Question 120
A team requests an AI supplier's proprietary data models without confirming its ability to handle personal information. The team has identified a response and must obtain a justified decision before moving forward. What governance decision should leadership make before the next commitment?
Explanation
Correct Answer
This decision respects the accountable project authority and the scenario’s remaining exposure: Hold award until privacy risks and contractual protections are accepted by the authorized owners. The response being governed is Require privacy/security due diligence, permitted-use terms, and verified data-handling controls before award. and the completion measure is Contractual controls and test evidence show compliant access, retention, and deletion of personal data.
Incorrect Answers
Route noncompliant bids through documented evaluation rather than informal price-only preference. That safeguard does not address the specific risk here: a polished prototype does not prove lawful use of confidential project information. The relevant follow-up is: Hold award until privacy risks and contractual protections are accepted by the authorized owners.
Seek a risk-owner go/no-go decision before production if disparity remains outside approved tolerances. That safeguard does not address the specific risk here: a polished prototype does not prove lawful use of confidential project information. The relevant follow-up is: Hold award until privacy risks and contractual protections are accepted by the authorized owners.
Require the asset owner to accept open obligations before project resource release. That safeguard does not address the specific risk here: a polished prototype does not prove lawful use of confidential project information. The relevant follow-up is: Hold award until privacy risks and contractual protections are accepted by the authorized owners.