Ethics, Governance and Responsible Analytics

Introduction

Data-driven decision making can improve forecasting, service delivery, operational efficiency, and strategic planning. Yet analytical capability also creates responsibilities. A model may expose private information, reproduce historical discrimination, make decisions that affected people cannot understand, or create security and regulatory risks. Ethical analytics therefore concerns more than whether a model is accurate. It asks whether data were obtained legitimately, whether decisions are fair and proportionate, whether systems are secure, whether responsibility is clearly assigned, and whether affected people can challenge outcomes.

Responsible analytics is the disciplined integration of ethical principles, governance structures, technical controls, legal requirements, and organizational accountability throughout the data and model life cycle. It is not a final approval step added after development. It begins when a business problem is defined and continues through data collection, preparation, analysis, deployment, monitoring, retirement, and record retention.

For business analysts, these issues are strategic. Trust affects customer relationships, employee acceptance, regulatory exposure, brand reputation, and the sustainability of analytical investments. A technically sophisticated organization that cannot explain or govern its models may create greater risk than an organization using simpler but transparent methods.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain privacy, consent, security, fairness, accountability, transparency, and regulatory compliance in analytics.
2. Distinguish data ownership, stewardship, custodianship, and subject rights.
3. Apply a life-cycle model for responsible analytics and model governance.
4. Identify common sources of bias and select suitable fairness controls.
5. Design practical controls for documentation, validation, monitoring, auditability, and human oversight.
6. Evaluate an applied analytics case from ethical, governance, operational, and regulatory perspectives.

1. Why Responsible Analytics Matters

Analytics converts observations into classifications, predictions, recommendations, or actions. Each conversion introduces choices: what to measure, which records to include, how to define success, which errors matter most, and who may act on the result. These choices are not value-neutral.

Consider a model used to prioritize applications for a scarce public service. High predictive accuracy may coexist with unequal error rates across communities. A fraud-detection system may reduce losses while wrongly blocking legitimate customers. An employee-monitoring system may improve attendance while intruding into personal life and damaging trust. In each case, the relevant question is not simply “Does the model work?” but “For whom, under what conditions, with what consequences, and subject to whose authority?”

A useful distinction is between validity and legitimacy. Validity concerns whether a method measures or predicts what it claims to measure or predict. Legitimacy concerns whether using the method is justified, authorized, proportionate, and consistent with rights and institutional obligations. A model can be statistically valid but illegitimate if it uses data without a proper legal basis or makes decisions that should remain subject to human judgment.

Responsible analytics has four interdependent dimensions:

• Individual protection: privacy, autonomy, dignity, consent, and protection from harmful decisions.
• Organizational control: ownership, accountability, security, documentation, and compliance.
• Technical quality: data quality, robustness, explainability, fairness testing, and monitoring.
• Social legitimacy: transparency, contestability, inclusion, and public or stakeholder trust.

2. Core Ethical Principles

Privacy and data minimization

Privacy is the appropriate control of information about identifiable or reasonably identifiable people. It includes confidentiality, control over personal information, freedom from unjustified surveillance, and appropriate limits on secondary use.

Privacy protection is not achieved merely by removing names. Quasi-identifiers—such as age, location, occupation, and transaction time—can sometimes be combined to re-identify individuals. Aggregation, pseudonymization, access controls, retention limits, and privacy-preserving computation may reduce risk, but each has limitations. Pseudonymized data remain potentially personal where a person can be reidentified using additional information.

Data minimization means collecting and retaining only data that are adequate, relevant, and necessary for a specified purpose. Analysts should be able to answer:

• What decision requires this variable?
• Is the variable collected directly or inferred?
• Could a less sensitive variable serve the same purpose?
• How long must the data be retained?
• Who needs access, and at what level of detail?

Minimization reduces privacy exposure, storage costs, attack surfaces, and the possibility of inappropriate reuse.

Consent and lawful purpose

Consent is an informed, specific, freely given, and revocable expression of permission. It should not be treated as a universal solution. Consent may be invalid where individuals lack a genuine choice, where the purpose is vague, or where the organization collects excessive information. In many legal systems, organizations may process data under several possible legal bases, such as contract, legal obligation, legitimate interests, or public task; the applicable basis depends on jurisdiction and context.

A sound consent process explains the purpose, data categories, retention period, sharing arrangements, material risks, and withdrawal mechanism in understandable language. Consent obtained for customer support does not automatically authorize unrelated behavioral profiling. Analysts must also consider whether data were obtained from third parties and whether the original purpose permits the proposed use.

Security

Security protects confidentiality, integrity, and availability. Confidentiality prevents unauthorized disclosure; integrity protects data and model correctness; availability ensures that authorized users can access systems when needed. Security controls should include identity and access management, least privilege, encryption in transit and at rest, secure development, vulnerability management, logging, backup and recovery, incident response, and supplier oversight.

Analytics creates distinctive security risks. Training data may contain sensitive attributes; notebooks may expose credentials; application programming interfaces may reveal predictions; model inversion or membership-inference attacks may disclose information about training records; and data poisoning may corrupt a model. Security must therefore cover datasets, code, infrastructure, interfaces, model artifacts, and human processes.

Fairness and non-discrimination

Fairness means that analytical systems do not produce unjustified or unlawful disadvantage and that relevant groups receive appropriate consideration. It is not a single mathematical property. Different definitions can conflict, particularly when groups have different base rates.

Important concepts include:

• Disparate treatment: intentionally treating people differently because of a protected characteristic.
• Disparate impact: a seemingly neutral rule produces substantially worse outcomes for a protected group.
• Proxy discrimination: a variable such as postcode or language indirectly encodes a protected attribute.
• Representational harm: a system stereotypes, excludes, or misrepresents a group.
• Allocative harm: a system distributes opportunities, services, or resources unfairly.

Fairness assessment should examine the entire process, not just the final model. Bias may enter through sampling, labels, measurement, missingness, historical decisions, feature engineering, thresholds, human overrides, or deployment conditions.

Common group metrics include selection rate and true-positive rate. For group g:

Selection-rate comparisons are useful for detecting unequal access, while true-positive-rate comparisons show whether qualified cases are identified equally. These metrics do not prove fairness. They require a defined decision context, reliable group labels where lawful and appropriate, sufficient sample sizes, and careful consideration of legitimate differences in risk or need. Fairness criteria may conflict; improving one metric can worsen another. Consequently, fairness is a governance judgment supported by measurement, not a claim established by one number.

Accountability and responsibility

Accountability means that an organization can identify who is answerable for a system, explain decisions, demonstrate compliance, and provide remedies. “The algorithm decided” is not an acceptable allocation of responsibility. A model has no legal or moral agency; people and institutions design, approve, deploy, and use it.

Accountability requires named roles, decision rights, escalation routes, documentation, evidence, and consequences for non-compliance. It also requires contestability: affected individuals should have a meaningful route to ask questions, correct inaccurate information, request review, and challenge harmful outcomes where appropriate.

Transparency and explainability

Transparency concerns disclosure about what a system does, why it is used, what data it relies upon, who operates it, and what limitations apply. Explainability concerns the ability to communicate how an output was produced at a level suitable for the audience.

Different audiences need different explanations. A senior manager may need performance, risk, and approval status. A data scientist may need features, validation design, and drift statistics. An affected customer may need the principal factors influencing a decision, the data used, the method for correction, and the appeal process. Technical complexity does not remove the obligation to provide an understandable explanation.

Transparency must not become misleading disclosure. Publishing a model card without explaining operational use, limitations, or appeal rights creates the appearance rather than the substance of accountability.

3. Governance Architecture for Analytics

Governance is the system of authority, policies, standards, roles, controls, and evidence through which data and analytical systems are directed and supervised. It should be proportionate to risk. A low-risk descriptive dashboard does not require the same approval process as an automated system that determines employment, credit, insurance, healthcare access, or public benefits.

Data ownership and stewardship

Ownership is an organizational accountability concept, not necessarily a claim that a person loses rights over information once it is collected. A data owner is accountable for the purpose, acceptable use, access rules, quality expectations, and risk of a data domain. A data steward manages definitions, metadata, quality issues, classification, and day-to-day policy implementation. A data custodian operates technical storage, backup, access, and security controls. A data subject is the person to whom personal data relate and may possess legal rights regardless of organizational ownership.

A data ownership register should record the domain, owner, steward, source, classification, permitted uses, retention schedule, quality rules, sharing restrictions, and escalation contact. Clear ownership prevents orphaned datasets that are widely reused but poorly governed.

The analytics and model life cycle

A practical governance life cycle contains the following stages:

1. Purpose definition: specify the decision, affected parties, expected benefit, alternatives, and unacceptable uses.
2. Risk classification: assess sensitivity, scale, reversibility, vulnerability of affected groups, and degree of automation.
3. Data assessment: document provenance, consent or legal basis, quality, representativeness, sensitive attributes, and retention.
4. Design and development: select features and methods, record assumptions, test security and fairness, and preserve reproducible code.
5. Validation and approval: conduct independent review, challenge assumptions, test performance by relevant subgroups, and obtain authorized sign-off.
6. Deployment: control access, communicate limitations, establish human roles, and test integration with operational processes.
7. Monitoring: track performance, drift, fairness, incidents, complaints, overrides, and unintended outcomes.
8. Change and retirement: reapprove material changes, archive evidence, withdraw obsolete models, and dispose of data securely.

Figure: A responsible analytics life cycle with governance controls operating continuously.

Model governance and the model inventory

Model governance is the controlled management of analytical models from conception to retirement. A model inventory should assign each model a unique identifier and record its purpose, owner, version, training data, features, target variable, assumptions, performance, limitations, risk classification, dependencies, approval status, deployment location, monitoring plan, and retirement date.

Independent validation is especially important for high-impact models. Validation should challenge the development team’s data, methodology, assumptions, performance claims, and implementation. It should test out-of-sample performance, subgroup performance, sensitivity to plausible changes, and the consequences of errors. Approval should be conditional: a model may be authorized only for a defined purpose, population, geography, time period, and decision authority.

4. Auditability and Documentation

Auditability is the ability to reconstruct what happened, why it happened, who authorized it, and what evidence supports the decision. Auditability requires more than keeping final outputs. Essential records include:

• source and transformation history, often called data lineage;
• versioned code, parameters, features, and model artifacts;
• training, validation, and test data descriptions;
• approval records and risk assessments;
• access logs and changes to permissions;
• prediction, override, complaint, and incident records;
• monitoring results and remediation actions;
• explanations and notices provided to affected people.

Documentation should be usable, current, and proportionate. A model card can summarize intended use, out-of-scope use, evaluation data, performance, subgroup results, limitations, and ethical considerations. A data sheet can describe dataset motivation, composition, collection process, preprocessing, recommended uses, and known gaps. These instruments do not replace governance, but they make review more systematic.

A basic audit trail might record: model version, input-data version, timestamp, decision output, human reviewer, explanation code, action taken, and any appeal. Logs must themselves be protected because they may contain sensitive information. Retention should follow legal and operational requirements rather than indefinite accumulation.

5. Regulatory Compliance as a Management Practice

Regulatory requirements vary by jurisdiction, industry, and use case. A responsible analyst must identify applicable obligations rather than assume that one general privacy law answers every question. Relevant regimes may include data-protection and privacy laws, employment and consumer-protection law, sectoral requirements in finance or healthcare, cybersecurity and breach-notification rules, records-management obligations, accessibility requirements, and emerging artificial-intelligence regulation.

A compliance assessment should ask:

1. What data are processed, and are any sensitive or special categories involved?
2. What is the documented purpose and lawful basis?
3. Are notices, consent, access, correction, deletion, objection, or portability rights relevant?
4. Is automated decision-making restricted or subject to explanation and human review?
5. Are cross-border transfers, vendors, or subprocessors involved?
6. What security, retention, breach-response, and audit obligations apply?
7. Is a privacy or algorithmic impact assessment required before deployment?

Compliance is a minimum floor, not the complete ethical standard. A practice may be technically lawful yet damaging to dignity, trust, or equality. Conversely, ethical design often helps compliance by producing evidence, clear purposes, access controls, and documented decisions.

6. Responsible AI Controls

Artificial intelligence systems require controls suited to their scale, adaptability, and potential opacity. The following control set is practical for business organizations:

• Use-case approval: prohibit high-risk uses unless necessity, proportionality, alternatives, and safeguards are documented.
• Human oversight: define when a human must review, override, pause, or reject a system output. Human involvement must be meaningful, not a nominal rubber stamp.
• Input and output controls: validate inputs, restrict sensitive features, detect anomalous requests, and prevent unsafe or unauthorized outputs.
• Evaluation: test accuracy, calibration, robustness, subgroup outcomes, privacy leakage, security, and failure modes before and after deployment.
• Monitoring: establish thresholds and triggers for drift, unequal outcomes, rising complaints, data-quality deterioration, or incident frequency.
• Change management: require review when data sources, features, model architecture, decision thresholds, or operating contexts change.
• Procurement controls: require vendors to disclose intended use, data practices, performance evidence, security measures, subcontractors, update procedures, and audit rights.
• Incident response: define reporting, containment, investigation, notification, remediation, and learning procedures.
• Redress: offer a route to correct records, obtain review, and receive a timely remedy.

Generative AI introduces additional risks, including fabricated outputs, confidential-data disclosure, copyright or licensing uncertainty, prompt injection, and inconsistent responses. Organizations should define approved tools, prohibit uploading restricted data to unapproved services, require source verification, label generated content where appropriate, and maintain human accountability for published or consequential outputs.

7. A Worked Fairness Assessment

Suppose a recruiting-screening system recommends candidates for interview. In one month, the results are:

The selection rate for Group A is:

For Group B:

The selection-rate ratio of Group B to Group A is:

Thus, Group B is recommended at about 67% of the rate of Group A. This is a signal for investigation, not proof of unlawful discrimination. The analyst should examine job-relatedness of features, historical hiring patterns, missing data, applicant pools, threshold choices, and whether the groups are comparable in relevant qualifications.

The true-positive rate for Group A is:

For Group B:

The model identifies only 30% of qualified Group B applicants compared with 60% of qualified Group A applicants. Possible responses include checking label quality, removing unjustified proxies, improving representation in training data, revising the target definition, testing alternative thresholds, adding structured human review, and suspending the system while material unfairness is investigated. Any intervention should be evaluated for accuracy, fairness, operational feasibility, and legal consequences.

8. Illustrative Case: Credit-Limit Recommendations

Background

A fictional retail bank, Northbridge Bank, introduces a machine-learning system to recommend credit-limit increases. The model uses repayment history, account activity, income information, and location-based variables. It improves predicted repayment performance during pilot testing.

Problem

After deployment, customer-service staff observe that customers in several lower-income districts receive fewer increases. Customers cannot determine why they were declined. An internal review finds that a location variable is strongly associated with neighborhood wealth and may operate as a proxy for protected characteristics. The bank’s model inventory is incomplete, and no documented appeal process exists.

Analysis

The model may have predictive value, but the bank has weaknesses in purpose limitation, proxy-risk assessment, transparency, governance, and contestability. A high-level accuracy score does not establish fair access to credit. The bank must also consider whether the model’s data are current, whether income is measured consistently, and whether historical decisions encode earlier discrimination.

Approach and solution

Northbridge pauses automatic increases for customers in affected segments and forms a cross-functional review group including credit risk, compliance, privacy, data science, customer service, security, and independent validation. The group:

1. documents the model’s intended purpose and prohibited uses;
2. inventories all variables, vendors, transformations, and versions;
3. tests selection, approval, error, and calibration outcomes across relevant groups;
4. investigates location as a proxy and evaluates less intrusive alternatives;
5. introduces a reason-code explanation that accurately reflects principal decision factors;
6. creates a human review and appeal route for disputed decisions;
7. establishes monitoring thresholds for subgroup outcomes, drift, complaints, and overrides;
8. requires reapproval after material changes and schedules periodic independent audits.

The bank also improves data-quality controls and limits access to sensitive information. It does not simply remove protected attributes from the model, because those attributes may be needed for fairness testing; instead, access and use are governed, and the legal basis is documented.

Outcome

The revised system produces a modestly lower aggregate approval lift but materially improves consistency of outcomes and explanation quality. Customers can request review, and managers can identify changes in subgroup performance earlier. The bank accepts that some predictive performance may be traded for legitimacy, controllability, and reduced regulatory risk.

Learning points

The case demonstrates that responsible analytics is a business process, not only a modeling exercise. Fairness requires examining proxies and outcomes, not merely deleting protected variables. Transparency must support action by customers and employees. Governance must assign ownership, preserve evidence, and provide intervention mechanisms before harm becomes systemic.

9. Implementation Blueprint for Analysts

An analyst can operationalize responsible analytics with a concise control checklist:

Before data collection: define the purpose, affected people, necessity, legal basis, retention, and risks. Identify whether an impact assessment is required.

Before modeling: document provenance, quality, representativeness, sensitive variables, proxy risks, target-label construction, and approved users. Establish a baseline and explain why the proposed model is necessary.

Before deployment: complete independent validation, subgroup testing, security review, privacy review, user acceptance testing, and approval. Define human oversight, communication, appeal, monitoring, and rollback procedures.

During operation: monitor performance and fairness by relevant groups, data drift, missingness, security events, overrides, complaints, and unexpected uses. Escalate threshold breaches and record actions.

At change or retirement: reassess material changes, revoke obsolete access, preserve required evidence, notify stakeholders where necessary, and securely delete or archive data according to policy and law.

A useful governance principle is proportionality: the greater the potential impact, scale, sensitivity, irreversibility, and vulnerability involved, the stronger the required controls. A fully automated recommendation for a music playlist and an automated decision affecting housing eligibility should not be governed identically.

10. Challenges and Limitations

Responsible analytics faces practical tensions. Privacy may reduce available data and affect model performance. Fairness interventions may conflict with one another or with legal restrictions on collecting protected attributes. Explanations may be difficult for complex models and may expose security-sensitive information. Human review can introduce inconsistency, automation bias, or additional discrimination. Documentation can become outdated as models and data change. Small subgroup samples may make estimates unstable, while excessive aggregation can hide material differences.

There is also a danger of ethics-washing: adopting principles and labels without changing incentives, authority, or operational behavior. Effective governance requires resources, independent challenge, leadership commitment, staff training, and willingness to stop or redesign a system. Metrics should support judgment rather than create a false impression that ethical questions have been completely solved numerically.

Contemporary Developments and Professional Implications

Organizations are moving toward risk-based AI management, algorithmic impact assessments, privacy-enhancing technologies, continuous controls monitoring, and stronger contractual requirements for analytics vendors. Privacy-enhancing approaches may include federated learning, secure multiparty computation, differential privacy, and synthetic data, but each involves trade-offs in utility, complexity, and residual disclosure risk. These technologies supplement rather than replace lawful purpose, access control, and accountability.

Business analysts increasingly need hybrid capabilities: data literacy, process understanding, stakeholder communication, basic security awareness, regulatory reasoning, and the ability to challenge unjustified assumptions. Employability depends not only on building dashboards or models but also on explaining limitations, documenting decisions, identifying harm, and escalating risks responsibly.

Chapter Summary

Responsible analytics integrates privacy, consent, security, fairness, accountability, transparency, and compliance across the entire data and model life cycle. Privacy requires purpose limitation, minimization, appropriate access, retention controls, and recognition that pseudonymization does not eliminate risk. Consent must be informed, specific, freely given, and appropriate to the intended use.

Security protects confidentiality, integrity, and availability across data, code, infrastructure, models, and interfaces. Fairness is context-dependent and should be examined through data provenance, labels, features, proxies, subgroup outcomes, and operational decisions. Selection rates and true-positive rates can reveal disparities, but no single metric proves fairness.

Governance assigns data owners, stewards, custodians, and model owners; maintains inventories; requires independent validation; preserves audit trails; and establishes monitoring, change control, human oversight, appeal, and retirement procedures. Regulatory compliance is a minimum obligation that must be translated into operational controls. Responsible AI requires proportionate, risk-based controls and meaningful accountability. The strategic outcome is not merely a more accurate model, but trustworthy decision making that is defensible, inclusive, secure, and capable of correction.

Key Terms

Accountability: The duty to answer for decisions, demonstrate compliance, and provide remedies.

Auditability: The ability to reconstruct decisions, actions, authorizations, and supporting evidence.

Consent: Informed, specific, freely given, and revocable permission for a defined use.

Data custodian: The party responsible for technical operation, storage, access, and protection of data.

Data minimization: Collecting and retaining only data necessary for a specified purpose.

Data owner: The person or function accountable for a data domain’s purpose, access, quality, and risk.

Data steward: The role managing definitions, metadata, quality, and implementation of data policies.

Data subject: An identifiable person to whom personal data relate.

Disparate impact: Unequal adverse effects produced by an apparently neutral rule or system.

Explainability: The ability to communicate how an analytical output was produced.

Fairness: The avoidance of unjustified or unlawful disadvantage in analytical processes and outcomes.

Human oversight: Meaningful human authority to review, intervene in, override, or stop a system.

Model governance: The controlled management of models from development through retirement.

Model inventory: A structured register of models, owners, purposes, versions, risks, and approvals.

Pseudonymization: Replacing direct identifiers while retaining a possibility of reidentification.

Proxy discrimination: Indirect discrimination through variables associated with protected characteristics.

Purpose limitation: Using data only for specified, legitimate, and compatible purposes.

Transparency: Clear communication about a system’s purpose, operation, limits, and accountability.

True-positive rate: The proportion of actual positive cases correctly identified by a system.

Review Questions

Short Answer Questions

1. Why is predictive accuracy insufficient to establish that an analytical system is responsible?
2. Distinguish a data owner, data steward, and data custodian.
3. What is data minimization, and how can it reduce organizational risk?
4. Explain the difference between disparate treatment and disparate impact.
5. Name four elements that should appear in a model inventory.

Long Answer Questions

1. Explain how privacy, consent, security, and transparency interact across the analytics life cycle.
2. Discuss why fairness cannot be established by relying on one numerical metric.
3. Design a proportionate governance framework for an analytics system used in employee recruitment.
4. Explain the role of independent validation, monitoring, audit trails, and human oversight in model governance.
5. Evaluate the claim that regulatory compliance is equivalent to ethical analytics.

Analytical / Application Questions

1. A service-prioritization model selects 45% of Group A applicants and 30% of Group B applicants. Calculate the selection-rate ratio for Group B relative to Group A and identify three additional investigations required before concluding that the model is unfair.
2. A retailer wants to use loyalty-card data collected for discounts to predict customers’ health-related purchases. Analyze the privacy, consent, purpose-limitation, security, and governance issues and recommend a decision process.
3. An AI vendor refuses to provide training-data information or meaningful explanations but claims superior accuracy. Develop a procurement and deployment response that protects accountability, auditability, fairness, and customer redress.

Multiple Choice Questions with Answers

Question 1

Which principle requires an organization to collect only information necessary for a specified purpose?

A. Data minimization

B. Model calibration

C. Human oversight

D. Data duplication

Correct Answer: A. Data minimization

Question 2

Which role is primarily accountable for the purpose, access rules, and risk of a data domain?

A. Data subject

B. Data owner

C. Data custodian

D. External auditor

Correct Answer: B. Data owner

Question 3

What does a true-positive rate measure?

A. The percentage of all predictions that are correct

B. The percentage of actual positive cases correctly identified

C. The percentage of negative cases correctly rejected

D. The percentage of records containing complete data

Correct Answer: B. The percentage of actual positive cases correctly identified

Question 4

Why can removing a protected attribute fail to eliminate discrimination?

A. Models cannot operate without protected attributes

B. Other variables may act as proxies for that attribute

C. Removing variables always increases selection rates equally

D. Protected attributes are never relevant to fairness testing

Correct Answer: B. Other variables may act as proxies for that attribute

Question 5

Which practice most directly supports auditability?

A. Deleting all intermediate versions

B. Keeping versioned code, data lineage, approvals, and access logs

C. Using a more complex algorithm

D. Allowing undocumented manual overrides

Correct Answer: B. Keeping versioned code, data lineage, approvals, and access logs

Question 6

What is the main purpose of independent model validation?

A. To replace all business judgment

B. To challenge assumptions, methods, performance, and implementation

C. To guarantee that no model will ever fail

D. To increase the number of model features

Correct Answer: B. To challenge assumptions, methods, performance, and implementation

Question 7

Which statement best describes meaningful human oversight?

A. A person formally approves every output without reviewing it

B. A person has authority and ability to review, override, pause, or reject outputs

C. A model is trained using human-generated data

D. A system sends an automated notification to a manager

Correct Answer: B. A person has authority and ability to review, override, pause, or reject outputs

Question 8

A system selects 200 of 1,000 Group A applicants and 90 of 600 Group B applicants. What is the selection-rate ratio for Group B relative to Group A?

A. 0.50

B. 0.75

C. 1.00

D. 1.33

Correct Answer: B. 0.75

Question 9

Which statement about regulatory compliance is most accurate?

A. Compliance always proves that a system is ethical

B. Compliance is irrelevant when a model is accurate

C. Compliance is a minimum obligation and may not resolve all ethical concerns

D. Compliance applies only after a system causes harm

Correct Answer: C. Compliance is a minimum obligation and may not resolve all ethical concerns

Question 10

Which control is especially relevant when a generative AI tool may expose confidential organizational information?

A. Allowing unrestricted uploads for convenience

B. Prohibiting restricted data in unapproved tools and controlling access

C. Removing all human review from generated content

D. Retaining every prompt indefinitely without protection

Correct Answer: B. Prohibiting restricted data in unapproved tools and controlling access