7.3 — Case Study Practice
Scenario-based questions present real-world situations where you must identify applicable regulations, required controls, and appropriate audit findings. Practice the 5-step approach below.
What is the AI system? What risk tier does it fall under in each applicable framework?
Which countries/regions are involved? Which regulations apply (EU AI Act, DPDP, GDPR, RBI)?
What controls, documentation, and assessments are required from each applicable framework?
What is missing or non-compliant based on the scenario details?
Provide specific, actionable recommendations — not vague 'improve governance' statements.
The exam rewards specific, actionable recommendations over generic statements. Instead of 'improve documentation,' say 'Create model cards following Mitchell et al. (2019) framework with all 8 sections, and establish a quarterly review cycle.' Specificity demonstrates competence.