictions have adopted or proposed secure-by-design principles, consumer IoT baselines, labelling schemes, or vulnerability-reporting requirements. Applicability depends on product, market, jurisdiction, and implementation date.

5. Blockchain, Distributed Ledgers, and Legal Finality

A blockchain is a type of distributed ledger in which transactions are recorded in linked blocks and validated through a consensus process. The technology can provide tamper-evidence and shared records, but “immutable” should be used carefully. Records may be technically difficult to alter, yet governance mechanisms, forks, key compromise, administrative intervention, or off-chain correction may change the practical result.

Key legal questions include:

• Who is the data controller or responsible operator in a decentralised network?
• Is personal data stored directly on-chain or merely referenced?
• Can an individual exercise access, correction, or deletion rights?
• Who is liable for a smart-contract defect?
• Which jurisdiction and court have authority?
• How are private keys secured and recovered?
• Does a token represent property, a security, payment value, or another legal interest?

A prudent privacy architecture normally avoids placing unnecessary personal data directly on a public ledger. A common design is to store a cryptographic reference on-chain and keep the substantive record in a controlled system. However, a hash may still be personal data if it can be linked to an identifiable person or used to verify personal information. “Hashed” therefore does not automatically mean anonymous.

Smart contracts are software-based rules that execute when specified conditions are met. Code execution is not identical to legal enforceability. A written agreement should define the relationship between code, legal terms, error correction, dispute resolution, governance, and emergency suspension.

6. Quantum Technologies and the Future of Cryptography

Quantum computing uses quantum-mechanical effects to process information in ways that may outperform classical computers for particular problems. It does not make every cryptographic system instantly breakable, and practical capability varies by algorithm, implementation, error correction, and available hardware.

The principal cybersecurity concern is that sufficiently capable quantum computers could threaten widely used public-key schemes based on integer factorisation or discrete logarithms. Symmetric cryptography is affected differently; larger key sizes can generally provide a security margin, although exact choices depend on the algorithm and security target.

The “harvest now, decrypt later” threat is especially important. An adversary may capture encrypted traffic today and attempt decryption in the future. Organisations with long-lived confidential information should therefore begin cryptographic inventory and migration planning before a cryptographically relevant quantum computer exists.

A practical quantum-readiness programme includes:

• inventorying cryptographic algorithms, certificates, protocols, and data lifetimes;
• identifying systems dependent on public-key encryption or signatures;
• prioritising information requiring long-term confidentiality or authenticity;
• requiring supplier roadmaps and crypto-agility;
• testing post-quantum cryptographic algorithms and interoperability;
• monitoring standards and approved transition guidance;
• protecting fallback and migration mechanisms.

Post-quantum cryptography seeks algorithms believed to resist quantum attacks while running on conventional computers. Migration must be governed carefully: an algorithm may be mathematically promising but operationally unsuitable because of key size, performance, implementation defects, or immature standards. Quantum key distribution is a different technology and does not remove the need for endpoint security, authentication, governance, or conventional cryptographic controls.

7. RegTech and Supervisory Technology

RegTech uses technology to support compliance activities such as transaction monitoring, identity verification, policy mapping, control testing, regulatory reporting, and evidence management. Supervisory technology, or SupTech, is used by regulators to analyse market or institutional data.

Examples include natural-language tools that map new regulations to internal controls, automated monitoring of privileged access, machine-assisted anti-money-laundering alerts, and dashboards that track remediation. These tools can reduce repetitive work, but they can also automate flawed interpretations. A system that produces thousands of alerts may appear rigorous while overwhelming investigators and encouraging superficial closure.

Effective RegTech requires:

• a traceable mapping from legal requirement to control and evidence;
• clear ownership of each control;
• data lineage and quality checks;
• version control for laws, policies, rules, and models;
• human review of material judgments;
• documented thresholds and tuning decisions;
• independent validation and periodic assurance;
• secure retention of evidence;
• procedures for correcting false positives and false negatives.

Compliance automation does not transfer legal responsibility to software. The organisation remains accountable for interpreting its obligations, selecting suitable controls, and responding to failures.

8. Governance Frameworks and Accountability Models

Several complementary frameworks support responsible emerging-technology governance. The NIST AI Risk Management Framework organises work around Govern, Map, Measure, and Manage. ISO/IEC 42001 provides requirements for an artificial-intelligence management system. ISO/IEC 27001 addresses information-security management, while ISO/IEC 27701 extends privacy-management practices. The OECD AI Principles and UNESCO Recommendation on the Ethics of Artificial Intelligence provide influential international policy principles. These instruments differ in legal status: some are voluntary standards or guidance, while legislation and regulatory orders may be binding.

A practical governance structure can be organised into three lines:

The board or senior management should approve risk appetite, allocate resources, and receive meaningful reporting. Technical teams should not be expected to resolve legal and ethical questions without institutional support. Conversely, legal teams need sufficient technical understanding to assess architecture, model limitations, and security evidence.

A useful accountability artefact is an AI or emerging-technology impact assessment. It should document purpose, affected groups, legal basis, data flows, suppliers, risks, mitigations, testing, residual risk, decision rights, incident procedures, and review dates. It should be updated when the model, data, purpose, or operating environment changes.

9. The Regulatory Landscape

Regulation is becoming layered rather than uniform. A single system may be governed by privacy law, cybersecurity requirements, consumer-protection law, equality and human-rights law, intellectual-property law, sector regulation, procurement rules, employment law, and product-safety obligations.

The EU AI Act is an important example of risk-based AI regulation. It establishes categories of prohibited practices, high-risk systems, transparency duties for certain systems, and obligations for providers and deployers. It is being applied through a phased timetable, and organisations must consult current official provisions and implementation guidance rather than relying on summaries. The Act operates alongside other EU instruments, including the GDPR and product and cybersecurity legislation.

In the United States, regulation is distributed across federal agencies, state laws, sectoral rules, enforcement powers, and standards. The White House executive policy environment and agency guidance may change with administrations. The United Kingdom has pursued a principles-based, regulator-led approach, while other countries have adopted their own statutes, strategies, or standards. International organisations and standards bodies contribute terminology and good practice but do not necessarily create directly enforceable rights.

For compliance purposes, organisations should maintain a legal and regulatory register identifying:

• jurisdictions in which the system is developed, hosted, sold, and used;
• affected individuals and data transfers;
• sector-specific obligations;
• system classification and prohibited or restricted uses;
• supplier and contractual responsibilities;
• reporting, audit, record-keeping, and incident duties;
• review dates and regulatory owners.

10. Illustrative Case Study: Automated Benefit-Fraud Detection

Background

A public authority introduces an AI system to identify potentially fraudulent benefit claims. The system analyses historical claims, household information, payment patterns, and previous investigation outcomes. Investigators receive a risk score and may suspend payment while requesting evidence from the claimant.

Problem

After deployment, civil-society groups report that certain communities are referred for investigation more frequently. Claimants receive generic notices and cannot understand why their payments were suspended. Investigators rely heavily on the score because of workload pressures. A supplier argues that the model is proprietary and refuses to provide detailed documentation.

Analysis

The system has significant effects on access to essential services. Relevant risks include inaccurate historical labels, proxy discrimination, data-quality problems, unlawful data sharing, excessive reliance on automation, inadequate reasons, and procedural unfairness. A risk score is not proof of fraud. Suspending payment before human verification may create severe hardship.

The authority should identify its legal authority and purpose, conduct a data-protection and equality impact assessment, test performance across relevant groups, examine false-positive rates, and assess whether the model uses variables that are necessary and proportionate. It should document the model’s role in the final decision and ensure that investigators have authority and time to challenge it.

Approach and solution

The authority establishes a governance board, pauses automatic payment suspension, and uses the model only to prioritise cases for trained investigators. It introduces a notice explaining the principal reasons for review, a rapid human appeal route, minimum evidence requirements, and hardship safeguards. The supplier provides model documentation, testing results, version history, and audit access under contract. The authority creates monitoring thresholds for error rates and group disparities and requires reapproval after material model changes.

Outcome

The revised process reduces harmful automatic actions and improves the authority’s ability to explain and audit decisions. Some fraud-detection efficiency is lost, but the system becomes more proportionate and defensible. The authority also discovers that a data field reflecting geographic service access acted as a proxy for socioeconomic status and removes it after further analysis.

Learning points

1. High-impact decisions require more than technical accuracy.
2. Human oversight must be real, informed, and empowered.
3. Suppliers must provide evidence sufficient for legal and operational assurance.
4. Fairness must be assessed in context, including the consequences of errors.
5. Governance controls should continue after deployment.

11. Challenges and Limitations

Emerging-technology governance faces persistent difficulties. Laws may lag behind technical change, while broad principles may be difficult to apply consistently. Jurisdictional conflict can arise when data, suppliers, users, and infrastructure are located in different countries. Small organisations may lack specialist staff and struggle with the cost of audits, testing, and documentation.

Technical explainability has limits. Some complex models are difficult to interpret, but a simpler model is not automatically more accurate or fair. Privacy-enhancing techniques can reduce exposure but may also reduce utility or complicate audit. De-identification is vulnerable to linkage attacks when datasets are combined. Certification can provide useful evidence but cannot guarantee safe outcomes in every context.

There is also a danger of compliance theatre: producing policies, dashboards, or impact assessments without changing decisions or controls. Effective governance connects documentation to authority, resources, testing, monitoring, and consequences for non-compliance.

12. Professional Best Practices

A diploma-level cybersecurity practitioner should be able to contribute to the following practices:

• maintain an accurate inventory of AI models, IoT assets, data stores, algorithms, suppliers, and cryptographic dependencies;
• apply secure-by-design and privacy-by-design principles from project initiation;
• classify systems according to impact and legal context;
• document data sources, purposes, retention, access, and quality limitations;
• test security, accuracy, accessibility, robustness, and group performance;
• preserve logs that support investigation without collecting unnecessary personal data;
• establish incident, rollback, appeal, and business-continuity procedures;
• use contracts to require security updates, vulnerability disclosure, audit access, documentation, and breach notification;
• review systems after major changes and at defined intervals;
• provide staff training and ensure that responsibility is assigned to named roles;
• monitor regulatory developments and obtain specialist legal advice for high-impact uses;
• plan cryptographic agility and long-term protection against quantum threats.

The future of cyber regulation will likely combine binding legal duties, technical standards, assurance schemes, procurement requirements, professional practice, and international cooperation. Organisations that treat regulation as a lifecycle engineering requirement will be better prepared than those that respond only after an incident or enforcement action.

Chapter Summary

AI and emerging technologies create both capability and risk. Effective cyber regulation must address the complete lifecycle of systems and the relationships among developers, deployers, suppliers, users, regulators, and affected individuals. AI governance requires attention to automated decisions, meaningful human oversight, explainability, bias, data quality, security, and appeal. Biometric systems require necessity, proportionality, template protection, accuracy testing, and special care because biological characteristics are difficult to replace.

IoT expands cyber risk into physical environments and requires secure-by-design, update, supply-chain, and safety controls. Blockchain can provide tamper-evident records but does not remove questions about privacy, legal responsibility, jurisdiction, key management, or smart-contract error. Quantum technologies make cryptographic inventory, crypto-agility, and post-quantum migration important. RegTech can improve compliance but cannot replace accountable human judgment.

Risk-based governance frameworks, impact assessments, documented accountability, independent assurance, continuous monitoring, and clear incident and appeal procedures provide practical foundations. Laws and standards differ by jurisdiction and legal status, so organisations must maintain a current regulatory register and obtain appropriate professional advice. The central principle is responsible innovation: technology should be deployed only when its benefits, risks, safeguards, and accountability arrangements are sufficiently understood.

Key Terms

AI system: A computational system that produces predictions, recommendations, content, or decisions.

Automated decision-making: Making or materially influencing a decision through automated processing.

Accountability: The obligation to accept responsibility and demonstrate how duties have been fulfilled.

Explainability: The extent to which an output or process can be meaningfully understood.

Bias: A systematic tendency that can produce inaccurate, unfair, or discriminatory outcomes.

Biometric data: Data concerning physical, physiological, or behavioural characteristics used for identification or authentication.

Biometric template: A derived representation used to compare biometric characteristics.

Internet of Things: A network of connected devices that sense, communicate, compute, or act.

Secure by design: Integrating security requirements into design rather than adding them later.

Blockchain: A distributed ledger using linked records and a consensus mechanism.

Smart contract: Software that executes specified rules or transactions, often on a distributed ledger.

Cryptographic agility: The ability to change cryptographic algorithms and parameters with manageable disruption.

Post-quantum cryptography: Cryptographic methods designed to resist attacks from quantum computers.

RegTech: Technology used to support regulatory compliance and reporting.

SupTech: Technology used by supervisory or regulatory authorities.

Impact assessment: A structured evaluation of legal, social, ethical, security, and operational effects.

Human oversight: Meaningful human capacity to understand, intervene in, review, or override a system.

Data minimisation: Collecting and using no more personal data than is necessary for a defined purpose.

Model drift: Change in model performance or data relationships after deployment.

Residual risk: Risk remaining after safeguards have been applied.

Review Questions

Short Answer Questions

1. Why is a technology-neutral approach useful in cyber regulation?
2. Distinguish transparency from explainability.
3. State two special risks associated with biometric data.
4. Why should organisations maintain a cryptographic inventory for quantum readiness?
5. What is the purpose of a regulatory impact assessment?

Long Answer Questions

1. Explain the governance requirements for a high-impact automated decision system.
2. Discuss how IoT creates distributed responsibility among manufacturers, suppliers, owners, and operators.
3. Analyse the privacy and accountability challenges of using blockchain for personal records.
4. Compare the benefits and limitations of RegTech in compliance management.
5. Explain how risk-based regulation can support innovation while protecting individuals and society.

Analytical / Application Questions

1. A university proposes facial recognition for attendance monitoring. Assess the proposal using necessity, proportionality, accuracy, privacy, security, accessibility, and appeal criteria. Recommend whether and how it should proceed.
2. A manufacturer sells connected medical devices but provides security updates for only one year. Identify the principal legal, safety, supply-chain, and governance risks and propose contractual and technical controls.
3. An organisation stores encrypted customer archives for twenty years. Develop a high-level quantum-readiness plan, including inventory, prioritisation, migration, testing, and governance responsibilities.

Multiple Choice Questions with Answers

Question 1

Which statement best describes meaningful human oversight of an automated decision?

A. A person automatically approves every system output

B. A person has the competence, authority, information, and opportunity to review and override the output

C. The system is trained using data collected by humans

D. The organisation publishes the model’s programming language

Correct Answer: B. A person has the competence, authority, information, and opportunity to review and override the output

Question 2

Why are biometric credentials difficult to replace after compromise?

A. They are always stored publicly

B. They cannot be encrypted

C. They are linked to relatively permanent physical or behavioural characteristics

D. They require no authentication process

Correct Answer: C. They are linked to relatively permanent physical or behavioural characteristics

Question 3

Which IoT control most directly supports continued security after vulnerabilities are discovered?

A. A decorative device label

B. Authenticated and maintainable software updates

C. Removing all device logs

D. Using identical default passwords

Correct Answer: B. Authenticated and maintainable software updates

Question 4

What is a major concern created by storing personal data directly on a public blockchain?

A. The data may be difficult to correct or delete

B. The data automatically becomes anonymous

C. The ledger cannot be replicated

D. Consensus eliminates all legal obligations

Correct Answer: A. The data may be difficult to correct or delete

Question 5

What does cryptographic agility mean?

A. The ability to change cryptographic algorithms with manageable disruption

B. The ability to make any password permanent

C. The removal of encryption from legacy systems

D. The use of only one approved algorithm forever

Correct Answer: A. The ability to change cryptographic algorithms with manageable disruption

Question 6

Which statement about quantum computing and cryptography is most accurate?

A. Quantum computing instantly breaks every security control

B. Quantum computing affects all symmetric and asymmetric algorithms identically

C. Sufficiently capable quantum computers may threaten some widely used public-key schemes

D. Quantum computing removes the need for endpoint authentication

Correct Answer: C. Sufficiently capable quantum computers may threaten some widely used public-key schemes

Question 7

What is a central danger of poorly designed RegTech?

A. It guarantees that laws are interpreted correctly

B. It can automate flawed rules and create false assurance

C. It prevents all human involvement in compliance

D. It makes audit evidence unnecessary

Correct Answer: B. It can automate flawed rules and create false assurance

Question 8

Which factor can create bias even when a protected attribute is excluded from an AI model?

A. A proxy variable correlated with the protected attribute

B. A documented model version

C. An authenticated software update

D. A data-retention schedule

Correct Answer: A. A proxy variable correlated with the protected attribute

Question 9

Which framework activity focuses on understanding the context, impacts, and risks of an AI system?

A. Mapping

B. Disposal

C. Tokenisation

D. Compression

Correct Answer: A. Mapping

Question 10

Why is a model risk score not necessarily proof of fraud or wrongdoing?

A. Scores are always random numbers

B. A prediction expresses estimated risk and may contain errors or reflect biased data

C. Models cannot process numerical information

D. Fraud can only be identified by blockchain

Correct Answer: B. A prediction expresses estimated risk and may contain errors or reflect biased data