Meridian Regional Airlines' loyalty-fraud model was trained to flag suspicious mileage-redemption patterns. In production, it disproportionately freezes the accounts of infrequent flyers who redeem miles to book trips for family members, while rarely flagging the redemption behavior of frequent business travelers. No malicious actor is involved and no data was mishandled. Which Trustworthy AI concern does this scenario primarily illustrate?

The correct answer identifies this as an unintended consequence of the AI system. The model was never instructed to penalize infrequent flyers, yet its learned pattern produces exactly that outcome — a foreseeable-in-hindsight but unplanned harm to a legitimate customer segment. Identifying and mitigating unintended consequences before and after deployment is a core Trustworthy AI task, not a data-governance or security task. The GDPR option is a trap: GDPR concerns consent, lawful basis, and data-subject rights, none of which are implicated here — no unlawful processing occurred, only a biased outcome. The adversarial-attack option is also a trap: adversarial attacks describe a deliberate, malicious actor crafting inputs to fool a model, and the stem explicitly rules that out ('no malicious actor is involved'). The data-lineage option confuses a governance discipline (tracking where data came from and how it moved) with a fairness discipline (how the model treats different populations); lineage failures are traceability problems, not behavioral-bias problems. The PM's obligation here is to treat this as a project risk: investigate the root cause in training data or features, and add human review before any account is restricted, rather than shipping and hoping the pattern self-corrects.