Key privacy compliance consideration regarding privacy in AI?

• A. Privacy must be guaranteed, requiring internal policy review and a Privacy Impact Assessment before production use
• B. Privacy can be ignored if model performance is high
• C. Privacy is only checked after deployment
• D. Privacy is irrelevant for AI in production

Answer: (A)

Prior to putting an AI system into production, privacy must be planned and governed through a formal Privacy Impact Assessment and an internal policy review. This upfront step identifies how data is collected, stored, used, and shared, and evaluates risks to individuals’ privacy. It covers data minimization, purpose limitation, retention, consent where required, and the rights of data subjects, then translates those findings into concrete controls—such as access restrictions, data minimization, robust logging, and, where appropriate, techniques like anonymization or differential privacy. Conducting this assessment early ensures regulatory compliance, accountability, and transparency, and helps prevent privacy incidents that could arise from model training data, memorization, or inferences later on.

Delaying privacy considerations until after deployment or treating privacy as optional would miss these risks and can lead to violations, costly remediation, or loss of trust. High model performance does not negate privacy risks, and once data flows are live, addressing privacy becomes far more difficult and less effective.