CCAR-P Governance, Safety, and Risk Management Practice Question
A multinational corporation is using Claude to process employee feedback surveys. The data includes sensitive personal opinions. The governance team must ensure that the AI system complies with the EU's General Data Protection Regulation (GDPR). Which control is most critical to address the 'right to explanation' requirement for automated decision-making?
⚠ Common exam trap
Test-takers frequently confuse other GDPR principles like consent or data residency with the right to explanation, which specifically demands transparency of automated decision logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a mechanism to provide a human-readable explanation of how the AI arrived at its conclusions for each individual.
The right to explanation under GDPR requires that individuals receive meaningful information about the logic of automated decisions. Implementing a mechanism to generate human-readable explanations for each individual directly fulfills this. Other controls like anonymization, consent, or data residency address different aspects of GDPR but not the specific transparency requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Obtain explicit consent from all employees before processing their feedback with AI.
Why it's wrong here
Consent is one legal basis for processing, but it does not fulfill the right to explanation. Even with consent, individuals retain the right to meaningful information about automated decision-making. This control addresses lawfulness of processing, not transparency of the logic, so it is not the most critical for the stated requirement.
- ✓
Implement a mechanism to provide a human-readable explanation of how the AI arrived at its conclusions for each individual.
Why this is correct
GDPR's right to explanation requires that individuals can obtain meaningful information about the logic involved in automated decisions. Providing a human-readable explanation for each individual directly satisfies this requirement. This control ensures transparency and accountability, which are core to GDPR compliance for automated processing.
- ✗
Anonymize all employee feedback before processing to remove personal identifiers.
Why it's wrong here
Anonymization can reduce privacy risks but does not address the right to explanation, which applies to automated decisions affecting individuals. If data is truly anonymized, GDPR may not apply, but the scenario implies processing personal opinions, so anonymization might not be feasible or sufficient. It does not provide the required explanation.
- ✗
Store all data within the EU to comply with data residency requirements.
Why it's wrong here
Data residency is about where data is stored, not about explaining automated decisions. While important for GDPR, it does not satisfy the right to explanation. The governance team specifically needs to address the transparency of the AI's decision-making process, which data localization does not provide.
About these practice questions
One of 262 original CCAR-P practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Anthropic exam blueprint
This CCAR-P practice question is part of Courseiva's free Anthropic certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCAR-P exam.