Cybersecurity, AI Ethics and Digital Governance

Introduction

Digital supply chains connect manufacturers, logistics providers, distributors, retailers, financial institutions, platforms and customers through shared data and automated decisions. This connectivity creates value through visibility, coordination and prediction, but it also creates concentration of risk. A compromised supplier account can interrupt production; an inaccurate demand model can distort purchasing; an opaque routing algorithm can disadvantage a carrier; and an unauthorised use of operational data can expose commercially sensitive information.

Cybersecurity, AI ethics and digital governance therefore cannot be treated as separate compliance activities. They are mutually reinforcing capabilities. Cybersecurity protects the confidentiality, integrity and availability of information and systems. AI ethics addresses whether automated systems are fair, explainable, safe and socially acceptable. Digital governance establishes decision rights, controls, accountability, standards and assurance mechanisms across the ecosystem.

For supply-chain managers, the central question is not simply whether a technology works. It is whether the technology works reliably, lawfully and responsibly within a network in which data, decisions and accountability cross organisational boundaries.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain cybersecurity, privacy, AI ethics and digital governance in a supply-chain context.
2. Identify threats and assess risks across interconnected supply-chain partners.
3. Design controls for data sharing, access management, resilience and third-party risk.
4. Evaluate algorithmic bias, explainability, human oversight and accountability.
5. Apply governance frameworks to AI procurement, deployment, monitoring and retirement.
6. Recognise relevant regulatory and contractual obligations without assuming that one jurisdictional rule applies everywhere.
7. Develop audit evidence, incident-response arrangements and responsible-AI controls.

1. The digital supply-chain risk landscape

A digital supply chain is a socio-technical system: people, processes, technologies, contracts and institutions interact to produce outcomes. Risk can arise from any of these elements and can propagate through the network.

Typical assets include supplier master data, bills of material, inventory records, transport plans, customer information, pricing data, production recipes, trade secrets, credentials, application interfaces and machine-generated forecasts. Typical threat sources include criminals, state-sponsored actors, malicious insiders, careless users, compromised vendors and accidental system failures.

The familiar cybersecurity objectives are:

• Confidentiality: information is accessible only to authorised parties.
• Integrity: information and system behaviour remain accurate and unaltered except through authorised processes.
• Availability: systems and information are accessible when needed.
• Authenticity: users, devices, messages and data sources are genuine.
• Non-repudiation: actions and transactions can be reliably attributed and evidenced.

A supply-chain risk assessment should examine both direct and cascading effects. A ransomware event at a third-party warehouse-management provider may affect not only that provider but also inventory visibility, customer promises, replenishment decisions and regulatory reporting. Consequently, risk should be assessed in business terms, not only as a count of technical vulnerabilities.

A useful prioritisation concept is expected loss:

Here, E(L) is expected loss over a defined period, pᵢ is the probability of scenario i, and Iᵢ is its impact, expressed in a consistent monetary or scoring unit. The expression assumes that scenarios are sufficiently defined and that probabilities and impacts are estimated on a comparable basis. It is a decision-support measure, not a precise prediction. Where scenarios are dependent, simply adding expected losses may understate correlated or systemic risk.

Impact should include operational interruption, safety consequences, legal exposure, regulatory penalties, lost revenue, recovery cost, reputational damage and harm to affected individuals. A low-frequency event with severe safety consequences may require stronger controls than a high-frequency event with modest financial impact.

2. Governance architecture and accountability

Digital governance answers five questions:

1. Who owns the decision?
2. What rules and standards apply?
3. What evidence must be produced?
4. How are exceptions approved?
5. How are performance and harm monitored?

A practical governance architecture usually includes the board or executive risk committee, a chief information or security officer, data and privacy leadership, procurement, legal counsel, operations, internal audit, model owners and business users. Governance should not be concentrated exclusively in the IT function because many risks arise from business design choices, such as selecting a supplier with inadequate controls or deploying a model without a meaningful appeal process.

A responsibility matrix is useful. The accountable executive owns the outcome; the responsible team performs the work; consulted specialists provide expertise; and informed stakeholders receive relevant information. For a high-impact supplier-screening model, procurement may be accountable for the business decision, data science responsible for model maintenance, legal and privacy officers consulted, and affected suppliers informed about relevant procedures.

Governance should operate across the technology life cycle:

The three-lines model is often appropriate. Operational teams constitute the first line and own risks. Risk, compliance and security functions form the second line by setting standards and challenging decisions. Internal audit is the third line, providing independent assurance. External auditors, regulators and certification bodies may provide additional scrutiny but do not replace management accountability.

3. Cybersecurity controls for connected supply chains

Identity, access and trust

Identity is the control plane of a networked supply chain. Organisations should use unique identities, multi-factor authentication, least privilege, segregation of duties and time-limited privileged access. Supplier access should be limited by role, system, data field and transaction type. Shared accounts undermine attribution and should be prohibited except where technically unavoidable and tightly controlled.

Zero-trust principles are relevant: no user, device or network location is automatically trusted; each request is authenticated, authorised and evaluated against context. Context may include device health, location, time, transaction value and behavioural anomalies. Access should be reviewed periodically and immediately upon role change or contract termination.

Data protection and secure exchange

Data should be classified according to sensitivity and business criticality. Controls may include encryption in transit and at rest, tokenisation, data-loss prevention, retention limits, secure application programming interfaces and immutable audit logs. Data minimisation means collecting and using only what is necessary for the stated purpose. It reduces both privacy exposure and the consequences of compromise.

Data-sharing agreements should specify purpose, data fields, quality obligations, permitted users, onward transfer, retention, deletion, security standards, breach notification, audit rights, intellectual-property ownership and liability. A data-sharing arrangement is not merely a technical interface; it is a distribution of rights and responsibilities.

Resilience and incident response

Resilience requires preparation for degraded operation, not only prevention. Organisations should identify critical processes, maximum tolerable disruption and recovery priorities. Two related concepts are useful:

• Recovery time objective (RTO): the maximum acceptable time to restore a service.
• Recovery point objective (RPO): the maximum acceptable amount of data loss measured in time.

For example, an RTO of four hours and an RPO of fifteen minutes mean that service should be restored within four hours and recovered data should normally be no more than fifteen minutes old. These are management requirements, not guarantees; their feasibility depends on architecture, contracts and testing.

An incident-response plan should define detection, triage, containment, eradication, recovery, communications, evidence preservation and post-incident learning. It should include supplier contacts, alternate communication channels, regulatory notification decision points and authority to isolate systems. Exercises should test realistic scenarios such as compromised credentials, ransomware at a logistics provider, manipulated inventory data and cloud-service outage.

4. Privacy, data ownership and responsible data sharing

Privacy concerns the lawful and fair handling of information relating to identified or identifiable people. Supply-chain data may appear operational but still contain personal information: driver location, employee performance, customer addresses, delivery histories, contact details and biometric access records.

A privacy-by-design approach embeds safeguards before deployment. Important practices include:

• identifying the purpose and legal basis for processing;
• minimising collection and retaining data only as long as justified;
• separating personal identifiers from analytical data where possible;
• documenting controller, processor and joint-controller roles where applicable;
• enabling access, correction, deletion or objection rights where legally required;
• assessing cross-border transfers and localisation requirements;
• conducting a privacy impact assessment for high-risk processing; and
• restricting secondary use, especially for training models.

Ownership is not the same as access. A customer may own or control certain data while granting a logistics platform a limited licence to process it. A supplier may contribute production data without transferring ownership of its underlying process knowledge. Contracts should distinguish raw data, derived data, aggregated data, model parameters, reports and intellectual property.

Privacy and cybersecurity overlap but are not identical. Encryption may protect data from unauthorised access, yet a lawful-looking use can still violate purpose limitation. Conversely, a privacy-compliant process can still be insecure. Both dimensions require separate assessment.

5. AI ethics in supply-chain decisions

AI ethics concerns the values and duties that should guide the design and use of automated systems. Four principles are especially important in supply chains:

1. Beneficence and safety: the system should create legitimate value and avoid foreseeable harm.
2. Non-maleficence: the organisation should prevent or reduce avoidable harm, including unsafe recommendations and discriminatory outcomes.
3. Fairness: similarly situated parties should be treated consistently, and relevant differences should be considered legitimately rather than through proxies for protected characteristics.
4. Respect for autonomy: people should receive appropriate information, choice and meaningful human involvement in consequential decisions.

These principles can conflict. A fraud model might reduce losses but generate more false alerts for small suppliers. A delivery optimisation model might improve average cost while systematically disadvantaging remote communities. Ethical analysis must therefore consider distributional effects, not only aggregate efficiency.

Algorithmic bias

Bias can enter through historical decisions, incomplete data, measurement error, sampling, proxy variables, labelling practices, model objectives or deployment conditions. Removing a protected attribute does not necessarily remove bias because correlated variables may act as proxies.

Fairness is context-dependent. Common statistical measures include selection-rate parity and error-rate comparisons. For a group g, the selection rate is:

where TP, FP, TN and FN are true positives, false positives, true negatives and false negatives for that group. More conventionally, the numerator is the number predicted positive, so the expression may be written clearly as:

This measure is meaningful only when the decision, labels and groups are defined appropriately. Selection-rate parity alone does not establish fairness: groups may have different base rates, costs of error or legitimate business circumstances. Fairness metrics can also conflict, particularly when base rates differ. Therefore, organisations should document the chosen fairness objective, affected parties, trade-offs and escalation process rather than claiming that one metric proves ethical performance.

Explainability and contestability

Explainability means providing an intelligible account of how a system reaches or supports an outcome. It has at least three levels:

• Global explanation: how the model generally behaves.
• Local explanation: why a particular case received a result.
• Process explanation: who approved the system, what data were used, what controls apply and how a decision can be challenged.

A technically sophisticated explanation is not necessarily useful to a warehouse worker or supplier. Explanations should be audience-appropriate, accurate, timely and actionable. High-impact decisions should provide a route for human review, correction of inaccurate data and appeal. Human oversight is meaningful only when the reviewer has authority, time, competence and access to relevant evidence; merely placing a person in a workflow does not guarantee oversight.

6. Intellectual property and data-related rights

AI systems may involve copyrighted documents, proprietary process data, software, database rights, trade secrets, patents and confidential information. Risks arise when training data are collected without permission, when a provider uses customer data to improve a shared model, or when generated outputs reproduce protected material.

Procurement and implementation teams should clarify:

• permitted training and fine-tuning uses;
• ownership and licence rights in inputs, outputs and adaptations;
• confidentiality and trade-secret safeguards;
• restrictions on reverse engineering and model extraction;
• open-source licence obligations;
• attribution and record-keeping duties; and
• remedies for infringement or unauthorised disclosure.

Law varies by jurisdiction and by the nature of the material. Contractual language should not assume that an organisation owns every output merely because it paid for a service. Legal review is particularly important where models process engineering drawings, formulations, source code, customer records or supplier quotations.

7. Third-party and ecosystem risk

Third-party risk includes suppliers, cloud providers, software vendors, consultants, freight platforms, data brokers, managed-service providers and subcontractors. A vendor may be secure in isolation but create exposure through its own fourth parties or through privileged integration into the buyer’s environment.

A risk-based due-diligence programme should examine:

• criticality of the service and substitutability;
• data categories and processing locations;
• access privileges and integration architecture;
• security governance, testing and vulnerability management;
• business continuity and disaster recovery;
• privacy and AI impact assessments;
• subcontractor controls;
• financial and operational resilience;
• incident history and notification capability; and
• exit, portability and deletion arrangements.

Contracts should translate expectations into measurable obligations. Examples include minimum security controls, audit and evidence rights, vulnerability-notification periods, breach notification, service levels, recovery tests, limits on data use, model-change notification, cooperation with investigations and termination assistance.

A vendor score should never be the sole basis of approval. A mature process combines documentation, interviews, technical testing, references, independent assurance reports and continuous monitoring. A certificate may provide evidence of a control environment, but it does not prove that every relevant control is effective for the buyer’s specific use.

8. Regulatory and standards landscape

Applicable requirements depend on jurisdiction, sector, data type and organisational role. Important reference points include:

• ISO/IEC 27001: information-security management systems.
• ISO/IEC 27701: privacy-information management guidance linked to an information-security management system.
• ISO/IEC 42001: management systems for artificial intelligence.
• NIST Cybersecurity Framework 2.0: a risk-management framework organised around Govern, Identify, Protect, Detect, Respond and Recover.
• NIST AI Risk Management Framework: guidance for governing, mapping, measuring and managing AI risks.
• EU General Data Protection Regulation: personal-data protection, rights, security and accountability requirements for relevant processing.
• EU AI Act: a risk-based regime whose obligations depend on the system, role and use case, with requirements phased according to the applicable provisions.
• NIS2: cybersecurity risk-management and reporting obligations for covered entities and sectors in the European Union.
• Digital Operational Resilience Act (DORA): digital operational-resilience requirements for covered financial entities and certain technology providers.

These instruments should be treated as a landscape rather than a universal checklist. A supply-chain organisation may be subject to several regimes simultaneously, while a small supplier may be indirectly affected through customer contracts. Legal counsel should map obligations to actual processing activities, system roles and geographic reach. Compliance is a baseline; it does not by itself establish ethical adequacy or operational resilience.

9. Responsible-AI control framework

A practical control framework can be organised into seven control families:

1. Inventory and classification: maintain a register of AI systems, owners, vendors, purposes, data sources, affected groups and risk classifications.
2. Impact assessment: evaluate privacy, safety, discrimination, security, labour, competition and environmental risks before approval.
3. Data governance: document provenance, permissions, quality, representativeness, retention and transformation.
4. Model governance: record assumptions, intended use, limitations, validation results, version changes and performance thresholds.
5. Human oversight: define approval points, intervention authority, escalation and appeal procedures.
6. Monitoring and incident management: monitor drift, performance, fairness, security, complaints and near misses.
7. Audit and retirement: preserve evidence, conduct independent reviews and securely decommission systems.

Useful monitoring measures may include forecast or classification performance, false-positive rates by relevant group, override rates, complaint resolution time, unresolved incidents, access violations, data-quality exceptions and supplier-control failures. Metrics must be interpreted in context. For example, a low override rate might indicate excellent automation or ineffective human review.

Model change control is essential. Changes to training data, features, objectives, thresholds, vendor versions or deployment context can alter risk even when the model name remains unchanged. Material changes should trigger regression testing and, where appropriate, renewed impact assessment and approval.

10. Audit mechanisms and evidence

An audit should test both design and operating effectiveness. Design effectiveness asks whether a control could address the stated risk. Operating effectiveness asks whether it worked consistently during the review period.

A defensible evidence trail may include the business case, risk classification, data inventory, consent or legal-basis analysis, supplier assessment, model card, test datasets, validation report, approval minutes, access logs, change records, monitoring results, incident reports and retirement evidence. Logs should be time-synchronised, protected against unauthorised alteration and retained according to legal and business requirements.

Audit sampling should be risk-based. High-impact decisions, privileged accounts, exceptions and material model changes deserve greater attention than routine low-risk transactions. Independent review is especially important where the development team also approves its own system.

An audit finding should state the condition, applicable criterion, cause, consequence or risk, and agreed corrective action. Remediation should have an owner, deadline, priority and verification step. Governance fails when findings are recorded but not closed or when exceptions become permanent through repeated informal renewal.

11. Illustrative case: AI-enabled supplier risk scoring

Background

A global manufacturer introduces an AI system that ranks suppliers for enhanced due diligence. The system uses payment history, delivery performance, quality incidents, financial indicators, public information and questionnaire responses. High-risk suppliers receive more frequent audits and shorter purchase-order approval periods.

Problem

After deployment, small suppliers report that they are disproportionately classified as high risk. Some have incomplete financial data because they operate in countries with limited reporting infrastructure. Procurement staff also cannot explain individual rankings, and the vendor contract permits broad use of supplier data for model improvement.

Analysis

The system presents several risks. Missing data may be treated as negative evidence, creating a structural disadvantage. Country and firm-size variables may act as proxies for protected or economically sensitive characteristics. The model may be statistically accurate in aggregate but unfair in its distribution of scrutiny. Excessive audit requirements may impose costs that drive capable small suppliers out of the network. Broad vendor data rights create confidentiality and intellectual-property concerns.

Approach and solution

The manufacturer establishes a cross-functional review involving procurement, compliance, privacy, information security, supplier representatives and internal audit. It:

1. defines the legitimate purpose and limits of the score;
2. separates “insufficient evidence” from “evidence of high risk”;
3. analyses error and selection rates by supplier size, region and relevant operating context;
4. tests alternative features and documents fairness trade-offs;
5. provides suppliers with a concise explanation and correction channel;
6. requires human review before adverse commercial action;
7. renegotiates the vendor contract to restrict training use and onward disclosure;
8. introduces access controls, encryption, logging and model-change notification;
9. sets monitoring thresholds for drift, complaints and disparate outcomes; and
10. schedules an independent audit and annual reapproval.

Outcome

The revised process reduces false escalations, improves supplier data quality and preserves enhanced review for genuinely material risks. Procurement retains discretion, but decisions must be documented and supported by evidence. The organisation does not eliminate judgement; it makes judgement more consistent, contestable and accountable.

Learning points

The case illustrates that responsible AI is not achieved by selecting a more complex model. It requires purpose limitation, careful data interpretation, contractual control, human accountability, supplier voice, monitoring and independent assurance. It also shows why third-party governance and ethics must be integrated rather than managed as separate workstreams.

12. Implementation roadmap for supply-chain managers

A practical transformation can proceed in phases:

Phase 1—Discover: inventory systems, data flows, suppliers, AI uses, critical processes and existing obligations.

Phase 2—Prioritise: classify services by operational criticality, sensitivity, human impact and exposure. Address identity weaknesses, unsupported systems and uncontracted data sharing first.

Phase 3—Design: establish policies, ownership, minimum controls, assessment templates, contract clauses and escalation paths.

Phase 4—Implement: deploy technical safeguards, train users, conduct impact assessments, validate models and exercise incident plans.

Phase 5—Assure: monitor controls, audit high-risk systems, test recovery, investigate complaints and verify remediation.

Phase 6—Improve: learn from incidents and near misses, update standards, reassess vendors and retire systems that no longer have a defensible purpose.

Leadership should communicate that security and ethics are operational responsibilities, not obstacles to innovation. Procurement incentives should reward evidence of resilience and responsible practice rather than lowest initial price alone. At the same time, governance should be proportionate: excessive approval bureaucracy can encourage shadow systems and weaken transparency.

Challenges and limitations

Several challenges persist. Supply chains often contain small partners with limited resources, making uniform controls unrealistic. Cross-border data flows create conflicting legal requirements. Fairness metrics may point in different directions, and some harms are difficult to quantify. Explainability can be limited by complex models, proprietary systems or poor source data. Audits provide snapshots, whereas threats and models change continuously. Finally, no framework can remove all risk; governance must support informed decisions under uncertainty.

The correct response is not to avoid digitisation but to make risk visible, assign ownership and build proportionate safeguards. Organisations should be especially cautious about automation in safety-critical, employment-related, credit, access-to-service or commercially exclusionary decisions.

Chapter Summary

Digital supply chains create shared benefits and shared vulnerabilities. Cybersecurity protects confidentiality, integrity, availability, authenticity and accountability across interconnected systems. Effective controls include strong identity management, least privilege, secure data exchange, resilience planning, incident response and risk-based third-party oversight.

Privacy requires purpose limitation, minimisation, lawful processing, appropriate retention and clear allocation of controller, processor and contractual responsibilities. Data ownership, access and intellectual-property rights must be distinguished in contracts and operating procedures.

Responsible AI requires attention to safety, fairness, autonomy, explainability and contestability. Bias can arise from data, labels, proxies, objectives and deployment context. No single fairness metric proves ethical performance. Meaningful human oversight requires authority, competence and a genuine ability to intervene.

Digital governance establishes ownership, decision rights, standards, evidence, exception management and independent assurance. Responsible-AI controls should cover inventory, impact assessment, data governance, validation, human oversight, monitoring, change control, audit and retirement. Regulatory regimes and standards provide important baselines, but applicability must be mapped to jurisdiction, sector and system role.

For supply-chain leaders, the strategic objective is trustworthy transformation: innovation that is secure, lawful, explainable, resilient and accountable throughout the ecosystem.

Key Terms

Algorithmic bias: Systematic error or disadvantage affecting outcomes for a person, group or category.

Audit trail: Chronological evidence showing actions, decisions, changes and approvals.

Availability: The property that systems and information are accessible when required.

Data minimisation: Collecting and using only data necessary for a defined purpose.

Digital governance: Structures and processes that direct, control and assure digital activities.

Explainability: The ability to provide an understandable account of a system’s behaviour or decision.

Fairness: Ethical and context-dependent treatment of affected parties, supported by justified criteria.

Human oversight: Competent human involvement with authority to review, intervene or appeal.

Integrity: Protection of information and system behaviour from unauthorised or improper alteration.

Least privilege: Granting only the access needed for an authorised task.

Model drift: Change in data or relationships that reduces model relevance or performance over time.

Non-repudiation: Ability to attribute an action or transaction reliably.

Privacy by design: Embedding privacy safeguards into systems and processes from the outset.

Responsible AI: Design and use of AI consistent with safety, fairness, accountability, transparency and applicable law.

RPO: Recovery point objective; the maximum acceptable period of data loss.

RTO: Recovery time objective; the maximum acceptable time to restore a service.

Third-party risk: Risk introduced by external providers, suppliers or their subcontractors.

Zero trust: A security approach that continuously verifies access rather than trusting users or network locations by default.

Review Questions

Short Answer Questions

1. What are the five commonly used objectives of cybersecurity in a digital supply chain?
2. Distinguish data ownership from data access rights.
3. Define RTO and RPO and explain why both are needed.
4. Why does removing a protected attribute not necessarily eliminate algorithmic bias?
5. What is meant by meaningful human oversight?

Long Answer Questions

1. Explain how cybersecurity, privacy and digital governance reinforce one another in a connected supply chain.
2. Discuss the major controls that should be included in a third-party risk-management programme.
3. Evaluate the strengths and limitations of using fairness metrics to govern AI-based supplier decisions.
4. Design a life-cycle governance process for an AI system used in logistics planning.
5. Explain how contracts, audit evidence and incident exercises contribute to responsible digital transformation.

Analytical / Application Questions

1. A logistics provider requests continuous access to customer addresses, driver locations and delivery histories. Analyse the privacy, security, contractual and operational issues, and recommend proportionate controls.
2. An automated purchasing model reduces average cost but increases expedited shipments from rural suppliers and produces more adverse decisions for small firms. Propose an investigation using performance, fairness, data-quality and governance evidence.
3. A critical cloud-based warehouse platform suffers a ransomware incident at a subcontractor. Develop an incident-response and resilience decision sequence covering containment, communication, recovery, supplier accountability and post-incident assurance.

Multiple Choice Questions with Answers

Question 1

Which control most directly supports the principle of least privilege?

A. Giving every supplier administrator access

B. Granting users only the permissions required for their authorised tasks

C. Allowing anonymous access to operational dashboards

D. Retaining all user accounts after contract termination

Correct Answer: B. Granting users only the permissions required for their authorised tasks

Question 2

What does an RPO specify?

A. The maximum acceptable time to restore a service

B. The minimum number of recovery staff required

C. The maximum acceptable period of data loss measured in time

D. The percentage of suppliers that must be audited

Correct Answer: C. The maximum acceptable period of data loss measured in time

Question 3

Why can removing a protected attribute fail to eliminate algorithmic bias?

A. Models never use input variables

B. Other variables may act as proxies for that attribute

C. Encryption automatically creates bias

D. Human review always overrides the model

Correct Answer: B. Other variables may act as proxies for that attribute

Question 4

Which statement best describes meaningful human oversight?

A. A person is present but cannot change the automated outcome

B. A person approves every output without reviewing evidence

C. A competent reviewer has authority, time and information to intervene

D. The vendor alone decides whether an outcome is acceptable

Correct Answer: C. A competent reviewer has authority, time and information to intervene

Question 5

Which item is most appropriately included in a data-sharing agreement?

A. An unlimited right to use data for any future purpose

B. Purpose, permitted use, retention, security and deletion obligations

C. A prohibition on recording any access to data

D. Automatic transfer of all intellectual-property rights

Correct Answer: B. Purpose, permitted use, retention, security and deletion obligations

Question 6

Which NIST Cybersecurity Framework function focuses on restoring capabilities after an incident?

A. Identify

B. Protect

C. Detect

D. Recover

Correct Answer: D. Recover

Question 7

A model has high overall accuracy but disproportionately rejects small suppliers because missing data is treated as evidence of high risk. What is the most appropriate first response?

A. Deploy the model unchanged because overall accuracy is high

B. Delete all supplier-size information without further analysis

C. Investigate data quality, proxy effects, error rates and the meaning of missingness

D. Allow the vendor to make adverse decisions without explanation

Correct Answer: C. Investigate data quality, proxy effects, error rates and the meaning of missingness

Question 8

Which practice best supports model-change governance?

A. Changing training data without recording the change

B. Revalidating material changes to data, objectives, thresholds or deployment context

C. Disabling monitoring after deployment

D. Using a new model version without notifying affected owners

Correct Answer: B. Revalidating material changes to data, objectives, thresholds or deployment context

Question 9

What is the primary purpose of an audit trail?

A. To prevent every possible cyberattack

B. To provide evidence of actions, decisions, changes and approvals

C. To replace access controls

D. To guarantee that an AI model is fair

Correct Answer: B. To provide evidence of actions, decisions, changes and approvals

Question 10

Which statement about regulatory frameworks is most accurate?

A. One framework automatically applies identically to every organisation

B. Compliance eliminates the need for ethical judgement

C. Applicability depends on factors such as jurisdiction, sector, data and organisational role

D. Standards and laws are interchangeable terms

Correct Answer: C. Applicability depends on factors such as jurisdiction, sector, data and organisational role