Ethical AI Practices & Data Governance Flashcards

When applying the EU AI Act's risk classification, an AI system used to evaluate job applicants' suitability would be classified as:

Answer: High risk — requiring conformity assessment

The EU AI Act Annex III classifies AI used in employment, worker management, and access to self-employment as high-risk, requiring conformity assessments and quality management systems.

A data scientist discovers their training dataset contains records collected without proper consent. The MOST appropriate immediate action under ethical AI practices is:

Answer: Retrain using only consented data and document the issue

Ethical data governance requires that only lawfully and consensually obtained data be used for training; the organization must remediate the consent gap and document findings.

Equalized odds as a fairness criterion requires that a classifier satisfies:

Answer: Equal true positive and false positive rates across groups

Equalized odds, defined by Hardt et al., requires both equal true positive rates (TPR) and equal false positive rates (FPR) across protected groups simultaneously.

A company's data retention policy specifies that personal data collected for marketing must be deleted after 24 months. This policy reflects which data governance principle?

Answer: Storage limitation

Storage limitation (GDPR Article 5(1)(e)) requires that personal data not be kept longer than necessary for the specified processing purpose.

Which attack exploits a trained ML model by querying it repeatedly to reconstruct training data, potentially exposing private individuals' records?

Answer: Model inversion attack

Model inversion attacks use repeated queries and the model's outputs to reconstruct sensitive features or even raw training samples, threatening data privacy.

A Chief Data Officer (CDO) establishes a data lineage tracking system across all ML pipelines. The PRIMARY governance benefit of this is:

Answer: Enabling auditors to trace data origin, transformations, and usage for compliance

Data lineage systems enable full traceability of how data flows from source to model, which is essential for regulatory audits, incident investigations, and governance accountability.

In federated learning, which privacy concern is MOST directly mitigated compared to centralized training?

Answer: Raw training data never leaving local devices

Federated learning's core privacy property is that raw data remains on-device; only model updates (gradients or weights) are shared with the central aggregator.