Intellectual Property, Ethics, Safety and Compliance

Introduction

A prototype is not merely a physical or digital model. It is also a bundle of intellectual assets, design decisions, data, safety assumptions, legal obligations and stakeholder responsibilities. Entrepreneurs who focus only on technical feasibility may discover too late that their product infringes another party’s rights, exposes personal data, creates an unreasonable safety risk, excludes users with disabilities or cannot obtain regulatory approval.

Product prototyping therefore requires an integrated governance perspective. Intellectual property (IP) strategy protects and commercialises knowledge; ethics guides decisions where legality alone is insufficient; safety engineering reduces hazards; compliance demonstrates conformity with applicable rules; and responsible data practices protect users and organisational trust. These concerns should be addressed before substantial investment is made, not treated as documentation activities at the end of development.

This chapter uses the term prototype broadly to include sketches, CAD files, software builds, algorithms, laboratory samples, service blueprints, interfaces, datasets and pilot deployments. Requirements differ across jurisdictions and sectors. The discussion provides a professional framework, not legal advice; entrepreneurs should obtain qualified local advice before filing, licensing, testing or commercialising a product.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. distinguish patents, industrial designs, copyright, trade secrets and trademarks;
2. construct an IP ownership and freedom-to-operate strategy for a prototype;
3. design practical confidentiality, licensing and collaboration controls;
4. apply ethical principles to research, data collection and product decisions;
5. identify product hazards, foreseeable misuse and product-liability exposure;
6. integrate privacy, cybersecurity and accessibility into prototyping;
7. interpret the role of sector-specific regulation and conformity assessment; and
8. develop a proportionate evidence file demonstrating responsible product development.

1. Intellectual Property as a Prototyping Asset

1.1 The IP map

An IP map links each important product element to its creator, owner, legal protection, evidence and commercial purpose. A wearable health device, for example, may contain a patentable sensor arrangement, copyright in firmware, a registered design in its external appearance, trade secrets in calibration methods, a trademark in its name and licensed third-party libraries.

The first practical exercise is an asset inventory. For every component, record:

• what was created and when;
• who created it and under what employment or contractor arrangement;
• whether pre-existing material was incorporated;
• the proposed protection mechanism;
• disclosure status and relevant deadlines;
• licences and restrictions; and
• commercial importance and replacement cost.

Ownership is not automatically identical to authorship. Employees, contractors, universities, incubators and co-founders may have different rights under contract and local law. A startup should obtain written assignments and verify that contractor agreements address inventions, copyright, confidentiality and permitted use of background materials.

1.2 Patents

A patent protects an invention that satisfies jurisdiction-specific requirements, commonly novelty, inventive step or non-obviousness, industrial applicability or utility, and sufficient disclosure. Patent rights are territorial and time-limited. A patent does not provide a worldwide monopoly, nor does it automatically authorise the owner to practise the invention: another patent may still block commercial use.

A prototype does not need to be a finished product to support a patent strategy, but the application must disclose the invention sufficiently. Public disclosure before filing can destroy novelty in many jurisdictions, although grace periods vary and should not be assumed. Investor pitches, conference demonstrations, online videos, open repositories and unrestricted customer trials may all constitute disclosure.

A useful distinction is between a provisional or preliminary filing mechanism, where available, and a granted patent. A filing establishes a priority claim subject to applicable law; it is not proof that the invention is patentable or that a patent will be granted. Before filing, the team should conduct a prior-art search and formulate claims around the technical contribution rather than the commercial aspiration.

Patent strategy is especially relevant where development costs are high, imitation is likely and the invention can be detected from the marketed product. It may be less attractive where the technology changes rapidly or is difficult to reverse-engineer, because disclosure in the patent document may provide competitors with valuable information.

1.3 Industrial designs and copyright

An industrial design, design patent or equivalent right generally protects the visual appearance of a product—such as shape, configuration, pattern or ornamentation—subject to local requirements. It usually does not protect technical function. Filing before public disclosure is often prudent.

Copyright protects original expression fixed in a tangible or digital form. It may cover source code, technical drawings, manuals, photographs, interface artwork, audiovisual content and some database structures. It does not ordinarily protect an abstract idea, method, mathematical concept or purely functional principle. Copyright may arise automatically, but ownership, authorship and licensing evidence remain essential.

A CAD drawing and the physical object represented by it are related but not identical legal subject matter. Copying the drawing may raise copyright issues; reproducing the product’s appearance may raise design-right issues; reproducing its technical mechanism may raise patent issues. A single feature can therefore require several complementary protections.

1.4 Trade secrets and trademarks

A trade secret is commercially valuable information that derives value from not being generally known and is subject to reasonable steps to maintain secrecy. Examples include formulations, manufacturing parameters, test data, supplier terms, model weights, failure-analysis records and customer acquisition methods.

Trade-secret protection is fragile. Once information is independently developed, lawfully reverse-engineered where permitted, or publicly disclosed, secrecy protection may disappear. Controls should include need-to-know access, classification labels, secure repositories, employee and contractor agreements, exit procedures, vendor controls and records of disclosures.

A trademark identifies the commercial source of goods or services. It may be a word, logo, symbol, shape, sound or other sign depending on the jurisdiction. Brand clearance should occur before investment in packaging, domains and marketing. A technically excellent product can still face rebranding costs if its name conflicts with an existing mark.

2. Freedom to Operate, Confidentiality and Licensing

2.1 Freedom to operate

Patentability asks, “Can we obtain rights over our invention?” Freedom to operate (FTO) asks, “Can we make, use, sell or import this product without infringing others’ rights?” These are different questions. An FTO review identifies relevant third-party rights in target markets, compares claims or protected subject matter with the proposed product, and records design-around, licence or risk decisions.

FTO is probabilistic rather than an absolute certificate. Patent databases may be incomplete, claims may be amended, and legal interpretation varies. The review should be updated when architecture, suppliers, jurisdictions or product functions change. Open-source software requires a parallel licence-compliance review: permissive licences and copyleft licences impose different obligations, and “open source” does not mean “without conditions.”

2.2 Confidentiality and controlled disclosure

Confidentiality should be designed around disclosure purpose. Before a supplier receives drawings, the entrepreneur should decide what the supplier needs, remove unnecessary information, use an appropriate confidentiality agreement and establish permitted use, retention, return and destruction requirements. A confidentiality agreement cannot repair a disclosure that was already public, and it should not be used to conceal safety information from regulators or affected users.

A robust disclosure protocol includes:

1. classification of information;
2. authorisation of the recipient and purpose;
3. minimum necessary disclosure;
4. secure transmission and access logging;
5. restrictions on copying, subcontracting and reverse engineering where lawful; and
6. closure, deletion or return of information.

2.3 Licensing and collaboration

Licensing converts rights into controlled commercial access. Important terms include the scope of rights, territory, field of use, exclusivity, duration, sublicensing, royalties, minimum commitments, improvement ownership, quality control, audit rights, support, indemnities, termination and post-termination obligations.

Entrepreneurs should distinguish background IP—what a party brings into a project—from foreground IP—what the project creates. Joint ownership can be difficult because each jurisdiction supplies different default rules about licensing, enforcement and accounting. A clear agreement is usually preferable to relying on default law.

3. Ethics in Product Prototyping

3.1 Beyond legal compliance

Compliance establishes a minimum enforceable standard; ethics asks what responsible conduct requires when rules are incomplete, ambiguous or silent. A product may be legally marketable yet ethically objectionable if it manipulates vulnerable users, conceals limitations, exploits unequal bargaining power or imposes risks on people who did not consent.

A practical ethical analysis considers autonomy, beneficence, non-maleficence, justice, accountability and respect for human dignity. These principles can conflict. For example, collecting more data may improve accuracy but reduce privacy. A fair decision therefore requires explicit identification of affected groups, alternatives, evidence, uncertainties and distribution of benefits and harms.

3.2 Research ethics and human participants

Prototype testing involving people may constitute human-subject research, usability research, clinical investigation or ordinary product validation depending on the activity and jurisdiction. The team should determine whether institutional review, ethics committee approval, informed consent, clinical authorisation or other oversight is required before recruitment.

Informed consent should explain the purpose, procedures, foreseeable risks, benefits, data use, confidentiality limits, voluntary nature of participation, withdrawal process and contact details. Consent is not valid merely because a participant signs a form; comprehension and freedom from undue influence matter. Incentives should not be so large that they compromise voluntariness.

Special care is required for children, employees, patients, prisoners and other groups whose ability to refuse may be constrained. Test protocols should include stopping criteria, incident reporting, adverse-event escalation, compensation arrangements and post-test communication. Deception, if scientifically justified, should be minimised and followed by appropriate debriefing.

Research integrity also requires accurate recording of methods, negative results, exclusions and deviations. Fabricating test results, selectively reporting favourable trials or allowing sponsor pressure to alter conclusions undermines both ethics and safety.

3.3 Responsible innovation

Responsible innovation anticipates consequences, includes diverse perspectives, reflects on assumptions and responds to evidence. In prototyping, this means testing not only whether a product works, but for whom it fails, who bears the costs and how it may be misused. A risk register should therefore include social and ethical harms alongside technical failures.

4. Data Privacy and Cybersecurity

4.1 Privacy by design

Privacy concerns the justified control and use of information about identifiable or identifiable persons. Key concepts include purpose limitation, data minimisation, accuracy, retention limitation, transparency, security and accountability. Applicable obligations vary by location and data type; health, biometric, financial, children’s and employee data commonly receive heightened protection.

A prototype data inventory should identify:

• data categories and whether individuals can be identified;
• collection source and legal or ethical basis;
• purpose and compatible secondary uses;
• storage location and international transfers;
• access roles and processors;
• retention and deletion rules; and
• data-subject rights and incident procedures.

An entrepreneur should not collect data simply because future analytics might be useful. A smaller, purpose-specific dataset reduces exposure and simplifies consent, security and deletion. Anonymisation must be evaluated carefully: removing names does not necessarily prevent re-identification when datasets can be linked. Pseudonymisation reduces direct identification but normally does not remove privacy obligations.

4.2 Security of connected prototypes

Cybersecurity should be threat-modelled early. Identify assets, actors, entry points, trust boundaries, likely attacks, consequences and mitigations. Controls may include secure authentication, least privilege, encryption in transit and at rest, signed updates, secrets management, dependency scanning, logging, vulnerability disclosure, backup and recovery testing.

A prototype should not use production credentials, real customer data or unrestricted internet exposure merely for convenience. Security testing must be authorised and conducted in a controlled environment. A vulnerability disclosure policy gives researchers a safe channel for reporting weaknesses and establishes response responsibilities.

Artificial intelligence introduces additional concerns: training-data rights, representativeness, model leakage, adversarial inputs, automation bias, explainability, human oversight and performance degradation after deployment. Claims about accuracy should be supported by representative validation and clearly bounded conditions. A model that performs well on average may still cause unacceptable harm to a minority group.

5. Safety, Product Liability and Human Factors

5.1 Safety as a lifecycle activity

Safety is not equivalent to passing a final inspection. It is a lifecycle process beginning with hazard identification and continuing through design, verification, manufacture, instructions, monitoring and corrective action. A useful hierarchy of controls prioritises inherently safer design, then guards and protective systems, then warnings and training. Warnings should not substitute for feasible risk reduction.

Risk is often analysed as a combination of severity and probability, but a simple numerical multiplication should not be treated as a universally valid law. Qualitative matrices, fault-tree analysis, failure mode and effects analysis (FMEA), hazard analysis and scenario testing may be appropriate depending on the sector. FMEA typically records failure mode, effect, cause, existing controls, detectability and proposed action. Its rankings support prioritisation; they do not prove that a product is safe.

Foreseeable misuse matters. A product should be evaluated under reasonably predictable behaviour, environmental conditions, maintenance failures, user error and interaction with other products. Human-factors testing can reveal confusing controls, unsafe assumptions and accessibility barriers that laboratory engineering tests miss.

5.2 Product liability

Product-liability exposure may arise from manufacturing defects, design defects, inadequate warnings or instructions, breach of contract, negligence or statutory regimes, depending on jurisdiction. Documentation is strategically important: requirements, design decisions, test plans, calibration records, supplier controls, complaints and corrective actions should be traceable.

Entrepreneurs should define acceptance criteria before testing, preserve raw evidence, investigate anomalies and avoid marketing claims that exceed validated performance. Insurance, contractual allocation of responsibility and recall procedures can reduce—but do not eliminate—exposure. A disclaimer cannot lawfully excuse every safety failure, especially where mandatory consumer protections apply.

6. Accessibility and Inclusive Prototyping

Accessibility means that people with varied physical, sensory, cognitive and technological characteristics can use a product effectively and safely. It should be integrated at the requirements stage rather than added after the interface and hardware are fixed.

Inclusive prototyping may involve adjustable dimensions, adequate contrast, captions, screen-reader compatibility, keyboard operation, tactile or auditory feedback, simple language, error recovery and compatibility with assistive technologies. Testing should include people with relevant disabilities, while avoiding tokenism and compensating participants fairly. Accessibility requirements can be technical, procurement-related or legally mandatory depending on sector and jurisdiction.

Universal design does not mean one design works identically for everyone. It means the system offers equitable access where practicable, with alternatives and reasonable accommodations when necessary. Accessibility also improves general usability: captions help noisy-environment users, clear error messages help all users, and adjustable controls support changing contexts.

7. Sector-Specific Regulation and Compliance Architecture

Regulation depends on product function, claims, risk, location and route to market. A device marketed for diagnosis may be regulated differently from a wellness product with similar hardware. A toy, cosmetic, food product, vehicle component, financial technology service, medical device and industrial machine each have distinct expectations.

A compliance architecture should answer five questions:

1. What is the product’s legal classification in each target market?
2. Which mandatory standards, technical regulations, registrations or approvals apply?
3. What evidence demonstrates conformity?
4. Who is responsible for testing, certification, labelling, post-market surveillance and incident reporting?
5. What changes trigger reassessment?

Common evidence includes technical files, drawings, risk assessments, test reports, declarations, quality records, labels, instructions, clinical or performance evidence and supplier certificates. Voluntary standards may support conformity and market credibility, but they do not automatically replace mandatory law.

Examples of sector-specific concerns include electrical safety and electromagnetic compatibility for connected hardware; medical-device quality and clinical evidence for health products; food-contact and sanitation rules for kitchen products; aviation or automotive requirements for safety-critical systems; financial, consumer-protection and anti-money-laundering obligations for fintech; and environmental restrictions governing hazardous substances, batteries, packaging and waste.

A compliance matrix can link each requirement to a design feature, test method, owner, evidence location and status. It should be version-controlled. Regulatory interpretation should be confirmed with competent authorities, accredited laboratories or specialist advisers where consequences are significant.

8. An Integrated Governance Workflow

The following workflow embeds governance into iterative prototyping:

Discover. Identify users, affected non-users, intended use, foreseeable misuse, jurisdictions and sector classification.

Map. Inventory IP, data, hazards, stakeholders, suppliers, standards and legal obligations.

Decide. Select protection, disclosure, testing, consent, security and compliance strategies before irreversible commitments.

Build. Apply privacy, security, accessibility and safety requirements within design and procurement decisions.

Verify. Conduct technical tests, usability and accessibility studies, security assessment, IP review and regulatory evaluation.

Document. Preserve assumptions, evidence, approvals, incidents, design changes and unresolved risks.

Release cautiously. Use staged pilots, clear instructions, monitoring, support and incident-response arrangements.

Learn and govern. Review complaints, failures, new threats, legal changes and post-market data; update the product and its evidence file.

This workflow is iterative. A change in sensor, algorithm, supplier, user group or marketing claim can alter IP, safety, privacy and regulatory conclusions.

Applied Case: Illustrative Smart Medication Dispenser

Background

A fictional startup, MedAssist, develops a connected dispenser intended to remind users to take medication and notify a caregiver when a dose is missed. The prototype includes a mechanical dispensing mechanism, a mobile application, cloud analytics and a camera intended to confirm access to the medication compartment.

Problem

The founders initially describe the product as a “diagnostic adherence system,” collect continuous video, use a contractor’s unlicensed software library and plan to demonstrate the device at a public investor event before filing any IP application. The prototype also jams when loaded incorrectly and the application is difficult to use with screen readers.

Analysis

The diagnostic claim may move the product into a more demanding medical-device classification. The camera creates privacy and cybersecurity risks, particularly if images of users or household members are uploaded. The unlicensed library creates copyright and licence-compliance risk. Public demonstration may compromise patent or design options. Mechanical jamming creates a foreseeable safety and medication-access hazard. Caregivers may incorrectly assume that a notification proves ingestion, creating a risk of overreliance.

Approach and solution

MedAssist first defines the intended use and removes the unsupported diagnostic claim. It conducts a regulatory classification review and consults a specialist. The team replaces continuous video with a local, event-based sensor where feasible, documents the data purpose, obtains informed consent for pilot testing and establishes deletion and access controls. It performs a threat model, separates development from production credentials and implements signed firmware updates.

The founders complete an IP inventory, obtain assignments from the contractor, review software licences, conduct a prior-art and trademark search, and delay public disclosure until an appropriate filing and confidentiality plan are completed. They redesign the loading mechanism, add a mechanical fail-safe and test foreseeable misuse. The app gains screen-reader labels, scalable text, high contrast and non-visual alerts. Pilot participants receive clear instructions that an alert indicates dispenser activity or a missed event—not confirmed ingestion.

Outcome

The revised prototype has a narrower but supportable claim, less intrusive data collection, clearer user expectations and a traceable evidence file. Testing reveals two additional failure modes, which are corrected before the pilot. Although development takes longer, the startup reduces rework, improves investor confidence and creates a defensible basis for regulatory dialogue.

Learning points

The case demonstrates that IP, ethics, safety, accessibility and compliance are interdependent. A marketing claim can change regulatory status; a design change can alter patent scope and safety; a data-minimisation decision can improve both privacy and cybersecurity; and inclusive testing can identify operational hazards. Governance is therefore part of product quality, not an administrative layer added after innovation.

Challenges and Limitations

Small ventures often lack legal budgets, regulatory expertise and dedicated security staff. International expansion multiplies these difficulties because rights, privacy rules, standards and liability regimes differ. Excessive secrecy can prevent useful collaboration, while excessive openness can destroy competitive advantage. Formal risk matrices can create false confidence if probability estimates are weak or if low-frequency catastrophic harms are averaged away. Compliance can also become performative when teams collect certificates without understanding actual use conditions.

The appropriate response is proportionality and escalation. Low-risk exploratory prototypes may require lightweight controls, whereas products involving children, health, finance, critical infrastructure or physical hazards require specialist review and stronger evidence. Entrepreneurs should identify “stop points” at which expert advice, ethics review, accredited testing or regulator engagement becomes mandatory for responsible progress.

Contemporary Developments and Best Practices

Current practice is moving toward secure-by-design, privacy-enhancing technologies, software bills of materials, responsible AI governance, digital product passports, circular-design obligations and stronger supply-chain accountability. These developments make traceability increasingly valuable. A software bill of materials, for example, helps identify vulnerable dependencies; it does not itself secure the product, but it improves response capability.

Best practices include:

• establish an IP and compliance owner even in a small team;
• maintain a living risk, requirement and decision register;
• use version control for designs, code, evidence and approvals;
• obtain written ownership and licence rights before investment;
• minimise data and test with synthetic or de-identified data where possible;
• threat-model connected products before deployment;
• include accessibility and misuse scenarios in acceptance testing;
• validate every safety and marketing claim;
• preserve raw test results and investigate adverse findings;
• use staged release, monitoring and incident response; and
• seek qualified legal, regulatory, ethics and security advice at defined escalation points.

Chapter Summary

Product prototyping is simultaneously a technical, commercial, ethical and regulated activity. Patents protect qualifying technical inventions; industrial designs protect appearance; copyright protects original expression; trade secrets protect valuable information kept secret; and trademarks distinguish commercial source. An IP map, ownership evidence, confidentiality controls, licence review and freedom-to-operate analysis reduce strategic risk.

Ethical prototyping extends beyond legal compliance. It requires informed consent, protection of vulnerable participants, honest reporting, anticipation of misuse and attention to who benefits or bears harm. Privacy by design limits unnecessary data collection, while cybersecurity requires threat modelling, access control, secure updates and incident readiness. Safety depends on lifecycle hazard analysis, human-factors testing, traceable evidence and appropriate controls. Accessibility should be built into requirements and tested with diverse users.

Finally, regulatory classification, standards, conformity assessment and post-market duties must be integrated into the product roadmap. A mature venture treats governance as an iterative design capability: it maps obligations, builds controls, verifies evidence, documents decisions and learns from real-world use.

Key Terms

Intellectual property: Legal rights protecting creations, inventions, identifiers and confidential business information.

Patent: A time-limited, territorial right granted for a qualifying invention in exchange for disclosure.

Industrial design: Protection for qualifying visual features of a product.

Copyright: Protection for original expression fixed in a material or digital form.

Trade secret: Valuable confidential information protected through reasonable secrecy measures.

Trademark: A sign identifying the commercial source of goods or services.

Freedom to operate: An assessment of whether planned activities may infringe third-party rights.

Background IP: Intellectual property contributed to a project before the project begins.

Foreground IP: Intellectual property created during a project.

Confidentiality agreement: A contract controlling permitted disclosure and use of information.

Informed consent: Voluntary, comprehending agreement to participate after relevant information is provided.

Privacy by design: Incorporating privacy protections into products and processes from the outset.

Pseudonymisation: Replacing direct identifiers while retaining a controlled possibility of linkage.

Threat model: A structured analysis of assets, actors, attack paths and consequences.

Product liability: Legal responsibility for harm caused by defects, inadequate warnings or other actionable conduct.

Foreseeable misuse: Use that a reasonable designer should anticipate, even if unintended.

Accessibility: Design enabling people with diverse abilities to use a product effectively and safely.

Conformity assessment: The process of demonstrating that a product meets specified requirements.

Post-market surveillance: Monitoring product performance, incidents and emerging risks after release.

Review Questions

Short Answer Questions

1. How do patentability and freedom to operate differ?
2. Why is trade-secret protection dependent on reasonable secrecy measures?
3. What information should be included in an informed-consent process?
4. Explain the difference between anonymisation and pseudonymisation.
5. Why should accessibility be addressed during early prototyping?

Long Answer Questions

1. Compare patents, industrial designs, copyright and trade secrets, and recommend a combined strategy for a connected consumer product.
2. Explain how privacy by design and cybersecurity by design can be integrated into an iterative prototyping workflow.
3. Discuss the ethical responsibilities of an entrepreneur conducting tests with vulnerable participants.
4. Analyse how product claims, intended use and foreseeable misuse influence regulatory and liability exposure.
5. Develop a compliance architecture for a prototype that combines hardware, software, cloud services and third-party components.

Analytical / Application Questions

1. A startup plans to publish a video of a novel machine before filing any IP application. Analyse the risks and propose a disclosure strategy.
2. A fitness application obtains continuous location and health data although its core reminder function needs neither. Apply data-minimisation and ethical principles to redesign the data architecture.
3. A prototype works reliably in laboratory conditions but fails when users load it incorrectly and its interface is inaccessible to screen-reader users. Construct a prioritised action plan covering safety, human factors, accessibility, documentation and release decisions.

Multiple Choice Questions with Answers

Question 1

Which question is addressed by a freedom-to-operate analysis?

A. Can the startup obtain a trademark for its name?

B. Can the startup commercialise the product without infringing relevant third-party rights?

C. Has the product achieved universal accessibility?

D. Has the product passed all usability tests?

Correct Answer: B. Can the startup commercialise the product without infringing relevant third-party rights?

Question 2

Which subject matter is most directly associated with copyright protection?

A. An original software program

B. A product’s chemical composition as such

C. A company’s confidential manufacturing parameter

D. The commercial source-identifying name alone

Correct Answer: A. An original software program

Question 3

What is the principal weakness of relying on a confidentiality agreement after information has already become public?

A. It automatically transfers ownership to the recipient

B. It cannot restore secrecy that has been lost

C. It prevents all patent filings worldwide

D. It eliminates the need for access controls

Correct Answer: B. It cannot restore secrecy that has been lost

Question 4

Which practice best reflects data minimisation?

A. Collecting all potentially useful data for future analysis

B. Retaining identifiable data indefinitely

C. Collecting only data necessary for a defined purpose

D. Sharing raw data with every project partner

Correct Answer: C. Collecting only data necessary for a defined purpose

Question 5

Which statement about product safety is most accurate?

A. Warnings always replace the need for safer design

B. A final inspection makes lifecycle safety unnecessary

C. Foreseeable misuse should be considered in risk analysis

D. A risk matrix proves that a product is safe

Correct Answer: C. Foreseeable misuse should be considered in risk analysis

Question 6

What is the main purpose of informed consent in participant testing?

A. To guarantee that no participant can withdraw

B. To ensure voluntary agreement based on relevant understanding

C. To transfer all product liability to participants

D. To allow researchers to omit foreseeable risks

Correct Answer: B. To ensure voluntary agreement based on relevant understanding

Question 7

Which control is especially relevant to secure software updates in a connected prototype?

A. Signed updates

B. Unrestricted administrator access

C. Shared production passwords

D. Disabling vulnerability reporting

Correct Answer: A. Signed updates

Question 8

Which statement best describes a trademark?

A. It protects a qualifying technical invention

B. It protects the visual appearance of every product automatically

C. It identifies the commercial source of goods or services

D. It protects any information a company prefers not to disclose

Correct Answer: C. It identifies the commercial source of goods or services

Question 9

Why should accessibility be tested with relevant users where feasible?

A. Technical compliance documents always predict real use

B. Users can reveal barriers that laboratory tests may miss

C. Accessibility applies only after commercial launch

D. It removes the need for functional testing

Correct Answer: B. Users can reveal barriers that laboratory tests may miss

Question 10

What is the most appropriate first response when a product’s marketing claim may change its regulatory classification?

A. Continue marketing and address classification after launch

B. Remove all technical documentation

C. Conduct a classification review and obtain competent advice

D. Assume that similar hardware has the same legal classification

Correct Answer: C. Conduct a classification review and obtain competent advice