15. Responsible AI Strategy, Leadership and Future DirectionsIntroduction: From Responsible Principles to Enterprise CapabilityResponsible artificial intelligence is often introduced through principles such as fairness, transparency, accountability, privacy, safety, and human autonomy. Principles, however, do not by themselves produce responsible outcomes. An organisation may publish an impressive ethics statement while deploying systems that are poorly documented, inadequately tested, or impossible to challenge. The strategic question is therefore not merely whether an organisation supports responsible AI, but whether it has the leadership, operating model, investment portfolio, controls, and organisational culture required to make responsibility part of ordinary business practice. Responsible AI strategy connects ethical commitments with enterprise decisions. It determines which AI opportunities should be pursued, which risks are acceptable, who is accountable for outcomes, how suppliers are assessed, what evidence must be produced before deployment, and how systems are monitored after release. It also recognises that responsibility is dynamic. A model may behave acceptably in a laboratory but become harmful when data distributions change, users adapt their behaviour, a vendor updates its model, or a new regulation changes the organisation’s obligations. For postgraduate professionals, the subject requires movement across several levels of analysis. At the technical level, responsible AI involves data quality, robustness, interpretability, security, evaluation, and monitoring. At the organisational level, it involves governance structures, roles, incentives, procurement, risk management, and change leadership. At the strategic level, it concerns business value, public trust, competitive positioning, digital transformation, sustainability, and the capacity to respond to emerging technologies such as autonomous agents and causal AI. Learning ObjectivesAfter studying this chapter, the reader should be able to: 1. Formulate an enterprise responsible-AI strategy aligned with business objectives and social obligations. 2. Explain responsible-AI maturity models and use them to identify capability gaps. 3. Construct a risk-balanced AI portfolio and design governance gates across the AI lifecycle. 4. Evaluate procurement, vendor-management, and accountability controls for third-party AI. 5. Explain the responsibilities of senior leaders, boards, technical teams, and business owners. 6. Assess how responsible AI creates business value and supports digital transformation. 7. Analyse emerging issues involving autonomous agents, causal AI, sustainability, and evolving regulation. 8. Apply strategic principles to a realistic organisational case. The Strategic Meaning of Responsible AIA responsible-AI strategy is a coordinated set of choices about the organisation’s AI ambitions, constraints, capabilities, controls, and accountability arrangements. It should not be reduced to a compliance checklist. Compliance is essential, but a strategy must also address whether an AI use case is desirable, whether it should be automated at all, and how its benefits and burdens are distributed. A useful strategic distinction is between value creation and value protection. Value creation includes improved forecasting, better service, scientific discovery, operational efficiency, accessibility, and new products. Value protection includes preventing discrimination, privacy loss, unsafe decisions, cyber compromise, regulatory penalties, reputational damage, and loss of public legitimacy. Mature organisations manage both forms of value rather than treating ethics as an obstacle to innovation. Responsible AI also requires attention to the decision context. The same technical model may be appropriate in one setting and unacceptable in another. A prediction used to prioritise routine maintenance is different from a prediction used to determine eligibility for housing, employment, credit, healthcare, or public benefits. The consequences of error, the possibility of human review, the affected population, and the reversibility of decisions must all influence governance intensity. Important Concepts and TerminologyAI system: A computational system that generates predictions, recommendations, content, or decisions from inputs, often with varying degrees of autonomy. Responsible AI: The design, development, deployment, and oversight of AI in ways that respect rights, safety, fairness, human agency, and legitimate organisational and social objectives. AI use-case portfolio: The collection of proposed, active, paused, and retired AI initiatives managed as an investment and risk portfolio. AI inventory or registry: A controlled record of AI systems, owners, purposes, data sources, models, suppliers, risks, and lifecycle status. Model card: A structured document describing a model’s intended uses, limitations, performance, evaluation conditions, and relevant risks. System card: Documentation covering the wider AI-enabled system, including users, interfaces, workflows, safeguards, and impacts beyond the model itself. Human oversight: Organisational and technical arrangements that enable people to understand, supervise, intervene in, or override an AI system. Residual risk: The risk remaining after controls and mitigations have been implemented. Materiality: The significance of a possible impact to people, the organisation, or society. Impact assessment: A structured examination of an AI system’s likely effects, affected groups, risks, controls, and justification. AI assurance: Evidence-based evaluation that an AI system meets specified requirements for performance, safety, security, fairness, privacy, and governance. Algorithmic incident: An event in which an AI system causes, contributes to, or creates a significant risk of harm, malfunction, or non-compliance. Foundation model: A broadly trained model that can be adapted or used for many downstream tasks. Autonomous agent: An AI-enabled system capable of planning and taking actions toward goals, often through tools, APIs, or external systems. Causal AI: Methods that represent or estimate cause-and-effect relationships rather than relying only on statistical association. AI literacy: The knowledge and practical competence needed to use, evaluate, govern, or challenge AI appropriately. Designing an Enterprise Responsible-AI StrategyStrategy begins with an explicit statement of purpose. The organisation should identify the outcomes it seeks from AI and the boundaries it will not cross. A purpose statement is stronger when it includes affected stakeholders, not only shareholders or internal users. For example, a financial institution might commit to improving access to suitable products while ensuring that automated decisions remain contestable and do not reproduce unjustified exclusion. The next step is to establish strategic principles that can guide choices. Principles should be translated into operational requirements. “Fairness” may require subgroup testing, justified feature selection, a process for challenging outcomes, and monitoring for disparate effects. “Transparency” may require user notices, explanations appropriate to the audience, documentation, and disclosure of the role played by automation. “Accountability” may require named system owners, approval records, audit trails, and escalation procedures. A practical strategy normally includes five linked elements: - a target vision and measurable outcomes;
- an inventory of AI systems and proposed use cases;
- a risk classification and governance model;
- capabilities, resources, and operating responsibilities; and
- assurance, monitoring, reporting, and improvement mechanisms.
From Use-Case Ideas to an AI PortfolioAI initiatives should be assessed as a portfolio rather than approved individually without regard to organisational capacity. Portfolio management allows leaders to balance high-value opportunities with foundational investments such as data quality, model monitoring, security, documentation, and staff training. A use-case assessment can consider expected benefit, feasibility, strategic alignment, affected stakeholders, reversibility, level of automation, and potential harm. High-impact use cases deserve stronger evidence and oversight even when their commercial return appears attractive. A portfolio may therefore contain four categories: low-risk productivity applications, operational decision-support tools, high-impact decision systems, and prohibited or strategically unsuitable applications. Portfolio decisions should also consider concentration risk. If many business units depend on the same external foundation model, cloud provider, dataset, or identity service, a single failure may affect the entire organisation. Similarly, rapid expansion of generative-AI pilots can create unmanaged exposure through confidential-data leakage, inaccurate outputs, copyright disputes, or inconsistent customer treatment. A Lifecycle Governance ModelResponsible governance is most effective when controls are placed throughout the lifecycle rather than concentrated at final approval. A typical lifecycle includes problem definition, data preparation, design, development, validation, deployment, operation, change, and retirement. During problem definition, the organisation should ask whether AI is necessary and whether the proposed objective is legitimate. During data preparation, teams should examine provenance, consent, quality, representativeness, security, and possible historical bias. During development, they should select appropriate performance measures and test robustness, privacy, security, and relevant subgroup outcomes. Validation should be independent enough to challenge the development team and should include realistic operational conditions. Deployment should include defined human roles, user training, communication to affected people, access controls, rollback procedures, and incident channels. Once operational, the system requires monitoring for drift, changing error patterns, misuse, unexpected feedback loops, and changes in the external environment. Material changes to data, model, purpose, or users should trigger renewed assessment. Retirement requires secure data handling, notification of stakeholders, preservation of records, and review of lessons learned. Governance gates should be proportionate. A low-risk internal summarisation tool does not require the same approval pathway as an automated system that influences medical treatment or employment. Proportionality reduces bureaucracy while preserving scrutiny where consequences are serious. Maturity Models and Organisational CapabilityA maturity model helps an organisation understand not only what controls exist, but whether they are repeatable, measured, integrated, and improved. Maturity should not be interpreted as a claim that an organisation is permanently “ethical.” It is a diagnostic device that reveals capability and remaining exposure. An illustrative five-level model is as follows: Level 1—Ad hoc: AI is developed through isolated projects. Ownership is unclear, documentation is inconsistent, and issues are handled after deployment. Level 2—Aware: Leaders recognise responsible-AI risks and issue basic policies. Some training, inventories, and review activities exist, but application varies substantially. Level 3—Defined: Standard lifecycle processes, risk tiers, documentation requirements, approval roles, and procurement controls are established across the organisation. Level 4—Measured: The organisation uses metrics, independent assurance, incident analysis, monitoring, and board-level reporting to evaluate control effectiveness. Level 5—Adaptive: Responsible AI is integrated into strategy, product design, incentives, enterprise risk management, and continuous learning. The organisation anticipates emerging risks and revises practices as evidence and regulation develop. Assessment should be capability-specific. An organisation may have mature privacy controls but weak model monitoring, or strong technical testing but poor user redress. A maturity score should therefore be accompanied by evidence, such as the percentage of systems inventoried, the proportion with named owners, completion of impact assessments, time to resolve incidents, coverage of subgroup testing, and the percentage of high-risk suppliers reviewed. Maturity models have limitations. They can encourage symbolic compliance, reward documentation rather than outcomes, and imply a linear progression where different capabilities develop unevenly. The most useful approach combines maturity assessment with outcome indicators and direct engagement with affected communities. Leadership, Accountability, and CultureResponsible AI is an executive responsibility because many of its most important decisions involve risk appetite, resource allocation, incentives, and organisational priorities. A board does not need to approve every model, but it should understand the organisation’s significant AI exposures, decision rights, major incidents, regulatory obligations, and readiness for systemic failures. Senior management should appoint accountable business owners for material systems. Technical teams are responsible for engineering quality and evidence, but they should not carry sole responsibility for decisions about social acceptability or business purpose. Legal, compliance, privacy, security, risk, procurement, human resources, and affected-domain specialists must contribute according to the use case. A three-lines arrangement can be useful. The first line consists of product and operational teams that own risks and operate controls. The second line consists of risk, compliance, privacy, security, and responsible-AI functions that set standards and challenge decisions. The third line consists of internal audit or an equivalent independent assurance function. Culture is shaped by incentives. If teams are rewarded only for launch speed and adoption, responsible practices will be experienced as delay. Performance objectives should recognise high-quality documentation, effective monitoring, responsible escalation, and the decision not to deploy an unsuitable system. Psychological safety is equally important: employees must be able to report concerns without retaliation. Board reporting should be concise but decision-relevant. It may include the number and risk distribution of systems, significant use cases awaiting approval, unresolved high-severity findings, incidents and near misses, supplier concentration, regulatory developments, control-testing results, and progress against strategic objectives. A list of policy documents is not an adequate board report. Procurement and Third-Party AI ControlsMany organisations do not build their own models; they buy applications, APIs, data, or cloud services. Procurement therefore becomes a central responsible-AI control. A contract should identify the intended use, data rights, security obligations, model-change notification, performance commitments, audit rights, incident notification, subcontractors, retention and deletion, intellectual-property responsibilities, and exit arrangements. Due diligence should examine more than vendor marketing. Buyers should request documentation about training-data governance where relevant, evaluation methods, known limitations, subgroup performance, service dependencies, human support, logging, access controls, and update practices. The organisation should determine whether vendor claims are independently verifiable and whether the service can support the organisation’s legal and ethical obligations. A supplier’s general certification does not automatically prove suitability for a specific deployment. Responsibility cannot be transferred merely because a system is externally hosted. The deploying organisation remains accountable for how the tool is configured, integrated, and used. Contracts should also address what happens when the vendor changes a model, withdraws a service, suffers a breach, or cannot explain a material failure. Business Value and Digital TransformationResponsible AI can create value directly and indirectly. Direct value may arise through safer automation, improved prediction quality, reduced rework, better user experience, and more reliable decisions. Indirect value comes from trust, employee adoption, regulatory readiness, improved data discipline, and reduced cost of incidents. Responsible AI should be integrated with digital transformation rather than treated as a separate approval layer. Transformation programmes often redesign processes, roles, data flows, and customer interfaces. If governance is added only after a system is built, it may be expensive or impossible to correct harmful design assumptions. Early involvement allows teams to choose less intrusive data, retain meaningful human control, and design explanations and appeals into the workflow. The business case should include total lifecycle cost. This includes data preparation, validation, monitoring, human review, user training, documentation, security, independent assurance, incident response, and retirement. A model with high predictive accuracy may be economically unattractive if it requires excessive manual review or creates unacceptable exposure. Conversely, a slightly less accurate model may create greater value if it is more robust, explainable, maintainable, and trusted. Practical Assurance and MeasurementResponsible-AI metrics should combine technical, operational, human, and business indicators. Technical measures may include accuracy by subgroup, calibration, robustness, privacy leakage, security test results, and drift. Operational measures may include review completion, override rates, incident response time, unresolved exceptions, and monitoring coverage. Human-centred measures may include complaint patterns, appeal outcomes, user comprehension, accessibility, and perceived legitimacy. Metrics require interpretation. A low override rate might indicate excellent performance, or it might indicate that users do not feel empowered to challenge the system. A high explanation-view rate might reflect useful transparency, or confusion caused by poor interface design. Quantitative indicators should therefore be supplemented with qualitative investigation and engagement with affected groups. Assurance activities may include internal testing, independent validation, red teaming, scenario analysis, external audits, penetration testing, bias assessment, privacy review, and post-deployment impact evaluation. No single test can establish that a system is responsible. Assurance is a body of evidence matched to the system’s risks and context. Illustrative Case Study: Northstar Benefits ServicesBackgroundNorthstar Benefits Services, a fictional regional organisation, administers employee benefit claims for several large employers. It proposes an AI system to classify incoming claims, identify missing information, and prioritise complex cases for specialist review. The organisation expects shorter processing times and lower administrative cost. Situation and ProblemA pilot shows promising average accuracy, but employee representatives report that claims involving chronic conditions and non-standard documentation are being referred more frequently for delay. The vendor’s model was trained on historical claims and will be updated periodically through a hosted service. Northstar has no complete AI inventory, no formal impact-assessment process, and no board reporting on algorithmic systems. AnalysisThe proposed system is not merely an administrative convenience. Prioritisation can affect the speed of access to benefits and may have unequal effects on people with complex or less typical medical circumstances. Historical data may encode past administrative practices rather than legitimate indicators of claim complexity. The external update process creates change-management and validation risks. Average accuracy is insufficient because the distribution of errors across groups and claim types matters. Strategy and SolutionNorthstar first assigns an accountable business owner and classifies the system as high-impact decision support. It narrows the purpose: the system may identify missing documents and recommend queues, but it may not deny claims or determine eligibility. Human specialists retain authority and must record reasons for overriding recommendations. The organisation conducts a data and impact assessment, including analysis by claim type, disability-related indicators where lawfully and appropriately handled, language, documentation format, and other relevant factors. It establishes minimum performance and subgroup-monitoring thresholds, tests the system on recent and deliberately difficult cases, and creates a route for claimants to request human review. The procurement agreement requires advance notice of model changes, documentation of updates, incident notification, audit cooperation, data deletion, access control, and an exit plan. Northstar establishes a registry entry, model and system documentation, user training, monitoring dashboards, and quarterly reporting to its risk committee. Any material vendor update triggers revalidation before production use. OutcomeThe revised system is deployed more slowly than originally planned, but it reduces document-related delays while preventing automated denial. Monitoring identifies a performance gap for claims submitted through a particular accessibility format, leading to a workflow correction. The organisation also discovers that some delays were caused by unclear forms rather than model performance, prompting a broader process redesign. Learning PointsThe case demonstrates that responsible AI strategy begins with problem definition, not model selection. It also shows why portfolio governance, procurement, human oversight, subgroup analysis, and monitoring must work together. Finally, responsible-AI investment can reveal non-AI process problems and produce value beyond the original automation objective. Emerging Strategic IssuesAutonomous AgentsAutonomous agents extend generative AI from producing responses to planning and taking actions. They may send messages, create transactions, modify records, call software tools, or coordinate workflows. Their risk is not limited to inaccurate text; it includes excessive permissions, goal misinterpretation, prompt injection, insecure tool use, cascading errors, and difficulty reconstructing why a sequence of actions occurred. Agent governance should apply least-privilege access, sandboxing, action limits, approval thresholds, reliable identity, transaction logging, separation of planning from execution, and emergency stop mechanisms. High-impact actions should require explicit human confirmation. Organisations should test agents against adversarial instructions and failure chains rather than evaluating only individual responses. Causal AIConventional predictive models estimate associations useful for forecasting, but interventions require causal reasoning. Causal AI can support questions such as whether a training programme would improve outcomes or whether a policy change caused an observed effect. Its strategic promise is substantial, yet causal conclusions depend on assumptions about confounding, measurement, intervention consistency, and the underlying causal structure. A causal diagram or sophisticated method does not eliminate the need for domain knowledge and sensitivity analysis. Governance should require explicit statements of the causal question, intervention, target population, assumptions, identification strategy, and uncertainty. Causal claims should not be used to justify high-impact interventions without examining alternative explanations and possible unintended effects. SustainabilityAI sustainability has at least two dimensions: the environmental cost of computing and the social sustainability of systems used in organisations. Energy and water use may arise during data preparation, training, inference, storage, and cooling. Strategic decisions should consider model size, frequency of use, hardware efficiency, workload scheduling, model reuse, and whether a smaller system is sufficient. Environmental reporting requires care because measurements depend on infrastructure, location, utilisation, and accounting boundaries. Sustainability should therefore be treated as a lifecycle consideration rather than a marketing label. Social sustainability includes worker conditions in data labelling, effects on employment and skills, accessibility, and the long-term maintainability of automated processes. Evolving Regulation and StandardsAI regulation is developing through legislation, sectoral rules, privacy and consumer-protection law, product safety requirements, employment law, procurement obligations, and professional standards. Organisations should avoid designing solely for one statute or jurisdiction. Instead, they should maintain a regulatory horizon-scanning process, map obligations to controls, document risk classifications, and monitor authoritative guidance. Regulatory compliance is necessary but not sufficient. A legally permitted use may still be socially harmful, technically fragile, or inconsistent with organisational commitments. Conversely, strong governance practices can help organisations adapt when legal requirements change. The strategic objective is regulatory resilience: the ability to identify, interpret, implement, evidence, and revise controls as obligations evolve. Challenges and Common Strategic MistakesSeveral mistakes recur in responsible-AI programmes. First, organisations publish principles without assigning decision rights or resources. Second, they focus on model-level fairness while ignoring harmful objectives, exclusionary workflows, or unequal access to appeal. Third, they perform assessments once and treat them as permanent, despite changing data and models. Fourth, they rely on vendor assurances without testing the system in their own context. Fifth, they measure activity—such as training completion—rather than outcomes. Other challenges include fragmented ownership, shortage of specialised skills, tension between innovation speed and review, weak data provenance, uncertain causal evidence, and difficulty engaging people affected by AI decisions. Small organisations may lack dedicated responsible-AI teams, while large organisations may create committees that cannot make decisions. Proportional, risk-based governance is more useful than either complete informality or indiscriminate bureaucracy. Best-Practice Principles for Strategic ActionA durable responsible-AI programme should: 1. Begin with legitimate purposes and consider non-AI alternatives. 2. Maintain a reliable inventory with named owners and lifecycle status. 3. Use proportionate risk tiers and approval gates. 4. Integrate privacy, security, safety, fairness, accessibility, and human-rights analysis. 5. Require evidence that is appropriate to the system’s impact and context. 6. Make procurement and supplier change management part of governance. 7. Preserve meaningful human oversight, explanation, contestability, and redress. 8. Monitor systems after deployment and learn from incidents and near misses. 9. Align incentives, training, and leadership reporting with responsible outcomes. 10. Review strategy regularly in light of technical, social, environmental, and regulatory change. Chapter SummaryResponsible AI strategy converts ethical principles into enterprise capabilities, decisions, and evidence. It links business value with value protection and requires attention to purpose, context, affected stakeholders, and the full AI lifecycle. A balanced portfolio, risk-based governance gates, inventories, impact assessments, monitoring, and assurance provide the operational foundation. Leadership is shared but must be accountable. Boards oversee material exposure and strategic readiness; executives allocate resources and set incentives; business owners own outcomes; technical, legal, privacy, security, procurement, and assurance functions provide specialised challenge. Maturity models can reveal capability gaps, provided they are used diagnostically rather than as symbolic rankings. Procurement controls are essential because third-party AI does not remove organisational responsibility. Emerging autonomous agents require stronger control over permissions and actions, causal AI requires explicit assumptions and domain scrutiny, and sustainability requires lifecycle analysis. As regulation evolves, organisations need adaptable governance rather than narrow compliance. The central strategic lesson is that responsible AI is not a final review step: it is a continuing organisational capability that shapes which systems are built, how they are used, and whether their benefits are legitimate and durable. Key TermsResponsible AI: The responsible design, use, and oversight of AI in accordance with ethical, legal, social, and organisational requirements. AI strategy: A coordinated plan linking AI objectives, investments, capabilities, risks, and governance. AI portfolio: The set of AI initiatives managed collectively as investments and sources of risk. Risk tier: A classification used to determine the intensity of governance and assurance required. AI inventory: A maintained record of organisational AI systems, owners, purposes, data, suppliers, and status. Impact assessment: A structured analysis of an AI system’s potential effects, affected groups, and controls. AI assurance: Evidence-based evaluation of whether an AI system satisfies specified requirements. Residual risk: Risk remaining after safeguards have been applied. Human oversight: The capacity of authorised people to supervise, understand, intervene in, or override AI behaviour. Maturity model: A framework for assessing the development and institutionalisation of organisational capabilities. Model card: Documentation describing a model’s uses, performance, limitations, and evaluation conditions. System card: Documentation describing the wider AI system, workflow, users, controls, and impacts. Autonomous agent: An AI system that can plan and execute actions toward specified goals. Causal AI: AI methods intended to estimate or reason about cause-and-effect relationships. Regulatory resilience: The capability to adapt governance and controls as legal obligations evolve. AI literacy: The knowledge and skills required to use, evaluate, develop, or govern AI responsibly. Residual risk: Exposure that remains after planned controls and mitigations. Portfolio concentration risk: Exposure created by dependence on a common model, supplier, platform, or data source. Review QuestionsShort Answer Questions1. Why is a responsible-AI strategy broader than an ethics policy? 2. What is the purpose of an AI inventory? 3. Explain the difference between value creation and value protection. 4. Why should vendor model updates trigger governance review? 5. What does residual risk mean in an AI system? Long Answer Questions1. Explain how responsible-AI governance can be integrated across the AI lifecycle. 2. Describe the five levels of the illustrative responsible-AI maturity model and discuss its limitations. 3. Analyse the responsibilities of boards, executives, business owners, technical teams, and assurance functions. 4. Discuss procurement controls required when an organisation uses third-party AI services. 5. Explain how responsible AI can contribute to digital transformation and long-term business value. Analytical / Application Questions1. An organisation proposes an AI tool to prioritise job applicants. Design a risk-based governance process covering purpose, data, testing, human oversight, monitoring, and redress. 2. A foundation-model supplier announces a major model update with little advance notice. Analyse the organisational risks and recommend procurement and operational responses. 3. A customer-service autonomous agent can issue refunds and alter account records. Construct a control architecture that balances efficiency with safety, accountability, and customer protection. 22. Multiple Choice Questions with AnswersQuestion 1Which statement best captures the strategic meaning of responsible AI? A. It is a communications programme used to improve public perception. B. It is a coordinated approach linking AI value, risk, capabilities, controls, and accountability. C. It is a technical procedure for maximising model accuracy. D. It is a legal review performed after a system is deployed. Correct Answer: B. It is a coordinated approach linking AI value, risk, capabilities, controls, and accountability. Question 2Why should an organisation manage AI initiatives as a portfolio? A. To ensure every project uses the same model. B. To eliminate the need for project-level testing. C. To balance benefits, risks, shared dependencies, and foundational investments. D. To prioritise only projects with immediate financial returns. Correct Answer: C. To balance benefits, risks, shared dependencies, and foundational investments. Question 3Which activity belongs most directly to the problem-definition stage of AI governance? A. Asking whether AI is necessary and whether the objective is legitimate. B. Deleting all records when the system is retired. C. Measuring production drift after deployment. D. Testing the vendor’s incident-notification process. Correct Answer: A. Asking whether AI is necessary and whether the objective is legitimate. Question 4An organisation has policies and training but inconsistent implementation across departments. Which maturity level best describes it? A. Ad hoc B. Aware C. Measured D. Adaptive Correct Answer: B. Aware Question 5Which procurement requirement is most important when a vendor frequently updates a hosted AI model? A. A requirement that the vendor use the organisation’s preferred programming language. B. Advance notice, documentation, and revalidation rights for material changes. C. A guarantee that the model will never make an error. D. Permission for the vendor to reuse all customer data without restriction. Correct Answer: B. Advance notice, documentation, and revalidation rights for material changes. Question 6Why does a low override rate not necessarily demonstrate that an AI system is performing well? A. Overrides are always evidence of model failure. B. Users may lack authority, confidence, or opportunity to challenge the system. C. Low override rates prove that the model is biased. D. Override rates are unrelated to human oversight. Correct Answer: B. Users may lack authority, confidence, or opportunity to challenge the system. Question 7Which control is especially relevant to an autonomous agent that can issue refunds? A. Removing transaction logs to protect privacy. B. Allowing unrestricted permissions to maximise efficiency. C. Using approval thresholds, least privilege, logging, and emergency stopping. D. Evaluating only the fluency of the agent’s language. Correct Answer: C. Using approval thresholds, least privilege, logging, and emergency stopping. Question 8What distinguishes causal AI from ordinary predictive modelling? A. Causal AI never uses statistical data. B. Causal AI seeks to represent or estimate cause-and-effect relationships. C. Causal AI guarantees that interventions will succeed. D. Causal AI requires no domain assumptions. Correct Answer: B. Causal AI seeks to represent or estimate cause-and-effect relationships. Question 9Which is an example of portfolio concentration risk? A. Different teams use different documentation templates. B. Several critical systems depend on the same external foundation model and provider. C. A model is tested on multiple demographic groups. D. A low-risk tool is retired after a review. Correct Answer: B. Several critical systems depend on the same external foundation model and provider. Question 10What is the central lesson of the Northstar case? A. Average accuracy is sufficient for high-impact deployment. B. External vendors assume all responsibility for deployment outcomes. C. Responsible AI requires purpose limitation, human oversight, monitoring, procurement controls, and process analysis. D. AI should never be used in benefits administration. Correct Answer: C. Responsible AI requires purpose limitation, human oversight, monitoring, procurement controls, and process analysis.
|
