An organization integrates multiple AI services using APIs to enhance a customer support chatbot. Which of the following is the GREATEST risk?

API integration with external AI services creates data transmission pathways between the

organization and external systems. Customer support contexts involve sensitive personal data—

account information, contact details, inquiry content—that may be transmitted through these API

connections.

Why B is Correct: The ISACA AAIR security and privacy guidance identifies unauthorized disclosure of

sensitive data through insecure API connections as the greatest risk in multi-service AI integration.

APIs can be vulnerable to interception, inadequate authentication, or misconfiguration. In a

customer support context, exposure of personal data via API vulnerabilities creates privacy

violations, regulatory liability, and reputational harm—all more severe than the other listed

concerns.

Why A is Wrong: Bias and inaccuracy in chatbot responses are real quality risks but represent service

quality issues rather than security or privacy breaches. Inaccurate responses are visible and

correctable; data breaches may go undetected.

Why C is Wrong: Customer dissatisfaction from operational delays is a service quality and business

risk. It is a manageable consequence of performance issues rather than the greatest risk from API-

based AI integration.

Why D is Wrong: Insufficient training datasets affect model quality but are a development concern

addressed during the model selection phase. They do not represent the primary operational risk of

deploying multi-service API integrations in production.