An organization seeks to implement a new AI system that uses customer information to create targeted product recommendations. Which of the following is the MOST important consideration to ensure the system complies with regulatory requirements?

Privacy and data protection regulations worldwide—including GDPR, CCPA, and sector-specific laws—impose strict requirements on the collection, use, and processing of personal information. Customer data used for AI systems must be obtained through lawful means with appropriate consent for the specific processing purpose. Why A is Correct: According to ISACA AAIR guidance on regulatory compliance, the legal basis for processing personal data is the foundational requirement. An AI system built on data collected without proper consent or legal authorization exposes the organization to regulatory penalties, reputational damage, and forced shutdown of the system. Consent must be specific to the AI use case, not merely generic data collection consent. Why B is Wrong: Backup and storage protocols address data security and resilience, which are compliance requirements but secondary to the lawfulness of data collection. Securely storing improperly obtained data does not cure the regulatory violation. Why C is Wrong: Human review of recommendations is a governance safeguard for accuracy and fairness, not a regulatory compliance requirement for data collection. Many regulations do not require human review of recommendation systems. Why D is Wrong: Supervised learning is a modeling technique that does not address regulatory compliance regarding data sourcing. The training methodology is irrelevant to whether the underlying data was legally obtained.