12. Data, Analytics, and Artificial Intelligence GovernanceIntroduction and ContextData has become a strategic resource, but its value is not realized merely by collecting larger volumes of it. Organizations create value when data is trustworthy, accessible to authorized users, interpreted appropriately, and converted into decisions or services. Analytics and artificial intelligence (AI) extend this value proposition by identifying patterns, predicting events, automating decisions, and generating content. They also intensify organizational risk. Poor-quality data can produce unreliable conclusions; opaque algorithms can reproduce discrimination; uncontrolled access can expose confidential information; and generative AI can produce persuasive but inaccurate or unauthorized content. Data, analytics, and AI governance therefore constitute an integrated field of strategic governance. It connects information architecture, enterprise risk management, cybersecurity, privacy, compliance, ethics, procurement, internal control, and organizational accountability. The central question is not simply whether an organization uses advanced technology. It is whether the organization can demonstrate that its information and automated decision systems are fit for purpose, lawful, explainable where necessary, secure, monitored, and subject to legitimate human authority. Data governance establishes decision rights and accountability for data assets. Analytics governance controls the production and use of analytical outputs. AI governance extends these arrangements to models and systems that may learn from data, make recommendations, take actions, or generate new content. Effective governance must operate across the entire life cycle: problem definition, data acquisition, design, development, validation, deployment, use, monitoring, modification, retirement, and record preservation. For doctoral-level IT strategists, governance should be examined as a socio-technical and institutional phenomenon. Technical controls matter, but they operate within organizational incentives, professional norms, legal requirements, power relationships, and assumptions about what constitutes a legitimate decision. Governance is consequently not a checklist added after implementation. It is an organizational capability that shapes which innovations are pursued, under what conditions, and with what evidence of responsibility. Learning ObjectivesBy the end of this chapter, the reader should be able to: 1. Distinguish data governance, analytics governance, algorithm governance, and AI governance. 2. Design accountability arrangements for data ownership, stewardship, quality, lineage, access, and privacy. 3. Apply risk-based governance to statistical models, machine-learning systems, and generative AI. 4. Evaluate bias, fairness, explainability, robustness, security, and human oversight. 5. Construct life-cycle controls, monitoring metrics, escalation procedures, and documentation practices. 6. Analyze the strategic, ethical, regulatory, and organizational implications of AI adoption. 7. Critically assess the limitations of governance frameworks and the evidence required to support responsible decisions. From Data Assets to Governed DecisionsA useful distinction is between a data asset, an analytical product, and an automated decision system. A data asset is a structured or unstructured representation of facts, observations, transactions, or events. An analytical product is an interpretation or transformation of data, such as a dashboard, forecast, score, segmentation, or optimization recommendation. An automated decision system uses rules or models to recommend, determine, prioritize, or execute an action. Generative AI systems add the ability to produce text, images, code, audio, or other outputs in response to prompts or contextual inputs. Governance must address both the object and its use. The same data may be appropriate for operational reporting but inappropriate for personnel evaluation. A model with strong predictive accuracy may still be unsuitable if its use creates unacceptable discrimination or if affected individuals cannot challenge its outcome. Thus, governance requires purpose limitation: the organization must state what a data or AI system is intended to do, what it must not do, and which uses require separate authorization. Four governance layers are particularly important. Data governance assigns authority over data definitions, quality, access, retention, and protection. Analytics governance establishes standards for analytical methods, evidence, reproducibility, interpretation, and communication. Algorithm governance addresses decision logic, model performance, bias, validation, and change control. AI governance encompasses these concerns while adding issues such as autonomy, foundation models, generated content, human-machine interaction, and systemic effects. These layers should not be treated as independent committees. They should form a coherent control environment. A data owner may approve access, a privacy officer may assess lawful use, a model validator may test performance, and a business executive may accept residual risk. Their responsibilities differ, but their decisions must be connected through common inventories, risk classifications, documentation, and escalation routes. The Governance ArchitectureGovernance begins with the allocation of decision rights. A board or governing committee sets risk appetite and approves principles. An executive data or digital council translates those principles into enterprise standards. Business and technology leaders sponsor specific use cases. Data owners are accountable for particular domains, while data stewards maintain definitions, quality rules, metadata, and issue resolution. Security, privacy, legal, risk, compliance, and internal audit functions provide specialist challenge and assurance. A practical accountability model can combine a responsibility matrix with a system register. The register should identify each important dataset, dashboard, model, application programming interface, and AI service; its owner; purpose; users; data categories; suppliers; risk level; approval status; validation evidence; and retirement date. A register that lists systems without accountable owners is an inventory, not governance. Governance principles should be translated into operational requirements. Common principles include: - Accountability: a named person or body is answerable for every material data or AI use.
- Purpose limitation: collection and processing are linked to an approved and legitimate purpose.
- Proportionality: the intrusiveness and risk of a system are proportionate to its expected benefit.
- Quality and fitness for use: data and models are assessed against the context in which they will be used.
- Transparency: relevant stakeholders receive understandable information about processing and decision logic.
- Security and resilience: confidentiality, integrity, availability, and recovery are designed into the life cycle.
- Contestability: affected persons have appropriate routes to question, correct, or appeal decisions.
- Human responsibility: automation does not eliminate accountable organizational judgment.
A risk-based approach is preferable to treating every spreadsheet and every AI experiment identically. Low-risk descriptive analysis may require registration and basic access controls. A model used to allocate medical resources, determine credit conditions, or screen employment candidates requires more stringent validation, documentation, monitoring, and human review. Risk classification should consider impact, scale, reversibility, affected populations, data sensitivity, degree of autonomy, and potential for discrimination or systemic harm. Data Quality, Ownership, and LineageData quality is multidimensional. Accuracy asks whether values represent the underlying reality. Completeness asks whether necessary values or records are present. Consistency concerns agreement across systems and definitions. Timeliness concerns whether data is current enough for its purpose. Validity concerns conformity to rules and formats. Uniqueness concerns duplicate records. Quality is contextual: a dataset may be sufficiently timely for annual planning but not for real-time fraud detection. Data ownership should not be confused with possession. A data owner has decision authority and accountability over a domain, while a steward performs operational activities such as maintaining metadata, investigating defects, and coordinating corrections. A custodian manages storage and technical protection. A user consumes data under approved conditions. Clear separation prevents the common failure in which everyone uses data but nobody is accountable for its meaning or quality. Data lineage records the movement and transformation of data from origin to consumption. It may show source systems, ingestion processes, cleansing rules, joins, calculations, model features, reports, and downstream decisions. Lineage supports impact analysis, auditability, incident response, reproducibility, and regulatory inquiry. It is especially important when a model outcome is challenged: an organization should be able to identify which data contributed to the result and which transformations occurred. Metadata management provides the vocabulary for governance. A data catalog can record business definitions, technical schemas, sensitivity classifications, retention rules, quality scores, owners, and permitted uses. However, catalogs can become decorative if definitions are not connected to workflows. Metadata should be maintained at points where data is created, changed, approved, or consumed, preferably through automated discovery and validation supplemented by human review. Quality management should use thresholds tied to business consequences. For example, a critical payment dataset may require near-complete records and strict uniqueness, while an exploratory research dataset may tolerate missing values if limitations are documented. Quality incidents should be prioritized according to impact, not only error counts. Root-cause analysis should distinguish source-process failure, integration failure, definition ambiguity, user error, and deliberate manipulation. Access, Privacy, and Responsible Data UseAccess governance determines who may use which data, for what purpose, under what conditions, and for how long. Role-based access assigns permissions to job functions; attribute-based access can additionally consider project, location, data sensitivity, device, or purpose. The principle of least privilege limits access to what is necessary. Separation of duties reduces the possibility that one individual can create, approve, and exploit a sensitive data process. Access controls alone do not create responsible use. A legitimate user may still combine datasets in a way that creates unacceptable privacy risk. Privacy governance therefore addresses collection, notice, lawful basis where applicable, purpose limitation, retention, individual rights, data minimization, and secure disposal. Sensitive data may require stronger controls, additional approvals, privacy impact assessments, de-identification, aggregation, or restrictions on secondary use. De-identification is not a universal solution. Removing names does not necessarily prevent re-identification when records contain distinctive dates, locations, behaviors, or links to external datasets. Governance should assess the realistic possibility of re-identification and the consequences if it occurs. Synthetic data can reduce exposure in some development situations, but synthetic records may reproduce the biases and structural patterns of the source data and may not preserve the properties needed for valid testing. Analytics teams should document assumptions, exclusions, missingness, sampling methods, and uncertainty. A precise-looking chart can create false confidence if the underlying measure is poorly defined. Communication governance should distinguish correlation from causation, prediction from explanation, and model confidence from factual certainty. Decision-makers must know whether an output is a recommendation, a probability, an estimate, or an automated action. Governing Models and AlgorithmsA model is a simplified representation used to estimate, classify, predict, or optimize. Model governance begins before model training, with a clear statement of the decision problem, affected stakeholders, target variable, acceptable use, and prohibited use. The development record should identify data sources, feature engineering, algorithms considered, training and test methods, performance measures, limitations, and assumptions. Validation should be independent in proportion to risk. Technical validation examines data quality, coding, reproducibility, performance, robustness, and security. Conceptual validation asks whether the model is appropriate for the business problem and whether the target is a defensible proxy for the desired outcome. Outcomes validation examines real-world consequences after deployment. A model can pass technical tests yet fail conceptually if it predicts historical disadvantage and the organization treats that prediction as a legitimate basis for future decisions. Performance metrics must reflect the decision context. Classification systems may use accuracy, precision, recall, specificity, calibration, or area under a curve, but no single metric is sufficient. In imbalanced populations, accuracy may conceal poor performance for a minority class. Fairness assessment may compare error rates, selection rates, calibration, or predictive performance across relevant groups. These criteria can conflict mathematically and ethically; governance therefore requires an explicit rationale for the selected trade-off rather than a claim that a system is simply “fair.” Bias may enter through historical practices, nonrepresentative samples, measurement choices, labels, proxies, missing data, deployment conditions, or feedback loops. Removing a protected attribute does not necessarily remove bias because other variables may encode it. Mitigation techniques include better sampling, label review, feature modification, reweighting, threshold adjustment, human review, and restricting the use case. Technical mitigation cannot solve every structural problem. Sometimes the appropriate governance decision is not to automate. Explainability has several meanings. A global explanation describes general model behavior; a local explanation describes why a particular output was produced; a process explanation describes governance, data, and validation; and a user-oriented explanation translates the result into understandable reasons and possible actions. An explanation should be faithful to the model and useful to the audience. A visually attractive explanation that does not accurately reflect model behavior can create false assurance. Human oversight must be substantive rather than symbolic. A reviewer needs authority, time, competence, relevant evidence, and the ability to disagree with the system. If organizational targets reward rapid acceptance of automated recommendations, nominal human review becomes automation bias. High-impact systems should define override conditions, escalation procedures, review sampling, and records of human decisions. Human involvement is not automatically protective if reviewers are inadequately trained or if the system’s output is treated as presumptively correct. Generative AI GovernanceGenerative AI introduces distinctive governance issues because outputs are probabilistic, fluent, and often difficult to trace to sources. A governance program should distinguish experimentation, internal assistance, customer-facing use, and autonomous action. The risk is affected by the model provider, training and retrieval data, prompts, output recipients, integration with enterprise systems, and consequences of error. Organizations should establish rules for confidential information, personal data, copyrighted material, regulated content, and proprietary prompts. Employees should know whether their inputs may be retained or used by a provider for model improvement. Approved tools, contractual protections, access controls, logging, and technical filters reduce exposure but do not replace professional judgment. Generative systems require output controls. These may include source citation, retrieval from approved repositories, factual verification, malware and code scanning, toxicity and privacy filters, watermarking or labeling where appropriate, and human approval before external publication or consequential action. Retrieval-augmented generation can ground outputs in organizational documents, but it remains vulnerable to incomplete sources, retrieval errors, prompt injection, and unauthorized content. Prompt injection illustrates why AI governance must include security engineering. An attacker may place instructions in a document or message that cause a system to ignore its intended task, reveal information, or invoke an unauthorized tool. Systems connected to email, databases, financial processes, or operational technology should use constrained permissions, input and output validation, sandboxing, transaction confirmation, and comprehensive logging. Autonomous action should be narrowly bounded and reversible where possible. AI-generated content also creates questions of authorship, accountability, and professional competence. The employee or organization presenting an output remains responsible for its accuracy and lawful use. Disclosure of AI assistance may be necessary for transparency, academic integrity, procurement, or customer trust. Governance should avoid both indiscriminate prohibition and uncritical adoption; it should identify acceptable uses, unacceptable uses, and uses requiring enhanced review. Monitoring, Assurance, and Incident ResponseGovernance continues after deployment. Data distributions may change, relationships between variables may shift, user behavior may adapt, and societal conditions may alter the meaning of an output. Model monitoring should therefore cover performance, calibration, drift, subgroup outcomes, data quality, latency, availability, security events, override rates, complaints, and unexpected use. Thresholds should be defined before problems occur. A monitoring alert should identify the owner, severity, required investigation, temporary controls, communication obligations, and decision authority for suspension or rollback. Monitoring dashboards that generate alerts without operational capacity create noise rather than control. High-risk systems should undergo periodic reassessment and event-triggered review after major data, model, supplier, legal, or purpose changes. Documentation is an assurance mechanism. Useful artifacts include a data inventory, data dictionary, lineage record, privacy assessment, model card, system card, risk assessment, validation report, decision log, user guidance, incident record, and retirement plan. Documentation should be proportionate and usable. Excessive paperwork can encourage superficial compliance, while insufficient evidence prevents meaningful challenge. Internal audit can assess whether governance design is adequate and whether controls operate effectively. Independent assurance may be required where the organization lacks expertise or where conflicts of interest are significant. External standards and regulatory frameworks can guide practice, but certification does not prove that a specific use is ethical or fit for purpose. Assurance should examine outcomes and lived effects, not merely the existence of policies. An Integrated Life-Cycle MethodA practical governance process can be organized into seven connected stages. First, classify the use case. Define the purpose, affected people, decision consequences, data sensitivity, autonomy, scale, and reversibility. Decide whether the proposal is permitted, restricted, or prohibited. Second, establish accountability and necessity. Name the owner, identify stakeholders, test whether automation is necessary, and consider less intrusive alternatives. Conduct privacy, security, ethical, and impact assessments where required. Third, prepare data and documentation. Verify provenance, quality, representativeness, legal conditions, lineage, retention, and permitted uses. Record limitations rather than hiding them. Fourth, design and validate. Use approved methods, reproducible development practices, independent review, fairness analysis, robustness testing, and security testing. Define human roles and escalation routes. Fifth, approve and deploy with controls. Confirm that residual risk is accepted by the appropriate authority. Configure access, logging, user training, communication, rollback, and service-level responsibilities. Sixth, monitor and govern change. Track performance and impacts, investigate incidents, reassess risk, and control changes to data, prompts, models, vendors, and interfaces. Seventh, retire or renew. Disable systems that no longer have a legitimate purpose or acceptable performance. Preserve required records, remove unnecessary data, communicate the change, and evaluate lessons for future systems. This process should be embedded in portfolio and architecture governance. A use case should compete for resources not only on projected return but also on control feasibility, social impact, operational readiness, and the organization’s ability to provide continuing oversight. Illustrative Case: A University’s Student Success Prediction SystemBackgroundA large university considers a machine-learning system to identify students who may be at risk of withdrawal. The proposed system would use enrollment history, course performance, engagement data, financial indicators, and records of contact with student services. Advisors would receive a risk score and recommendations for outreach. Situation and ProblemThe university expects improved retention and more targeted support. However, historical withdrawal data reflects unequal access to resources and may encode socioeconomic or disability-related disadvantage. Some students are concerned that surveillance will replace supportive relationships. The university also lacks a complete inventory of data flows between its learning platform, finance system, and advising application. AnalysisThe use case is high impact because it may influence how students are treated and how institutional resources are allocated. Prediction is not equivalent to explanation: a high-risk score may identify correlation without revealing the reason a student needs help. If advisors interpret the score as a judgment of commitment, students may be stigmatized. Missing data may also cause the system to assign lower risk to students who are less visible in digital systems. A governance review identifies several requirements. The university must define a supportive purpose and prohibit punitive uses. Data minimization is necessary; collecting every available student attribute is not justified. Data lineage must connect source records to features and outputs. Performance and error rates should be examined across relevant groups, with attention to false negatives as well as false positives. Students should receive understandable information about the program and a route to correct inaccurate records. Advisors require training that emphasizes that the score is a prompt for conversation, not a determination. Approach and SolutionThe university establishes a cross-functional steering group including student representatives, academic staff, privacy and legal advisers, data stewards, security specialists, and student-support leaders. It conducts an impact assessment and begins with a limited pilot. The model produces risk bands rather than a fully automated action. Advisors must document the support offered and may override the recommendation with reasons. The university excludes variables judged unnecessarily intrusive, publishes a plain-language explanation, tests subgroup performance, and creates a data-quality process for disputed records. A monitoring plan tracks retention outcomes, outreach rates, student complaints, differential error patterns, advisor overrides, and unintended effects. A review committee may suspend the system if performance deteriorates or if students experience adverse consequences. OutcomeThe pilot does not produce an automatic claim of success. Instead, it generates evidence about whether targeted outreach improves student support without increasing stigma or unequal treatment. The university discovers that some engagement measures are unreliable for students with limited connectivity and revises the feature set. The principal governance achievement is not simply a functioning model; it is a bounded decision process in which the model remains subordinate to educational judgment and student rights. Learning PointsThe case demonstrates that governance begins with purpose and institutional values, not model selection. It also shows why data quality, fairness, privacy, human oversight, and monitoring must be addressed together. A technically accurate model may still be unacceptable if its use is coercive, opaque, or unsupported by an effective contestation process. Challenges, Limitations, and Common MistakesGovernance programs face several recurring difficulties. Accountability may be fragmented across business units, vendors, and cloud platforms. Data ownership may be nominal because executives lack time or authority to resolve cross-functional disputes. Technical teams may resist documentation when delivery incentives reward speed. Legal and ethics reviews may occur too late, after architectural decisions have made alternatives expensive. Another limitation is the instability of categories. A system classified as low risk during experimentation may become high risk when integrated into a customer-facing workflow. A general-purpose model may serve harmless and consequential functions simultaneously. Risk classification must therefore be revisited when purpose, scale, users, data, or autonomy changes. Organizations commonly confuse transparency with disclosure of source code, fairness with equal treatment in every metric, privacy with anonymization, and human oversight with the presence of a person somewhere in the process. They may optimize model performance while ignoring operational capacity, or purchase vendor assurances without obtaining evidence relevant to their own context. Governance can also become ceremonial: policies are approved, forms are completed, and harmful outcomes remain invisible because no one measures them. A mature program recognizes uncertainty. Not every risk can be quantified, and not every social value can be reduced to a metric. Qualitative judgment, stakeholder participation, professional standards, and precaution remain necessary. The objective is not to eliminate all risk, which is impossible, but to make risk visible, assign responsibility, reduce avoidable harm, and ensure that decisions are revisable. Regulation and Emerging DirectionsAI regulation is developing through a combination of legislation, sector rules, privacy law, consumer protection, procurement requirements, professional standards, and voluntary frameworks. Regulatory approaches commonly emphasize risk classification, transparency, documentation, security, impact assessment, accountability, and controls for high-impact or prohibited uses. Requirements differ across jurisdictions, so organizations operating internationally need a legal applicability map rather than assuming that a single global policy is sufficient. Emerging governance concerns include foundation-model concentration, model supply-chain risk, energy and resource use, intellectual property, synthetic media, autonomous agents, biometric inference, and the effect of AI on labor and professional expertise. The expansion of AI into operational systems makes identity, authorization, and tool access especially important. Future governance will likely focus less on isolated models and more on networks of models, data providers, software components, users, and downstream decisions. Research opportunities remain substantial. Scholars can investigate how governance affects innovation, how fairness metrics perform in institutional contexts, how people interpret explanations, how organizations develop AI literacy, and how regulatory regimes interact. Evidence should move beyond policy adoption to examine whether governance changes behavior and outcomes. Longitudinal and interdisciplinary research is particularly valuable because many harms emerge only after deployment and organizational adaptation. Best Practices for Strategic LeadersStrategic leaders should treat trusted data and responsible AI as enterprise capabilities rather than technical projects. They should sponsor a clear risk appetite, provide resources for stewardship and monitoring, and ensure that incentives do not reward unsafe deployment. Every significant system should have an accountable owner, a documented purpose, a risk classification, traceable data, appropriate validation, and a practical route for intervention. Leaders should also cultivate challenge. Diverse review groups, independent validation, red-team exercises, user research, and consultation with affected communities can expose assumptions that technical teams miss. Procurement should require evidence about training data, security, privacy, performance, support, incident notification, subcontractors, and exit arrangements. Contracts should not transfer accountability to vendors merely because a service is hosted externally. Finally, governance should be proportionate and adaptive. Automate evidence collection where possible, but preserve human judgment for contextual and ethical decisions. Measure not only efficiency and accuracy but also complaints, distributional effects, reversals, and trust. Responsible governance is demonstrated through what the organization does when a system fails, not only through the policies it publishes when systems work. Chapter SummaryData, analytics, and AI governance create the accountability conditions under which information systems can be trusted and used strategically. Data governance addresses ownership, quality, metadata, lineage, access, privacy, and retention. Analytics and algorithm governance add methodological integrity, validation, fairness, explainability, and change control. AI governance extends these responsibilities to autonomy, generative outputs, foundation models, human-machine interaction, and systemic risk. Effective governance is risk-based and life-cycle oriented. It begins with purpose, necessity, and accountability; continues through data preparation, design, validation, deployment, monitoring, and incident response; and ends with controlled retirement. Technical metrics are necessary but insufficient. Governance must also consider power, institutional context, affected communities, legal duties, professional responsibility, and the possibility that the correct decision is not to automate. The strategic objective is not frictionless adoption, but accountable innovation supported by evidence, contestability, and continuous oversight. Key TermsData governance: The allocation of authority, accountability, policies, and controls for managing data. Data owner: The person or organizational unit accountable for decisions about a defined data domain. Data steward: A role responsible for operational data definitions, quality, metadata, and issue coordination. Data lineage: A record of data origins, transformations, movements, and downstream uses. Metadata: Information describing the meaning, structure, origin, sensitivity, and use of data. Data quality: The degree to which data is accurate, complete, consistent, timely, valid, and fit for purpose. Analytics governance: Controls governing analytical methods, evidence, interpretation, communication, and use. Algorithm governance: Oversight of decision logic and models, including validation, fairness, explainability, and change control. Artificial intelligence governance: Organizational structures and controls for responsible development and use of AI systems. Model risk: The possibility that a model is incorrect, misused, misunderstood, or produces harmful outcomes. Model drift: A change in data or relationships that reduces a model’s relevance or performance after deployment. Explainability: The degree to which a system’s operation or output can be meaningfully understood by an appropriate audience. Fairness: The ethical and analytical assessment of whether system impacts or error patterns are unjust across relevant groups. Human oversight: Meaningful human authority to understand, review, override, or suspend an automated system. Purpose limitation: The requirement that data processing remain connected to a specified and legitimate purpose. Least privilege: Restricting access to the minimum permissions necessary for an authorized task. Generative AI: AI that produces new content such as text, images, code, audio, or video. Prompt injection: An attack that manipulates instructions provided to an AI system to cause unintended behavior. Contestability: The ability of affected persons to question, correct, appeal, or seek review of a decision. Model card: Documentation describing a model’s purpose, performance, limitations, risks, and appropriate use. Review QuestionsShort Answer Questions1. Distinguish a data owner from a data steward. 2. Why is data lineage important in AI governance? 3. What is meant by purpose limitation? 4. Identify two dimensions of data quality and explain their significance. 5. Why does human oversight need to be substantive rather than symbolic? Long Answer Questions1. Explain how data governance, analytics governance, algorithm governance, and AI governance form an integrated governance architecture. 2. Discuss the major stages of a risk-based AI life-cycle governance process. 3. Analyze the relationship among bias, data quality, representativeness, and fairness metrics. 4. Explain the governance requirements created by generative AI, including privacy, prompt injection, output verification, and accountability. 5. Evaluate the role of monitoring, documentation, independent validation, and incident response in managing model risk. Analytical / Application Questions1. An organization wants to use employee communications and productivity data to predict resignation. Design a governance review that addresses purpose, privacy, fairness, access, human oversight, and contestability. 2. A generative AI assistant connected to an internal knowledge base begins returning confidential information to unauthorized users. Analyze the likely governance and technical failures and propose corrective controls. 3. A credit model has high overall accuracy but a substantially higher false-negative rate for one demographic group. Decide what additional evidence and governance actions are required before deployment, and justify your position. 22. Multiple Choice Questions with AnswersQuestion 1Which governance artifact most directly supports tracing a model output back to its source records and transformations? A. A service-level agreement B. A data lineage record C. A business continuity plan D. A user satisfaction survey Correct Answer: B. A data lineage record Question 2A model performs well overall but poorly for a small population group. Which conclusion is most appropriate? A. The model is acceptable because overall accuracy is high B. Removing the protected attribute will automatically solve the problem C. Subgroup performance and the consequences of errors require further assessment D. Human review is unnecessary if the model is statistically significant Correct Answer: C. Subgroup performance and the consequences of errors require further assessment Question 3What makes human oversight substantive? A. A person is nominally listed as the system owner B. A reviewer can understand, challenge, override, or suspend the system when appropriate C. The system produces an explanation screen D. The organization publishes a general AI policy Correct Answer: B. A reviewer can understand, challenge, override, or suspend the system when appropriate Question 4Which situation best illustrates purpose limitation? A. Using every available variable because storage is inexpensive B. Reusing student counseling records for unrelated disciplinary prediction without review C. Retaining data forever in case it becomes useful D. Giving all analysts unrestricted access to improve collaboration Correct Answer: B. Reusing student counseling records for unrelated disciplinary prediction without review Question 5Why can removing a protected attribute fail to eliminate algorithmic bias? A. Models cannot operate without protected attributes B. Other variables may act as proxies and historical bias may remain in labels or samples C. Protected attributes are always required for accuracy D. Fairness is determined only by source-code length Correct Answer: B. Other variables may act as proxies and historical bias may remain in labels or samples Question 6A generative AI system can send emails and update records. Which control is most important for limiting harmful autonomous action? A. A more attractive user interface B. Broad permissions to reduce processing delays C. Constrained permissions, validation, logging, and confirmation for consequential actions D. Removing all monitoring to preserve flexibility Correct Answer: C. Constrained permissions, validation, logging, and confirmation for consequential actions Question 7Which statement best describes model drift? A. A change in the organization’s reporting hierarchy B. A reduction in relevance or performance caused by changing data or relationships after deployment C. A deliberate attempt to explain a model locally D. The initial selection of a training algorithm Correct Answer: B. A reduction in relevance or performance caused by changing data or relationships after deployment Question 8Why is a model with strong predictive accuracy not necessarily suitable for organizational use? A. Accuracy is irrelevant to every decision B. It may still be conceptually inappropriate, discriminatory, opaque, insecure, or harmful in context C. Predictive models cannot be validated D. High accuracy proves that the model is unlawful Correct Answer: B. It may still be conceptually inappropriate, discriminatory, opaque, insecure, or harmful in context Question 9Which governance decision is most appropriate when a proposed use case has high impact but weak data provenance and no effective appeal process? A. Deploy immediately and document problems later B. Classify it as low risk because the model is experimental C. Delay or reject deployment until provenance, safeguards, and contestability are addressed D. Transfer all accountability to the software vendor Correct Answer: C. Delay or reject deployment until provenance, safeguards, and contestability are addressed Question 10What is the primary strategic value of an enterprise data and AI system register? A. It replaces the need for accountable owners B. It identifies systems, purposes, owners, risks, controls, and approval status for governance decisions C. It guarantees that every model is fair D. It prevents all unauthorized innovation Correct Answer: B. It identifies systems, purposes, owners, risks, controls, and approval status for governance decisions
|
