AI Governance, Risk, and Compliance

SecAI+ · 38 questions

• The city stands up an AI Center of Excellence to coordinate pilots across public-health, permits, and 311. What governance structure is this?
• City council adopts an AI acceptable-use policy covering public chatbots and staff copilots. What governance artifact is this?
• Under CoE standards, a data scientist prepares labeled datasets for the housing-authority fraud model. Which role responsibility is illustrated?
• An AI architect designs the reference pattern for department RAG assistants on the city’s cloud. What role is primarily demonstrated?
• An ML engineer owns training pipelines for the city’s traffic-signal optimization model. How does this role differ from security or governance roles?
• Platform and MLOps engineers harden shared model hosting used by multiple city agencies. Which governance role focus is this?
• An AI security architect must review threat models before any municipal chatbot goes public. What accountability does this role provide?
• An AI governance engineer maintains model cards and approval workflows in the city’s model registry. What does this role support?
• Before go/no-go, an AI risk analyst scores residual risk for a police-department NLP pilot. Which function is this?
• An AI auditor samples production prompts quarterly for policy compliance in the clerk’s office assistants. What assurance activity is this?
• A data engineer builds lineage-tracked ETL into the vector store powering the clerk RAG assistant. Which role contribution is shown?
• Procedure requires AI security architect sign-off plus CoE intake before any production AI spend. What governance practice is this?
• A benefits chatbot is reviewed for fair treatment across language and zip-code groups before wider release. Which responsible-AI principle is primary?
• An emergency chatbot’s replies must clear reliability and safety bars before hurricane season. Which responsible-AI principle is primary?
• Residents demand transparent notices when AI assists parking-citation reviews. Which responsible-AI expectation does this reflect?
• A library AI tutor must uphold privacy and security commitments in children’s programs. Which responsible-AI pillar is primary?
• Policy assigns accountability owners and requires consistent AI behavior across district kiosks. Which responsible-AI cluster is this?
• All municipal staff complete shadow-AI awareness training before using any generative tools. What control does this represent?
• Historical policing data risks introducing bias into a municipal deployment-priority model. Which AI risk is primary?
• Staff paste confidential council memos into a public LLM, risking accidental leakage. Which AI risk is illustrated?
• A hallucinated public-health answer causes media scrutiny of the city’s chatbot. Which AI risk is primary?
• A vendor model’s license creates IP risk for redistributing generated city code snippets. Which risk cluster is in play?
• A semi-autonomous drone inspection program raises accountability questions after a near miss. Which AI risk focus applies?
• Departments run unsanctioned ChatGPT plugins on case data — classic shadow AI. What organizational risk does this describe?
• The AI CoE green-lights a pilot only after fairness, privacy, and accountability checks pass. What practice is this?
• A city with EU-resident services maps a high-risk AI use case to EU AI Act obligations. Which compliance impact is this?
• Policy writers cite OECD AI principles when updating the city’s AI ethics charter. Which standards influence is this?
• Procurement asks vendors whether offerings align to relevant ISO AI management standards. Which compliance practice is this?
• Risk teams structure AI controls using NIST AI RMF functions for a courts chatbot. Which framework application is this?
• Only sanctioned AI tools may process resident PII; unsanctioned tools are blocked. Which corporate AI policy is this?
• Sensitive casework must use private or hosted models, not public consumer LLM endpoints. Which policy distinction is this?
• Sensitive-data governance forbids feeding CJIS-regulated content into unapproved AI. Which compliance intersection is this?
• Before buying a vendor SOC AI, the city runs a third-party compliance evaluation. Which practice is this?
• Residency rules require vector stores for resident PII to remain in-country or in-region. Which constraint is this?
• GRC maps NIST AI RMF controls to local policy and notes EU AI Act triggers for a grant-funded tool. Which compliance practice is this?
• Developers delay a facial-analytics pilot after compliance flags a high-risk classification. How does compliance affect development?
• Marketing cannot use generative ads with resident photos until consent and compliance review clear. Which impact is this?
• Auditors request model cards, sanctioned-tool lists, and sovereignty attestations for city AI systems. What are these?