Digital Transformation, Innovation, and AI

Introduction

Digital transformation is the strategic redesign of an organization through digital technologies, data, new capabilities, and changed ways of working. It is broader than digitization—the conversion of analogue information into digital form—and digitalization—the use of digital tools to improve existing processes. Transformation can alter a firm’s value proposition, revenue model, operating architecture, organizational boundaries, and international competitive position.

For international businesses, transformation is especially complex. A digital platform may scale globally at low marginal cost, yet encounter different languages, customer expectations, infrastructure, cybersecurity threats, data-localization rules, and artificial intelligence (AI) regulations. Decisions that appear technically efficient may therefore be legally impermissible, socially unacceptable, or strategically fragile in particular countries.

Managers must treat digital technology as a sociotechnical system: technology, people, processes, incentives, institutions, and ethical consequences interact. Sustainable advantage rarely comes from purchasing software alone. It arises from complementary capabilities such as trusted data, organizational learning, cybersecurity, ecosystem management, and responsible governance.

Learning Objectives

After studying this chapter, students should be able to:

1. Distinguish digitization, digitalization, and digital transformation.
2. Evaluate platform strategies, network effects, and data-driven business models.
3. Assess automation and generative AI applications, risks, and organizational requirements.
4. apply investment appraisal to digital initiatives using net benefit and net present value.
5. Explain cybersecurity as a strategic international business responsibility.
6. Analyze cross-border data governance and regulatory constraints.
7. Design global innovation networks that balance integration and local responsiveness.
8. Recommend responsible technology adoption and governance mechanisms.

1. The Strategic Nature of Digital Transformation

Digital transformation concerns how a business creates, delivers, and captures value. Its main dimensions include:

A useful distinction is:

• Digitization: converting physical information into digital data, such as scanning invoices.
• Digitalization: improving an existing activity through digital technology, such as automated invoice matching.
• Digital transformation: redesigning the wider system, such as integrating procurement, supplier finance, and predictive demand planning on a global platform.

1.1 Technology is not strategy

Cloud services, AI, application programming interfaces (APIs), robotics, and distributed ledgers are technological resources. They become strategically valuable only when combined with distinctive processes and capabilities. Under the resource-based view, a technology contributes to sustained advantage when the organization uses it in a valuable and difficult-to-replicate configuration. Widely available software seldom meets this condition by itself.

Dynamic capabilities are therefore important. Firms must be able to:

1. Sense technological and market changes.
2. Seize promising opportunities through investment and business-model choices.
3. Transform assets, structures, and routines as conditions change.

A company may successfully sense generative AI but fail to seize it because its data are inaccessible. Alternatively, it may implement tools rapidly but fail to transform employee roles and controls.

2. Digital Platforms and Ecosystem Strategy

A digital platform provides shared technological and governance infrastructure through which two or more participant groups interact. Examples include marketplaces connecting buyers and sellers, operating systems connecting users and developers, and industrial platforms connecting equipment owners, service firms, and data providers.

2.1 Network effects

A direct network effect occurs when a service becomes more valuable as the number of similar users increases. A messaging network is a typical example. An indirect or cross-side network effect occurs when growth in one participant group increases value for another. More buyers may attract more sellers, while more sellers improve buyer choice.

Network effects are not automatically positive. Growth may create congestion, fraud, misinformation, poor-quality supply, or excessive search costs. Platform governance—including admission rules, verification, ranking, dispute resolution, pricing, and data access—is therefore part of the value proposition.

2.2 Platform economics

A platform may earn revenue through commissions, subscriptions, advertising, licensing, or complementary services. For a commission-based platform:

where:

• R = platform revenue per period, measured in currency;
• τ = average commission or take rate, expressed as a decimal;
• G = gross merchandise value transacted during the period, measured in currency; and
• S = other revenue, such as subscriptions, measured in currency per period.

This relationship is an accounting approximation. It assumes the stated take rate applies to the relevant transaction value and excludes refunds, taxes, and pass-through amounts unless these are included consistently.

If quarterly gross merchandise value is €40 million, the average take rate is 6%, and subscription revenue is €0.5 million, revenue is:

Revenue is not profit. The platform must also account for payment processing, customer acquisition, moderation, cybersecurity, infrastructure, refunds, and regulatory compliance.

2.3 International platform choices

A global platform must decide what to standardize and what to localize. Core architecture, identity controls, and cybersecurity may benefit from standardization. Payments, language, content moderation, delivery, taxation, and consumer protection frequently require local adaptation.

Managers should evaluate:

• strength and direction of network effects;
• participant acquisition and multihoming behavior;
• switching costs and interoperability;
• quality control and trust mechanisms;
• ecosystem dependence and bargaining power;
• national infrastructure and payment systems;
• competition, consumer, labor, and platform regulation.

“Winner-takes-all” is not a universal platform outcome. Multiple platforms can coexist when users multihome, preferences differ by country, capacity is constrained, or interoperability reduces switching costs.

3. Data-Driven Business Models

A data-driven business model systematically uses data to improve decisions, automate activities, personalize offerings, create services, or generate revenue. The strategic cycle is:

Figure: A governed data feedback cycle can strengthen customer value and organizational learning.

Data alone do not create advantage. Value depends on data quality, timeliness, representativeness, accessibility, legal permission, analytical capability, and integration into decisions. Feedback loops can become self-reinforcing: better services attract more users, generating more useful data and further improvements. They can also amplify historical bias or exclude underrepresented groups.

Common data-driven models include:

• personalization and recommendation;
• dynamic inventory and pricing decisions;
• predictive maintenance;
• usage-based insurance or equipment services;
• fraud and anomaly detection;
• data-enabled benchmarking;
• digital twins and simulation.

Data monetization should not be equated solely with selling personal data. Internal cost reduction, improved risk management, and enhanced service quality are often safer and more sustainable forms of value creation.

4. Automation and Intelligent Operations

Automation reallocates tasks between people and machines. Rule-based workflow tools are appropriate for repetitive, stable, structured activities. Robotic process automation can interact with existing interfaces, while APIs usually provide more robust system-to-system integration. Machine learning is useful when decisions depend on patterns that cannot be fully expressed as fixed rules.

4.1 Selecting tasks for automation

Good candidates typically have high volume, standardized inputs, measurable outcomes, and manageable exceptions. Poor candidates involve ambiguous objectives, rare situations, tacit knowledge, empathy, or consequences that require accountable human judgment.

The correct unit of analysis is usually the task, not the occupation. A procurement specialist’s data entry may be automated while supplier negotiation and ethical judgment remain human responsibilities.

Automation can produce several effects:

• substitution: technology performs a human task;
• augmentation: technology improves human performance;
• creation: new tasks emerge, such as model monitoring;
• coordination: workflows connect participants across borders.

Managers must consider process redesign, exception handling, segregation of duties, employee consultation, reskilling, and business continuity. Automating a defective process can accelerate errors rather than create value.

5. Generative AI in International Business

Generative AI produces content such as text, software code, images, audio, or structured summaries based on learned statistical patterns. Large language models generate probable sequences of tokens; they do not inherently verify truth or possess human understanding.

Potential international business applications include:

• multilingual drafting and translation;
• customer-service assistance;
• contract and market-research summarization;
• software development support;
• localized marketing content;
• employee knowledge search;
• scenario generation and training simulations.

5.1 Deployment patterns

A general-purpose model may be accessed through a controlled enterprise interface. Retrieval-augmented generation (RAG) supplies relevant organizational documents at query time, helping ground outputs in approved sources. Fine-tuning adjusts a model for recurring patterns or specialized behavior but does not guarantee factual accuracy. High-risk use may require deterministic rules, specialist models, or human authorization rather than unconstrained generation.

5.2 Principal risks

Generative AI can create:

• fabricated or unsupported statements, often called hallucinations;
• confidential-data leakage;
• intellectual-property disputes;
• biased or discriminatory outputs;
• unsafe code or misleading advice;
• prompt injection and manipulated tool use;
• excessive reliance and declining human scrutiny;
• unclear accountability across model providers and deployers.

Human oversight must be substantive. A reviewer needs appropriate expertise, sufficient time, access to evidence, and authority to reject an output. Merely requiring an employee to click “approve” is not meaningful oversight.

5.3 AI control architecture

Responsible deployment should include an approved-use policy, data classification, vendor due diligence, access controls, testing, source citation where feasible, logging, monitoring, incident response, and retirement criteria. Model performance should be evaluated in the languages, countries, and user groups in which the system will operate. A model that performs well in English may fail on low-resource languages or culturally specific contexts.

6. Financial Evaluation of Digital Investments

Digital projects should be evaluated strategically and financially. Relevant benefits may include incremental revenue, avoided operating cost, reduced losses, improved working capital, and residual value. Relevant costs include implementation, integration, training, cloud use, cybersecurity, compliance, maintenance, and decommissioning.

6.1 Undiscounted net benefit

For a one-period or simplified undiscounted comparison:

where:

• N = total undiscounted net benefit, in currency;
• B = total measurable benefits over the evaluation period, in currency;
• C = total operating and recurring costs over the period, excluding initial investment, in currency; and
• I = initial investment, in currency.

The exclusion of initial investment from C is explicit; therefore I must be deducted separately. This measure ignores the timing and risk of cash flows and is unsuitable when these are material.

6.2 Net present value

For a multi-period project, net present value (NPV) discounts future incremental cash flows:

where:

• I₀ = initial investment at time 0, in currency;
• B_t = incremental cash benefit received at the end of period t, in currency;
• C_t = incremental operating cost paid at the end of period t, excluding I₀, in currency;
• r = risk-appropriate discount rate per period, expressed as a decimal;
• T = number of periods; and
• V_T = residual or terminal value received at the end of period T, in currency.

The formula assumes that the discount-rate period matches the cash-flow period and that cash flows occur at period end. Nominal cash flows require a nominal discount rate expressed in the same currency; real cash flows require a consistent real rate. A positive NPV indicates that quantified discounted benefits exceed quantified discounted costs, but it does not eliminate legal, ethical, cybersecurity, or strategic concerns.

6.3 Worked investment example

A company is evaluating a three-year automation and AI project. All figures are in thousands of US dollars. Initial investment is $600,000. Annual benefits and operating costs are forecast as follows:

The undiscounted net benefit is:

Thus, undiscounted net benefit is $420,000.

Using a 10% annual discount rate, no terminal value, and end-of-year cash flows:

The NPV is approximately $236,070. The project is financially attractive under the stated assumptions. Management should nevertheless test lower benefits, higher operating costs, implementation delays, exchange-rate exposure, and model-governance costs. Benefits such as employee time savings should be counted only when the organization can redeploy that time or otherwise realize economic value.

7. Cybersecurity as Strategic Risk Management

Cybersecurity protects the confidentiality, integrity, and availability of information and systems. It is not solely an information technology issue: cyber incidents can halt production, disrupt logistics, violate privacy, destroy trust, and create cross-border legal exposure.

International firms face phishing, ransomware, credential theft, supply-chain compromise, insider threats, denial-of-service attacks, and theft of intellectual property. Cloud adoption changes rather than removes responsibility. Providers secure designated infrastructure layers, while customers remain responsible for matters such as access configuration, data classification, and application security under the applicable shared-responsibility model.

7.1 Core safeguards

A risk-based security program normally includes:

• asset and data inventories;
• strong identity controls and multifactor authentication;
• least-privilege access;
• secure configuration and vulnerability management;
• encryption in transit and at rest where appropriate;
• network segmentation;
• protected and tested backups;
• monitoring and incident response;
• supplier security assurance;
• employee awareness and phishing resistance;
• recovery exercises and executive oversight.

A zero-trust approach does not automatically trust a user because the user is inside a corporate network. Access is continually evaluated using identity, device, context, and least-privilege principles.

Cyber risk can be estimated using expected annual loss:

where λ_j is the expected annual frequency of incident type j in events per year, L_j is average loss per event in currency, and EAL is expected annual loss in currency per year. The estimate supports comparison but is highly sensitive to uncertain frequencies, correlated incidents, extreme losses, and incomplete reporting. It should not be treated as a precise forecast.

8. Cross-Border Data Governance

Data governance establishes decision rights, standards, and accountability for data. It addresses what data exist, why they are collected, who may use them, where they are stored, how long they are retained, and how quality and security are maintained.

8.1 Governance principles

Effective international governance applies:

• purpose limitation: use data for specified legitimate purposes;
• data minimization: collect only what is necessary;
• quality: maintain accurate and sufficiently complete data;
• retention limitation: delete or anonymize data when no longer required;
• security: protect data according to sensitivity;
• transparency: communicate relevant processing practices;
• accountability: assign responsibility and retain evidence of compliance.

Roles commonly include data owners, data stewards, security officers, privacy specialists, system custodians, and model owners. Legal labels such as “controller” and “processor” depend on the applicable jurisdiction and actual decision-making roles, not merely contractual wording.

8.2 Cross-border transfers

Personal and strategically sensitive data may be subject to restrictions on international transfer, government access, localization, or sector-specific storage. Transfer mechanisms can include adequacy decisions, approved contractual clauses, binding corporate rules, consent in limited circumstances, or statutory exceptions. The appropriate mechanism depends on the relevant law and facts.

A company should map the full data flow rather than only the primary database location. Remote support, backups, analytics, subprocessors, and model-provider logs can all constitute cross-border access or transfer. Transfer assessments should examine destination-country law, contractual protection, encryption, key control, minimization, and the practical ability to meet data-subject rights.

Major regulatory environments include comprehensive privacy laws such as the European Union’s General Data Protection Regulation, sectoral regimes, national cybersecurity rules, and emerging risk-based AI legislation. Requirements differ and evolve; global policy should provide a common minimum while local legal teams identify stricter obligations.

9. Managing Global Innovation Networks

Innovation increasingly occurs through networks connecting headquarters, subsidiaries, universities, suppliers, customers, start-ups, and public institutions. Knowledge may originate anywhere in the multinational enterprise rather than flowing only from headquarters to subsidiaries.

9.1 Network design

An effective global innovation network balances:

• global integration: common architecture, shared learning, scale, and interoperability;
• local responsiveness: adaptation to language, regulation, infrastructure, and customer needs;
• exploration: experimentation with new technologies and business models;
• exploitation: refinement and scaling of proven capabilities.

Possible structures include global centers of excellence, regional innovation hubs, subsidiary mandates, corporate venture partnerships, and open-innovation alliances. Modular architectures help local teams innovate without fragmenting core systems.

Absorptive capacity—the ability to recognize, assimilate, and apply external knowledge—is critical. It requires relevant expertise, relationships, and routines for transferring knowledge. Digital collaboration tools help, but tacit knowledge often requires repeated interaction and staff mobility.

9.2 Reverse innovation and intellectual property

Reverse innovation occurs when an offering developed for an emerging or resource-constrained market is later adopted elsewhere. It challenges assumptions that knowledge always travels from advanced economies outward.

Collaboration agreements should specify ownership of background and newly created intellectual property, licensing rights, publication, confidentiality, data access, cybersecurity, and exit arrangements. Excessive central control can suppress local initiative, while weak coordination can create duplicate work and incompatible solutions.

10. Responsible Technology Adoption

Responsible adoption integrates commercial value with legality, security, ethics, and social impact. A proportionate governance process should classify applications according to their consequences. An internal translation assistant does not warrant the same controls as an AI system influencing recruitment, credit, healthcare, or critical infrastructure.

A practical lifecycle includes:

1. Define the problem: identify the legitimate business need and affected stakeholders.
2. Assess alternatives: consider non-AI and lower-risk options.
3. Evaluate data and vendors: verify provenance, rights, quality, security, and dependencies.
4. Conduct impact assessment: analyze privacy, bias, safety, labor, environmental, and human-rights effects.
5. Test before deployment: include security, accuracy, robustness, accessibility, and local-language testing.
6. Assign accountability: identify business, technical, risk, and executive owners.
7. Deploy gradually: use pilots, access limits, fallback procedures, and human escalation.
8. Monitor continuously: detect drift, incidents, misuse, and changing regulation.
9. Retire safely: preserve required records, revoke access, and manage retained data.

Governance should enable appropriate innovation rather than impose identical bureaucracy on every experiment. Regulatory sandboxes, controlled environments, and staged funding allow learning while containing exposure.

11. Illustrative Case: Meridian Industrial Services

Background

Meridian Industrial Services is a fictional multinational manufacturer that services industrial refrigeration equipment in 18 countries. Customers experience costly unplanned failures, while technicians repeatedly diagnose similar problems. Service records are dispersed across regional systems and written in six languages.

Problem

Meridian proposes a global predictive-maintenance platform combined with a generative AI technician assistant. The platform would analyze equipment sensor data and retrieve approved manuals and historical repair records. However, employee data, customer contracts, cyber exposure, and cross-border transfers create significant risks.

Analysis

The project could generate value through fewer failures, faster repairs, parts optimization, and service subscriptions. Network effects are limited rather than universal: more equipment data can improve failure models, but value depends on equipment comparability and reliable labels.

A review identifies four major concerns:

1. European maintenance records may contain identifiable employee information.
2. Some countries restrict transfer of industrial or personal data.
3. A compromised assistant could reveal confidential manuals or recommend unsafe repairs.
4. Historical records overrepresent older equipment in high-income markets.

Financial analysis produces a positive NPV under the base case, but sensitivity analysis shows that a one-year global delay would materially reduce value.

Approach

Meridian establishes a global core with regional controls. It standardizes equipment identifiers, APIs, security logging, and model documentation. Regional data stewards apply local retention and transfer rules. Personal fields are removed when unnecessary, and certain data remain in regional environments.

The technician assistant uses retrieval from approved documents rather than unrestricted internet content. It displays source references and confidence warnings. Safety-critical recommendations require technician confirmation against an authorized procedure. The system cannot autonomously change equipment settings.

Meridian pilots the system in two regions representing different languages and equipment ages. It tests accuracy by fault category and region, conducts penetration testing, trains technicians, and provides an incident-reporting channel. A cross-functional committee reviews expansion at defined stage gates.

Outcome

The pilot reduces average diagnostic time, but model performance is weaker for a locally manufactured equipment class. Meridian postpones deployment for that class and obtains additional training data through a supplier partnership. The remaining rollout proceeds in phases. Adoption improves because technicians participate in design and retain authority over safety decisions.

Learning Points

• A positive financial case is necessary but not sufficient.
• Global standardization should focus on shared architecture and controls, not indiscriminate data centralization.
• Generative AI is safer when grounded in approved sources and constrained by human authorization.
• Local pilots can reveal distributional performance differences hidden by global averages.
• Employee participation, governance, and technical design jointly determine adoption.

12. Contemporary Developments and Managerial Priorities

Multimodal AI increasingly combines text, audio, images, video, and sensor data. Smaller models and edge computing can reduce latency and support local processing, although they still require security and lifecycle management. Organizations are also developing sovereign-cloud arrangements, confidential computing, synthetic data, and privacy-enhancing technologies to address jurisdictional concerns.

AI agents capable of planning and using external tools may increase productivity but also amplify errors. Giving an agent permission to send payments, modify databases, or contact customers creates materially greater risk than generating a draft. Permissions, transaction limits, sandboxing, monitoring, and human approval must correspond to the potential impact.

Managers should avoid both technological determinism—the belief that adoption inevitably produces progress—and reflexive resistance. The central question is not whether a technology is fashionable, but whether it solves a defined problem in a financially sound, secure, lawful, and socially responsible manner.

Chapter Summary

Digital transformation redesigns customer value, operations, business models, ecosystems, and organizational capabilities. Platforms can benefit from direct and cross-side network effects, but success depends on governance, trust, localization, and sustainable unit economics. Data-driven models create value through learning and improved decisions, while also creating privacy, bias, and dependency risks.

Automation should be applied at task level and combined with process redesign and workforce development. Generative AI offers multilingual and knowledge-work applications but requires grounding, testing, security, meaningful human oversight, and clear accountability. Digital investments should be assessed using consistent cash-flow definitions and, where timing matters, net present value.

Cybersecurity, cross-border data governance, and evolving AI regulation are strategic concerns rather than technical afterthoughts. Global innovation networks must balance integration with local responsiveness and exploration with exploitation. Responsible adoption uses proportionate lifecycle governance, stakeholder participation, staged deployment, and continuous monitoring.

Key Terms

Absorptive capacity: The ability to recognize, assimilate, and apply external knowledge.

Automation: The performance of tasks or workflows by technological systems with reduced manual intervention.

Cross-side network effect: An increase in value for one participant group caused by growth in another group.

Cybersecurity: Protection of the confidentiality, integrity, and availability of information and systems.

Data governance: Decision rights, standards, roles, and controls governing data throughout its lifecycle.

Data localization: A legal or policy requirement that specified data be stored or processed within a jurisdiction.

Digital platform: Shared infrastructure enabling interactions among multiple participant groups.

Digital transformation: Strategic organizational redesign enabled by digital technologies and capabilities.

Digitalization: Use of digital technologies to improve existing processes or activities.

Digitization: Conversion of analogue information into digital form.

Dynamic capabilities: Organizational abilities to sense opportunities, seize them, and transform resources.

Generative AI: AI that produces content based on patterns learned from data.

Human oversight: Meaningful human review and authority over a technological system or decision.

Network effect: A change in user value caused by changes in the number or composition of users.

Net present value: Present value of future incremental cash flows minus initial investment.

Retrieval-augmented generation: Generation supported by information retrieved from selected external sources at query time.

Reverse innovation: Innovation developed in one context, often an emerging market, and subsequently adopted elsewhere.

Zero trust: A security approach that continuously verifies access rather than relying on network location.

Review Questions

Short Answer Questions

1. Distinguish digitization, digitalization, and digital transformation.
2. What is the difference between direct and cross-side network effects?
3. Why does human oversight require more than formal approval?
4. Identify four principles of cross-border data governance.
5. What is absorptive capacity, and why is it important?

Long Answer Questions

1. Explain how digital transformation can change value creation, delivery, and capture in an international business.
2. Critically evaluate the advantages and risks of global digital platform strategies.
3. Discuss the organizational and governance requirements for responsible generative AI deployment.
4. Explain how cybersecurity and privacy considerations should influence international digital strategy.
5. Analyze how multinational enterprises can design effective global innovation networks.

Analytical / Application Questions

1. A retailer plans to centralize customer data from ten countries. Develop a decision framework covering business value, legal transfer mechanisms, security, localization, and accountability.
2. Select a business process and divide it into tasks. Determine which tasks should be automated, augmented, or retained for human performance, and justify your choices.
3. Using the NPV framework, evaluate a proposed AI investment under base, optimistic, and pessimistic assumptions. Explain any nonfinancial reasons for accepting or rejecting it.

Multiple Choice Questions with Answers

Question 1

Which statement best describes digital transformation?

A. Converting paper records into electronic files

B. Installing new software without changing organizational processes

C. Strategically redesigning value creation, operations, and capabilities through digital technology

D. Outsourcing all information technology activities

Correct Answer: C. Strategically redesigning value creation, operations, and capabilities through digital technology

Question 2

A marketplace becomes more attractive to sellers because its number of buyers has increased. What does this illustrate?

A. A cross-side network effect

B. A direct network effect among sellers

C. Data localization

D. Process automation

Correct Answer: A. A cross-side network effect

Question 3

A platform has gross merchandise value of $20 million, a 5% take rate, and subscription revenue of $0.4 million. Using R = τG + S, what is its platform revenue?

A. $0.6 million

B. $1.0 million

C. $1.4 million

D. $20.4 million

Correct Answer: C. $1.4 million

Question 4

Which task is generally the strongest candidate for rule-based automation?

A. Negotiating a politically sensitive international partnership

B. Approving an unusual safety exception

C. Reconciling standardized invoices with purchase orders

D. Resolving an ambiguous employee grievance

Correct Answer: C. Reconciling standardized invoices with purchase orders

Question 5

What is the primary purpose of retrieval-augmented generation?

A. To remove the need for access controls

B. To ground generated responses in retrieved sources

C. To guarantee that every output is legally compliant

D. To convert all unstructured data into personal data

Correct Answer: B. To ground generated responses in retrieved sources

Question 6

A project requires an initial investment of $100,000 and produces end-of-year net cash inflows of $60,000 in each of two years. At a 10% annual discount rate, what is the approximate NPV?

A. −$4,130

B. $0

C. $4,130

D. $20,000

Correct Answer: C. $4,130

Question 7

If total benefits are $900,000, recurring costs excluding initial investment are $300,000, and initial investment is $250,000, what is undiscounted net benefit?

A. $350,000

B. $600,000

C. $650,000

D. $850,000

Correct Answer: A. $350,000

Question 8

Which action is most consistent with a zero-trust security approach?

A. Automatically trusting every user connected to the corporate network

B. Continuously evaluating identity, device, and context before granting least-privilege access

C. Eliminating all cloud services

D. Giving employees permanent administrator privileges

Correct Answer: B. Continuously evaluating identity, device, and context before granting least-privilege access

Question 9

Why should a multinational map subprocessors and remote support access when assessing data transfers?

A. Only the location of the primary database can create a transfer

B. Remote access and subprocessors may also involve cross-border processing or access

C. Subprocessors are exempt from privacy and security obligations

D. Data maps replace the need for contractual safeguards

Correct Answer: B. Remote access and subprocessors may also involve cross-border processing or access

Question 10

In the Meridian illustrative case, why was deployment postponed for one equipment class?

A. The entire project had a negative NPV

B. Technicians refused all use of digital tools

C. The model performed inadequately for that locally manufactured class

D. Retrieval from approved manuals was prohibited

Correct Answer: C. The model performed inadequately for that locally manufactured class