AI0-001 AI Security, Ethics and Governance Practice Question
An organization deploys an AI system that processes personal data of EU citizens. Which regulatory framework imposes strict requirements on automated decision-making and profiling?
⚠ Common exam trap
The AI0-001 exam often tests candidates' ability to distinguish between data privacy regulations (GDPR) and industry-specific security standards (PCI DSS, HIPAA, SOX), trapping those who confuse data security with data protection governance for AI systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is the correct regulatory framework because it specifically governs the processing of personal data of EU citizens and imposes strict requirements on automated decision-making and profiling under Article 22. This article grants individuals the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects. The GDPR also mandates data protection impact assessments and transparency obligations for such AI-driven processing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Payment Card Industry Data Security Standard (PCI DSS)
Why it's wrong here
PCI DSS governs payment card data handling, imposing no requirements on automated decision-making or profiling of EU citizens. It is the right framework when storing, processing, or transmitting cardholder data. GDPR's Article 22 specifically addresses automated decisions and profiling.
- ✓
General Data Protection Regulation (GDPR)
Why this is correct
The GDPR governs processing of EU citizens' personal data and, under Article 22, restricts solely automated decisions and profiling that produce legal or similarly significant effects, demanding safeguards such as human intervention and the right to contest. That directly satisfies the stem's constraint of strict automated decision-making requirements.
- ✗
Health Insurance Portability and Accountability Act (HIPAA)
Why it's wrong here
HIPAA regulates protected health information held by US covered entities, not the personal data of EU citizens generally, and sets no profiling rules. It is correct for safeguarding medical records in American healthcare contexts. GDPR governs automated decision-making for EU data subjects.
- ✗
Sarbanes-Oxley Act (SOX)
Why it's wrong here
SOX pertains to financial disclosures.
About these practice questions
Courseiva writes every AI0-001 question from scratch — 962 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI0-001 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI0-001 exam.