AI GRC Consultant

Sample question 1

Your company's internal AI usage policy requires that every prompt sent to a generative AI tool be logged in full and retained indefinitely for security audit purposes. Legal now flags that this requirement conflicts with the data minimization and storage-limitation obligations under the privacy regulation that applies to the company's customer data, because a meaningful share of employee prompts include customer personal information. You are asked to resolve the conflict between the internal policy and the applicable regulation before the retention rule is enforced company-wide. Which resolution is most defensible?

1. A.Continue full indefinite prompt logging as the internal policy specifies, since the policy was approved by the CISO and an internal, board-approved policy takes precedence over an external regulation whenever the two conflict, and note that the security team has relied on this same internal authority to justify similar data-handling decisions in the past without incident.
2. B.Revise the retention rule so prompts are logged in full only for the period necessary to support a security investigation, then delete or de-identify the personal information they contain, aligning the audit trail the security team needs with the regulation's data minimization and storage-limitation requirements, and document the revised rule as an update to the internal policy.
3. C.Stop logging prompts entirely to remove the retention conflict, and rely on the AI vendor's own logs if a security investigation is ever needed, since removing the company's internal logging removes the compliance question, and note in the policy that any future investigation will depend on the vendor's willingness and ability to produce records on request.
4. D.Escalate the conflict to executive leadership and pause the AI tool's use company-wide until a new policy is drafted through the standard governance committee review cycle, which typically takes two to three quarters to complete, during which time the teams that rely on the tool will need to revert to their prior manual process.

Sample question 2

An AI GRC Consultant advises a client whose contracted vendor operates the client's AI customer-support chatbot logging pipeline. A misconfigured cloud storage bucket exposed roughly 40,000 EU and US customers' chat transcripts, including account numbers, for 11 days before discovery. The vendor, acting as processor, notifies the client, the controller, of the exposure at 9 a.m. Wednesday. The client's general counsel asks when the GDPR 72-hour supervisory-authority notification clock starts, and what obligation applied to the vendor before that notice. What is the correct answer?

1. A.The 72-hour clock started the moment the vendor first discovered the exposed bucket internally, not when the client was formally informed on Wednesday, so the client is very likely already past its GDPR notification deadline by the time it even learns that a breach occurred.
2. B.The vendor, as processor, was required to notify the client without undue delay after the vendor itself became aware of the breach; the client's 72-hour clock to notify its supervisory authority runs from when the client became aware, which here is 9 a.m. Wednesday, not from when the vendor first found the exposure.
3. C.Because the vendor is only a data processor rather than a controller, GDPR notification obligations do not apply to the vendor at all in this relationship, and the client's 72-hour clock only starts once the client's own security team independently confirms the exposure through its own investigation, regardless of the vendor's notice.
4. D.Because the exposure includes both EU and US customers in a single incident, a single US federal breach-notification law preempts GDPR for the entire matter, and the controlling deadline becomes the 30-day window commonly used by most US state breach-notification statutes.

Sample question 3

An AI GRC consultant supports a US-based HR technology vendor whose AI tool screens job applicants via resume and video-interview analysis. A German bank client wants to use the tool for EU-based roles, with applicant data hosted on US servers. The client's legal team argues that because the vendor's servers sit in the US, GDPR does not apply to this processing. The consultant must correct this understanding before the engagement proceeds. Which explanation is accurate?

1. A.GDPR territorial scope is tied to where a company's servers are physically hosted, so moving the applicant data to US-based infrastructure takes this processing outside GDPR's reach.
2. B.The contract between the vendor and the bank specifies US law as governing, and that contractual choice of law determines whether GDPR requirements attach to this processing.
3. C.GDPR applies because the bank is established in the EU, so processing its EU applicants' data is governed by GDPR wherever it occurs; hosting the data on US servers raises cross-border transfer requirements rather than removing that obligation.
4. D.As a processor rather than a controller, the vendor has no independent compliance duties under GDPR; the bank's status as controller absorbs any GDPR obligations that might otherwise apply here.