Risk, Ethics, and Regulatory Compliance
Risk, Ethics, and Regulatory Compliance
This domain tests proportionate AI risk management: impact assessment, bias and fairness, transparency, privacy, security, human oversight, and regulatory mapping. Expect questions on risk tiers, documentation, and third-party models.
Core rules and concepts
- Use a risk taxonomy: harm to people, legal or regulatory, financial, operational, reputational, and security. Rate likelihood and severity, then apply controls proportionate to risk.
- Common reference models include the NIST AI Risk Management Framework (Govern, Map, Measure, Manage), ISO/IEC 42001 for AI management systems, and the EU AI Act risk tiers (unacceptable, high-risk, limited-risk transparency, minimal-risk). Know the tier logic, not just labels.
- Ethics controls: bias testing on relevant subgroups, explainability for affected users, consent and privacy impact assessment, human review for consequential decisions, and appeal paths.
- Documentation: model cards, data sheets, risk assessments, test evidence, and audit logs. Third-party models need due diligence and contractual controls.
- Compliance is continuous: monitor regulatory change and re-assess when use, data, or model changes.
Worked example
An HR screening tool ranks candidates. It is likely high-risk because it affects access to employment. The team completes a DPIA, tests adverse impact by gender and age, documents job-related validation, adds human review before rejection, and provides candidate notice. It also sets a monitoring metric for selection-rate disparity. Reasoning: the controls follow from the harm and legal context, not from the model's accuracy alone.
Traps
Treating ethics as PR; one-time compliance sign-off; ignoring third-party or foundation-model risk; no named accountability; and assuming explainability equals fairness.