Digital Logistics, Data, Cybersecurity and AI Law

Introduction

Logistics is increasingly conducted through digital infrastructures rather than paper documents and face-to-face instructions. Freight platforms match cargo with capacity; sensors report location and temperature; electronic bills of lading transfer control of goods; blockchain networks record transactions; artificial intelligence (AI) predicts demand, allocates vehicles and screens suppliers. These developments improve speed, traceability and coordination, but they also create legal questions concerning validity, evidence, privacy, cybersecurity, liability and accountability.

Digital logistics law is not a single field. It combines contract law, electronic-transactions legislation, transport law, data-protection law, cybersecurity regulation, consumer and competition law, intellectual-property law, financial regulation and sector-specific rules such as customs and dangerous-goods requirements. The applicable rules depend on the parties, the location of the goods and data, the chosen forum, the governing law, and the relevant transport mode.

A central managerial lesson is that digitisation does not remove legal obligations. It changes how obligations are created, performed, evidenced and enforced. A digitally signed contract may be legally binding, but only if issues such as authority, consent, integrity, retention and attribution have been properly addressed. An AI system may improve delivery performance, but its operator may still be responsible for unlawful discrimination, unsafe decisions or inadequate explanations.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the legal foundations of electronic contracts, electronic signatures and digital records.
2. Analyse the legal status and operational use of electronic bills of lading.
3. Distinguish the functions and risks of IoT, blockchain and smart contracts.
4. Assess legal responsibilities in platform-based logistics.
5. Apply privacy and cross-border data-transfer principles to logistics operations.
6. Design a cybersecurity governance approach for a logistics enterprise.
7. Evaluate AI-assisted decisions through the concepts of explainability, bias, human oversight and accountability.
8. Recommend contractual, technical and governance controls for digitally enabled logistics.

1. The Digital Logistics Legal Architecture

A logistics transaction commonly involves a shipper, consignee, carrier, freight forwarder, warehouse operator, customs broker, insurer, platform provider, technology vendor and payment provider. Each may process different information and assume different responsibilities. The same event—such as a delayed delivery—may raise contractual, tort, data-protection, cybersecurity and transport-law issues simultaneously.

The principal legal questions are:

• Formation: Did the parties validly agree, and can acceptance be demonstrated?
• Attribution: Which person or organisation made an electronic communication?
• Integrity: Has the record remained complete and unaltered?
• Authority: Was the employee, algorithm or system authorised to act?
• Evidence: Can the record be admitted and given appropriate weight in proceedings?
• Control: Who legally controls a digital document or token representing goods?
• Privacy: Is personal data collected lawfully, fairly and only to the necessary extent?
• Security: Were reasonable technical and organisational safeguards implemented?
• Allocation of risk: Which party bears loss caused by error, outage, manipulation or an AI recommendation?

International instruments and national statutes often adopt technology-neutral principles. Examples include recognition of electronic records, non-discrimination between paper and electronic forms, and functional equivalence between a paper document and a reliable electronic record. However, legal recognition is not universal or automatic. Formalities for negotiable instruments, warehouse receipts, customs documents, securities and transport documents may differ across jurisdictions. Organisations must therefore undertake a jurisdiction-specific legal review rather than assume that an electronic substitute has identical effects everywhere.

2. Electronic Contracts and E-Signatures

2.1 Formation by electronic communication

An electronic contract may be formed through email, an online platform, an electronic data interchange (EDI) message, a web interface, an application programming interface (API), or a sequence of automated system messages. Traditional contract requirements generally remain relevant: offer, acceptance, consideration where required, intention to create legal relations, capacity, certainty and legality.

The principal difficulty is often not whether a contract can be electronic, but whether the parties can prove what happened. A platform should preserve the version of terms displayed at the time of acceptance, the identity or account associated with the acceptance, the timestamp, the relevant transaction data and any subsequent amendments.

Click-wrap agreements, in which a user actively selects “I agree,” usually provide stronger evidence of assent than browse-wrap arrangements, in which terms are merely linked on a webpage. A logistics platform should avoid hiding significant terms in inaccessible links and should draw attention to unusual exclusions, limitation clauses, automatic renewals and arbitration provisions.

2.2 E-signatures

An electronic signature can include a typed name, a checkbox, a digital image of a signature, a one-time password, biometric authentication or a cryptographic digital signature. Legal systems often distinguish between basic, advanced and qualified signatures, or use equivalent categories under domestic law.

The legal value of a signature depends on factors such as:

• identification of the signatory;
• evidence of the signatory’s intention;
• control of the signing method;
• protection against alteration after signing;
• reliable time and audit records; and
• compliance with any required formality.

A cryptographic digital signature uses a private key controlled by the signer and a corresponding public key used for verification. It can demonstrate integrity and origin, but it does not alone prove that the person controlling the key had legal authority to bind the company. Delegation, employee access, system credentials and internal approval controls remain important.

2.3 Evidence and retention

Digital evidence must be reliable, reproducible and intelligible. A sound records policy should preserve metadata, system logs, identity records, document versions, audit trails and the relationship between a transaction and its supporting records. Retention should satisfy legal requirements without retaining personal data indefinitely.

Where a dispute is likely, an organisation should preserve relevant records through a legal hold. Altering, deleting or overwriting logs after notice of a dispute may damage credibility and expose the organisation to sanctions.

3. Electronic Bills of Lading and Digital Trade Documents

A bill of lading traditionally serves three functions: it evidences the contract of carriage, acknowledges receipt or shipment of goods, and may operate as a document of title. The third function creates a special challenge. A paper bill can be physically possessed and transferred, while a digital record can be copied. A legally effective electronic bill of lading therefore requires a reliable system for exclusive control, transfer and prevention of double disposition.

A robust electronic bill-of-lading system should address:

1. Identity: the issuer, carrier, shipper, consignee and authorised transferees.
2. Integrity: protection against unauthorised alteration.
3. Exclusivity: a mechanism showing who controls the current document.
4. Transfer: legally recognised transfer procedures and an audit trail.
5. Surrender or cancellation: prevention of further transfer after delivery or discharge.
6. Availability: continuity during outages and a controlled fallback process.
7. Governing law: express identification of the legal regime and dispute forum.
8. Interoperability: ability to communicate with carriers, banks, customs authorities and insurers.

An electronic record may be functionally equivalent to a paper document under a relevant statute or international framework, but this depends on the transaction and jurisdictions involved. Parties should verify whether courts, banks, customs authorities and financing institutions recognise the chosen platform.

A practical risk arises when one party uses an electronic bill while another still requires paper. Contractual provisions should specify conversion rules, the consequences of system failure, the authoritative version, and the process for correcting errors.

4. IoT, Sensors and Operational Data

The Internet of Things (IoT) connects sensors, vehicles, containers, warehouses and control systems. Devices may generate location, temperature, humidity, shock, access, driver-behaviour and engine information. This data supports predictive maintenance, cold-chain compliance, route optimisation and claims management.

IoT systems create several legal relationships. A sensor manufacturer may be responsible for defective hardware; a software vendor may be responsible for insecure code; a carrier may be responsible for deployment and monitoring; and a customer may control the purpose for which data is used. Contracts should define data ownership or usage rights, data quality, service levels, calibration, cybersecurity duties, access rights, retention and liability for false readings.

Sensor data is not automatically objective. Devices can be badly calibrated, installed in unsuitable locations, disconnected, spoofed or affected by battery failure. A temperature excursion may reflect an inaccurate sensor rather than a breach of the cold-chain requirement. Evidence procedures should preserve calibration records, device identity, time synchronisation and chain of custody.

Location and driver data may constitute personal data when it can be linked to an identifiable individual. Monitoring should be proportionate, transparent and limited to legitimate purposes. Employee notice, consultation and local labour-law requirements may also apply.

5. Blockchain and Smart Contracts

Blockchain is a distributed ledger in which participating nodes maintain records through a consensus process. Its legal value does not arise merely from using the label “blockchain.” It depends on governance, access controls, identity management, consensus reliability, data accuracy and applicable law.

Potential logistics uses include:

• recording custody events;
• confirming proof of delivery;
• sharing provenance information;
• coordinating trade-finance documentation; and
• reducing reconciliation between supply-chain participants.

Important limitations include scalability, confidentiality, governance disputes, erroneous input data and difficulty correcting records. Immutability may conflict with legal duties to rectify or erase personal data. A prudent design stores minimal personal information on-chain and keeps changeable or sensitive data in controlled off-chain systems, with secure references where appropriate.

A smart contract is code that automatically performs an action when programmed conditions are satisfied. It is not necessarily a complete legal contract. Code may execute a payment or release a shipment while the parties’ legal agreement defines exceptions, force majeure, fraud, mistake, liability and dispute resolution.

For example, a temperature-controlled shipment may trigger payment when delivery is recorded and sensor readings remain within agreed limits. The legal agreement should specify what happens if the sensor is defective, the network is unavailable, the data is manipulated, or the buyer disputes the delivery. Code should therefore be treated as one implementation layer within a broader contractual and governance framework.

6. Platform Logistics and Intermediary Responsibility

Digital freight platforms may operate as marketplaces, agents, carriers, brokers, data intermediaries or software providers. Their legal classification matters. A platform that merely introduces parties may have different duties from one that sets prices, controls allocation, issues transport documents, collects payment or promises delivery.

Platform contracts should address:

• the platform’s legal role;
• user verification and authority;
• allocation of carrier and cargo risks;
• pricing, commissions and cancellation;
• service-level commitments;
• data access and portability;
• intellectual-property rights in ratings and operational data;
• suspension and termination;
• complaints and dispute resolution; and
• liability caps and mandatory insurance.

Platforms must also consider competition law. Sharing commercially sensitive information, coordinating prices through algorithms, favouring affiliated providers or imposing restrictive access terms may create competition concerns. A platform’s algorithm does not eliminate responsibility for an unlawful outcome. Organisations should test pricing, ranking and allocation systems for discriminatory or exclusionary effects.

7. Privacy and Cross-Border Data Transfers

Logistics data may include names, addresses, phone numbers, signatures, identification documents, driver records, geolocation, device identifiers, CCTV images, customs information and employee data. The legal classification of an organisation—controller, processor, independent controller or joint controller—depends on its actual decision-making, not merely on the label used in a contract.

A privacy governance framework should address the following principles:

• Lawfulness, fairness and transparency: individuals should understand relevant processing and its legal basis.
• Purpose limitation: data collected for delivery should not automatically be reused for unrelated profiling.
• Data minimisation: collect what is reasonably necessary.
• Accuracy: provide mechanisms to correct inaccurate records.
• Storage limitation: retain data for a defined and justified period.
• Security: apply proportionate technical and organisational safeguards.
• Accountability: maintain evidence of compliance.

A privacy impact assessment is appropriate where processing is extensive, systematic, sensitive, innovative or likely to create significant risks. It should identify data flows, purposes, affected individuals, threats, controls, residual risks and consultation requirements.

Cross-border transfers may occur when a cloud provider stores data abroad, when a global platform accesses records remotely, or when a carrier shares data with an overseas partner. Transfer mechanisms differ by jurisdiction and may include adequacy decisions, standard contractual clauses, approved internal rules, certification mechanisms or specific legal exceptions. Contractual safeguards are not sufficient if the recipient’s legal environment or practical security undermines the protection required by the originating jurisdiction.

Data-processing agreements should specify subject matter, duration, categories of data, instructions, confidentiality, security measures, sub-processors, assistance with individual rights, breach notification, audits, deletion or return, and international transfer arrangements.

8. Cybersecurity in Logistics

Logistics is an attractive target because it is operationally critical and highly interconnected. Attacks may interrupt warehouse management systems, fleet dispatch, customs interfaces, payment systems, refrigeration controls or customer portals. Common threats include ransomware, phishing, credential theft, business-email compromise, supply-chain compromise, denial-of-service attacks, insider misuse and manipulation of sensor data.

Cybersecurity should be managed as an enterprise risk rather than delegated exclusively to the information-technology department. A useful lifecycle is:

1. Identify: map assets, data, dependencies and critical services.
2. Protect: apply access control, secure configuration, encryption, training, segmentation, patching and supplier requirements.
3. Detect: monitor logs, anomalies, endpoint activity and unusual transactions.
4. Respond: contain incidents, preserve evidence, communicate and maintain safety.
5. Recover: restore systems, validate data, learn from the incident and improve resilience.

The most important logistics-specific control is often operational continuity. A warehouse should have a tested manual dispatch procedure; a carrier should know how to verify instructions during a communications outage; and a cold-chain operator should have contingency power and alternative monitoring.

Incident response plans should identify legal reporting deadlines, decision-makers, forensic providers, insurers, regulators, affected customers and law-enforcement contacts. Organisations should avoid speculative communications, preserve privilege where available, and distinguish confirmed facts from assumptions.

Vendor due diligence should examine security certifications where relevant, vulnerability management, breach history, subcontractors, access rights, data location, recovery objectives, penetration testing, termination assistance and cooperation obligations. A vendor contract should not simply state that the vendor will provide “reasonable security”; it should define measurable expectations appropriate to the risk.

9. AI-Assisted Decisions in Logistics

AI may forecast demand, estimate arrival times, select carriers, optimise routes, detect fraud, assess warehouse labour requirements, identify damaged goods and prioritise customs inspections. These applications vary in risk. A recommendation that a manager can readily review is different from an automated decision that denies a supplier access to a platform or subjects a driver to disciplinary action.

9.1 Explainability

Explainability means being able to communicate how an AI system contributed to an output in a form appropriate to the audience. A technical explanation may describe features, model limitations and validation results. A managerial explanation may identify the principal factors affecting a recommendation. An affected individual may require a clear reason, an opportunity to challenge the result and access to human review.

Explanations should not be misleading. A post-hoc explanation that does not accurately reflect the model’s operation can undermine accountability. Organisations should document the purpose, data sources, model version, performance metrics, thresholds, known limitations and human decision process.

9.2 Bias and discrimination

Bias may enter through unrepresentative training data, historical discrimination, proxy variables, measurement error, label choices or unequal error rates. For example, a carrier-ranking system trained on historical allocation decisions may reproduce past exclusion of small or regional carriers.

Review should consider performance across relevant groups and operational contexts. No single fairness metric is universally correct; a trade-off may exist between different error rates or allocation objectives. Legal analysis must therefore combine statistical testing with the applicable discrimination rules and the legitimate business purpose.

9.3 Accountability and human oversight

Human oversight must be meaningful, not merely ceremonial. A reviewer needs sufficient authority, time, information and competence to question an AI recommendation. “The algorithm made the decision” is generally not an adequate allocation of legal responsibility.

Accountability controls include:

• an identified system owner;
• an inventory of AI uses;
• risk classification before deployment;
• documented data provenance;
• testing before and after deployment;
• monitoring for drift and disparate impact;
• access and change controls;
• incident and complaint channels;
• periodic independent review; and
• suspension or rollback procedures.

AI procurement contracts should address audit access, training-data rights, confidentiality, intellectual property, subcontractors, security, performance, explainability, regulatory cooperation, incident reporting and indemnities. The buyer should avoid accepting a black-box service without sufficient information to discharge its own legal duties.

10. Integrated Governance Framework

A mature digital-logistics governance programme connects legal, operational, technical and ethical controls. The following sequence is useful:

Step 1: Map the digital ecosystem

Identify systems, interfaces, vendors, devices, data flows, documents, jurisdictions and decision points. Include manual workarounds and shadow technology.

Step 2: Classify risks

Assess confidentiality, integrity, availability, privacy, safety, financial loss, discrimination, regulatory exposure and reputational harm. Prioritise systems whose failure could stop operations or endanger people.

Step 3: Allocate responsibility

Create a responsibility matrix covering the shipper, carrier, platform, technology vendor, employee and customer. Specify who approves data use, maintains systems, responds to incidents and communicates with regulators.

Step 4: Design contractual controls

Use clear provisions on authority, records, service levels, security, privacy, audit, subcontracting, business continuity, liability, insurance, dispute resolution and exit. Contractual wording should correspond to actual technical capabilities.

Step 5: Implement technical safeguards

Use strong authentication, least privilege, encryption, network segmentation, secure APIs, backups, monitoring, vulnerability management and tested recovery. Security should be built into procurement and system design rather than added after deployment.

Step 6: Establish assurance and review

Conduct audits, penetration testing, privacy assessments, AI impact assessments, supplier reviews and incident exercises. Reassess when the system, vendor, data, jurisdiction or business purpose changes.

Applied Case: The Failed Digital Cold-Chain Release

The following is an illustrative case, not a report of an actual organisation.

Background

NorthStar Foods, a multinational distributor, used an electronic bill of lading, IoT temperature sensors and a platform-based carrier network. A smart-contract module automatically released payment when the carrier uploaded proof of delivery and the sensor record showed compliance with the agreed temperature range.

Problem

During a shipment of vaccines, a sensor gateway lost connectivity for six hours. The platform later synchronised a data file containing apparently compliant readings. Payment was released, but the consignee found that the goods had exceeded the permitted temperature range. The carrier denied responsibility, arguing that the digital record was valid. The technology vendor claimed that the gateway had been configured by NorthStar. The consignee alleged that the electronic documentation and automated payment process concealed the defect.

Analysis

The incident involved several failures. First, the smart contract treated data availability as equivalent to data reliability. Second, the contract did not define the legal effect of missing readings or delayed synchronisation. Third, no independent alert required human review before payment for high-value or safety-critical goods. Fourth, the parties had not allocated responsibility for calibration, gateway configuration and data integrity. Finally, the electronic bill-of-lading system and sensor platform lacked a common incident and evidence protocol.

Approach and solution

NorthStar suspended automatic release for safety-critical shipments, introduced a rule that missing or reconstructed data triggers manual review, and required dual confirmation from the carrier and consignee. It retained raw sensor logs, calibration certificates, gateway logs and platform audit trails. Revised contracts allocated responsibilities for device installation, calibration, connectivity, data validation and incident notification. The platform was redesigned so that code executed payment only after specified legal and operational conditions were satisfied.

Outcome

The parties were able to distinguish a sensor-connectivity failure from a carrier-handling failure and to preserve evidence for the insurance and contractual claims. NorthStar also introduced risk-based AI and automation governance, with higher approval thresholds for goods affecting health or safety.

Learning points

1. A reliable digital record requires reliable data inputs.
2. Automation should not eliminate human review where consequences are serious.
3. Smart-contract code must implement, not replace, the legal agreement.
4. Contracts should allocate technical responsibilities precisely.
5. Business continuity and evidence preservation are part of legal compliance.

Challenges and Contemporary Developments

Digital logistics regulation is developing unevenly. Key challenges include conflicting national rules, fragmented standards, uncertain platform classification, evolving AI regulation, shortage of cybersecurity expertise and tension between transparency and commercial confidentiality.

Interoperability is another challenge. A closed platform may create dependency and make it difficult to transfer records when a provider fails or a contract ends. Organisations should require export functionality, documented interfaces and transition assistance.

The growth of connected vehicles, autonomous systems, digital identity, tokenised trade documents, generative AI and quantum-resistant cryptography will create new legal and operational questions. Legal teams should therefore participate in system design and procurement, not merely review disputes after deployment.

Best-Practice Checklist

A logistics organisation should be able to answer “yes” to the following questions:

• Are electronic records and signatures legally recognised in every relevant jurisdiction?
• Can the organisation prove who authorised each important transaction?
• Is there one clearly identified authoritative version of each digital document?
• Are electronic bills of lading transferable and controllable under applicable law?
• Are IoT data quality, calibration and outage procedures documented?
• Does the smart-contract code match the legal agreement and include exceptions?
• Are platform roles, liability and competition risks understood?
• Are privacy purposes, retention periods and cross-border transfers documented?
• Are critical systems segmented, monitored and recoverable?
• Are suppliers contractually required to support security and incident response?
• Are AI decisions tested for accuracy, bias, explainability and drift?
• Can a human reviewer intervene, reverse or suspend a consequential decision?
• Are records preserved for disputes, audits and regulatory inquiries?

Chapter Summary

Digital logistics law governs the creation, performance and proof of transactions conducted through electronic systems. Electronic contracts and signatures can be effective when identity, intention, integrity, authority and evidence are addressed. Electronic bills of lading require particular attention to control, transfer, exclusivity and jurisdiction because they may perform document-of-title functions.

IoT improves visibility but creates questions about data accuracy, privacy and responsibility for devices and connectivity. Blockchain can support shared records, but immutability, governance and data-correction problems must be managed. Smart contracts automate performance but do not replace the legal contract or resolve factual uncertainty.

Platforms must be classified according to their actual role, and their algorithms may create contractual, competition and discrimination risks. Privacy governance requires lawful purpose, minimisation, security, retention control and careful management of cross-border transfers. Cybersecurity is an enterprise and operational-resilience responsibility involving prevention, detection, response and recovery.

AI-assisted logistics decisions require explainability proportionate to risk, testing for bias, meaningful human oversight and clear accountability. The most effective governance combines legal drafting, technical safeguards, documented processes, assurance testing and continuous review.

Key Terms

Electronic contract: A contract formed, recorded or performed through electronic communications.

Electronic signature: Electronic data attached to or logically associated with a record to indicate signing or approval.

Digital signature: A cryptographic signature using a private key and verifiable through a corresponding public key.

Electronic bill of lading: A digital record evidencing carriage and potentially representing control or title to goods.

Electronic data interchange (EDI): Structured computer-to-computer exchange of business information.

IoT: A network of connected devices that collect, transmit or act on data.

Blockchain: A distributed ledger maintained through a consensus process among participating nodes.

Smart contract: Code that automatically performs actions when programmed conditions are met.

Platform logistics: Logistics activity coordinated through a digital intermediary or marketplace.

Controller: An entity that determines the purposes and means of processing personal data.

Processor: An entity that processes personal data on behalf of another entity.

Data minimisation: Limiting personal-data collection to what is necessary for the stated purpose.

Cross-border transfer: Movement or access to data across national or regulatory boundaries.

Cybersecurity: Protection of systems, networks and data against unauthorised or harmful activity.

Ransomware: Malicious software that blocks access to systems or data, commonly for extortion.

Explainability: The ability to communicate how a system contributed to a decision or output.

Algorithmic bias: Systematic and unfair differences in outcomes associated with data, design or deployment.

Human oversight: Competent human supervision capable of evaluating and intervening in an automated process.

Accountability: Responsibility supported by evidence, governance and the ability to explain and remedy conduct.

Review Questions

Short Answer Questions

1. What legal functions may a traditional bill of lading perform?
2. Why is a digital signature not, by itself, proof of corporate authority?
3. Identify three cybersecurity threats relevant to logistics.
4. What is the difference between a data controller and a data processor?
5. Why can sensor data be legally unreliable even when it is digitally recorded?

Long Answer Questions

1. Explain the legal and operational requirements for an effective electronic bill-of-lading system.
2. Discuss how privacy principles apply to vehicle tracking and driver-monitoring data.
3. Analyse the legal relationship between a smart contract and the underlying commercial contract.
4. Develop a cybersecurity governance framework for a multinational logistics company.
5. Explain how explainability, bias testing and human oversight support accountable AI use in logistics.

Analytical / Application Questions

1. A freight platform automatically excludes carriers whose on-time performance falls below a threshold. Analyse the possible contractual, discrimination, data-quality and accountability issues, and recommend controls.
2. A warehouse suffers a ransomware attack that disrupts dispatch, exposes customer addresses and corrupts inventory records. Prepare an immediate legal and operational response plan.
3. A carrier seeks to replace paper bills of lading with a blockchain-based system used across five countries. Identify the legal due-diligence questions and propose a phased implementation strategy.

Multiple Choice Questions with Answers

Question 1

Which feature is most important when an electronic bill of lading is intended to be transferable?

A. A decorative digital watermark

B. A mechanism for exclusive control and recognised transfer

C. A larger file size

D. Automatic deletion after shipment

Correct Answer: B. A mechanism for exclusive control and recognised transfer

Question 2

Which arrangement generally provides the strongest evidence of active electronic assent?

A. Browse-wrap terms with no visible notice

B. A verbal discussion with no record

C. Click-wrap acceptance requiring the user to select “I agree”

D. An unsigned marketing email

Correct Answer: C. Click-wrap acceptance requiring the user to select “I agree”

Question 3

What is a principal legal limitation of blockchain immutability?

A. It guarantees that input data is accurate

B. It may conflict with correction or deletion requirements

C. It prevents all cyberattacks

D. It eliminates the need for governance

Correct Answer: B. It may conflict with correction or deletion requirements

Question 4

Which statement best describes a smart contract?

A. It is always a complete legal contract

B. It is code that performs actions when programmed conditions are met

C. It is a paper document scanned into a database

D. It is a cybersecurity insurance policy

Correct Answer: B. It is code that performs actions when programmed conditions are met

Question 5

Which privacy principle requires collection of only data reasonably necessary for a stated purpose?

A. Data minimisation

B. Unlimited retention

C. Open access

D. Automatic disclosure

Correct Answer: A. Data minimisation

Question 6

Which activity belongs primarily to the ‘Detect’ phase of cybersecurity governance?

A. Mapping assets before deployment

B. Installing access controls

C. Monitoring logs for unusual activity

D. Restoring systems from backups

Correct Answer: C. Monitoring logs for unusual activity

Question 7

Why should AI-assisted carrier ranking be tested for bias?

A. Algorithms are legally incapable of making recommendations

B. Historical data or proxy variables may reproduce unfair exclusion

C. Testing always makes the system slower than paper processes

D. Bias testing removes the need for human oversight

Correct Answer: B. Historical data or proxy variables may reproduce unfair exclusion

Question 8

What makes human oversight meaningful in an AI decision process?

A. The reviewer receives no information about the output

B. The reviewer can evaluate, question and if necessary reverse the decision

C. The organisation labels every output as human-made

D. The reviewer approves every output automatically

Correct Answer: B. The reviewer can evaluate, question and if necessary reverse the decision

Question 9

Which contractual provision is especially relevant when a cloud logistics provider processes personal data?

A. A requirement to use decorative branding

B. Rules on processing instructions, security, sub-processors and deletion

C. A ban on keeping any operational records

D. A promise that no law will apply

Correct Answer: B. Rules on processing instructions, security, sub-processors and deletion

Question 10

In the illustrative cold-chain case, what was a central weakness of the smart-contract design?

A. It treated data availability as equivalent to data reliability

B. It required too much human review of safety-critical goods

C. It prohibited all electronic records

D. It prevented payment under every circumstance

Correct Answer: A. It treated data availability as equivalent to data reliability