Meridian Regional Airlines completed a legal review of data-privacy obligations for its European codeshare routes when the demand-forecasting project launched two years ago. Since then, EU data-privacy rules affecting AI systems have continued to evolve. The AI project manager is deciding how to handle this going forward. What is the appropriate practice?

The correct answer is to establish an ongoing process for monitoring AI-relevant data-privacy laws and regulations, treating regulatory awareness as a continuing project responsibility rather than a one-time gate passed at launch. Monitoring AI-relevant data privacy laws and regulations is a named Trustworthy AI task precisely because the regulatory landscape around AI and data privacy, especially in the EU, continues to change well after a project ships, and a review completed two years ago cannot reflect rules that did not yet exist. Relying on the original review indefinitely mistakes 'accurate at the time' for 'accurate now,' and treats a point-in-time legal assessment as a permanent guarantee, which invites exactly the kind of compliance gap that ongoing monitoring is meant to prevent. Waiting for a formal passenger complaint before revisiting compliance is reactive rather than proactive, and by the time a complaint arrives, the airline may already be out of compliance with rules it never tracked — the harm and the regulatory exposure both precede the trigger. Discontinuing use of European codeshare data entirely is a drastic overreaction that discards legitimate, valuable data on the assumption that ongoing compliance is impossible, when in practice an active monitoring process is the standard, manageable way organizations keep pace with evolving privacy law without abandoning the underlying capability.