An organization seeks to implement a new AI system that uses customer information to create targeted product recommendations. Which of the following…

Privacy and data protection regulations worldwide—including GDPR, CCPA, and sector-specific

laws—impose strict requirements on the collection, use, and processing of personal information.

Customer data used for AI systems must be obtained through lawful means with appropriate consent

for the specific processing purpose.

Why A is Correct: According to ISACA AAIR guidance on regulatory compliance, the legal basis for

processing personal data is the foundational requirement. An AI system built on data collected

without proper consent or legal authorization exposes the organization to regulatory penalties,

reputational damage, and forced shutdown of the system. Consent must be specific to the AI use

case, not merely generic data collection consent.

Why B is Wrong: Backup and storage protocols address data security and resilience, which are

compliance requirements but secondary to the lawfulness of data collection. Securely storing

improperly obtained data does not cure the regulatory violation.

Why C is Wrong: Human review of recommendations is a governance safeguard for accuracy and

fairness, not a regulatory compliance requirement for data collection. Many regulations do not

require human review of recommendation systems.

Why D is Wrong: Supervised learning is a modeling technique that does not address regulatory

compliance regarding data sourcing. The training methodology is irrelevant to whether the

underlying data was legally obtained.