CASE STUDY
Please use the following answer the next question:
A local police department in the United States procured an Al system to monitor and analyze social media feeds, online marketplaces and other sources of public information to detect evidence of illegal activities (e.g., sale of drugs or stolen goods). The Al system works by surveilling the public sites in order to identify individuals that are likely to have committed a crime. It cross-references the individuals against data maintained by law enforcement and then assigns a percentage score of the likelihood of criminal activity based on certain factors like previous criminal history, location, time, race and gender.
The police department retained a third-party consultant assist in the procurement process, specifically to evaluate two finalists. Each of the vendors provided information about their system's accuracy rates, the diversity of their training data and how their system works. The consultant determined that the first vendor's system has a higher accuracy rate and based on this information, recommended this vendor to the police department.
The police department chose the first vendor and implemented its Al system. As part of the implementation, the department and consultant created a usage policy for the system, whichincludes training police officers on how the system works and how to incorporate it into their investigation process.
The police department has now been using the Al system for a year. An internal review has found that every time the system scored a likelihood of criminal activity at or above 90%, the police investigation subsequently confirmed that the individual had, in fact, committed a crime. Based on these results, the police department wants to forego investigations for cases where the Al system gives a score of at least 90% and proceed directly with an arrest.
What is the best reason the police department should continue to perform investigations even if the Al system scores an individual's likelihood of criminal activity at or above 90%?

• A. Because investigations may identify additional individuals involved in the crime.
• B. Because the department did not perform an impact assessment for this intended use.
• C. Because Al systems that affect fundamental civil rights should not be fully automated.
• D. Because investigations may uncover information relevant to sentencing.

CASE STUDY
Please use the following to answer the next question:
A small local flower delivery company operates a few stores and has a limited IT budget. To reduce the time spent on customer service, which is a major drain on employee time, the company plans to implement a simple but high-performance generative AI chatbot on its website. The chatbot will provide real-time, fact-based responses to customer inquiries and assist with order processing, helping to reduce incoming phone calls.
The company currently uses a single on-premises server for its order database and email system and has not yet partnered with a cloud provider.
An internal data privacy policy governs the use of customer dat
a. This policy, written before the adoption of AI, allows the use or transfer of customer data beyond name and contact information but requires that all such data be deleted after the order is completed. The company prefers to maintain this policy without changes.
MULTI-SELECT
Please select 3 of the 5 options below. No partial credit will be given.
Which of the following actions would necessitate a change to the company's privacy policy?

• A. The flower shop transfers customer data to the third-party API running the chatbot so that the chatbot service can work as intended during each user session.
• B. Using data from each customer session with the chatbot for purposes of retraining the underlying model but deleting that data after each customer order is completed.
• C. Programming the chatbot to request the customer's name, telephone number, and address for order deliveries and keeping that data until after delivery of the product has been confirmed.
• D. The chatbot stores inputs for use in Retrieval-Augmented Generation (RAG), but does not use those inputs for retraining the AI model.
• E. The chatbot deployed on the company's website also scans the customer's appearance during use for signs of frustration or confusion while using the website.

Retrieval-Augmented Generation (RAG) is defined as?

• A. Applying advanced filtering techniques to the LLMs.
• B. Reducing computational processing requirements of the LLMs.
• C. Combining LLMs with private knowledge bases to improve their outputs.
• D. Fine tuning LLMs to minimize biased outputs.

According to the GDPR, what is an effective control to prevent a determination based solely on automated decision-making?

• A. Provide a just-in-time notice about the automated decision-making logic.
• B. Provide a right to review automated decision.
• C. Establish a human-in-the-loop procedure.
• D. Define suitable measures to safeguard personal data.

Scenario:
A company is using different types of AI systems to enhance consumer engagement. These include chatbots, recommendation engines, and automated content generation tools.
Which of the following situations would beleast likelyto raise concerns under existing consumer protection laws?

• A. An online platform offering recommendations to its users by displaying user-specific content and targeted advertisements
• B. An AI tool using scraped digital content to generate news summaries on a publishing website
• C. An AI algorithm being used in a credit decision-making process by a financial institution
• D. An AI customer service system claiming that it is as accurate as a human support agent