312-41 practice question 35 of 35

Vertex Insurance based in Munich, uses an automated system to calculate life insurance premiums. Their legal team has already completed a Data…

Choose your answer, then check it against the explanation.

Vertex Insurance based in Munich, uses an automated system to calculate life insurance premiums. Their legal team has already completed a Data Protection Impact Assessment (DPIA) and verified that all applicant data is processed with explicit consent and strict purpose limitation. However, a regulatory audit halts the deployment. The auditor is not interested in the data inputs or user consent. Instead, they flag a violation regarding the engineering lifecycle. Specifically, Vertex failed to implement a post-market monitoring system to continuously log and analyze whether the model's error rates or bias metrics drift over time after the initial release. The auditor cites a lack of a Quality Management System (QMS) for the software itself. Which regulatory framework requires ongoing post-deployment monitoring and a formal quality management system for AI models, beyond initial data protection compliance?

Answer options

Correct Answer:

Explanation

The General Data Protection Regulation (GDPR) focuses on data privacy and protection, while the EU AI Act (EUAI) specifically targets the safety and quality of AI systems themselves. The auditor's requirements for a post-market monitoring system to track model performance drift and a formal Quality Management System (QMS) are explicit obligations for providers of high-risk AI systems under the EU AI Act. Insurance premium calculation is classified as a high-risk application, making these lifecycle and quality assurance requirements mandatory under this regulation, extending beyond GDPR's data-centric focus.

Why Incorrect

A. GDPR: Focuses on personal data protection, consent, and rights of data subjects, but does not explicitly mandate a post-deployment QMS or model monitoring system for the AI software lifecycle.

B. HIPAA: This is a US law concerning the privacy and security of protected health information (PHI) and is not the relevant framework for a German insurance company's AI quality system.

D. CCPA: This is a California-specific consumer privacy law focused on data rights and does not impose requirements for an AI-specific Quality Management System or post-market monitoring.

References

1. European Commission. (2021, April 21). Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act). COM(2021) 206 final.

Article 17 ("Quality management system") mandates that "providers of high-risk AI systems shall put a quality management system in place."

Article 61 ("Post-market monitoring by providers") requires providers to "establish and document a post-market monitoring system in a manner that is proportionate to the nature of the artificial intelligence technologies and the risks of the high-risk AI system."

2. Veale, M., & Borgesius, F. Z. (2021). Demystifying the Draft EU Artificial Intelligence Act. Computer Law Review International, 22(4). https://doi.org/10.9785/cri-2021-220402. The paper analyzes the Act, noting its focus on "conformity assessment, quality management, and post-market monitoring" for high-risk systems, distinguishing it from prior data protection law.

3. Hacker, P. (2021). A Legal Framework for AI. Regulating Artificial Intelligence: The European Approach and the AI Act. European Parliament. This policy paper discusses the AI Act's requirements, including the QMS and post-market monitoring, as central pillars of its risk-based approach.

Question 35 of 35

Keep practicing

Take the free 312-41 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test