Law and Artificial Intelligence

• A. AI systems are exempt from legal rules because they are not human.
• B. AI systems and their developers must operate within legal frameworks that apply equally, clearly, and predictably. ✓
• C. Only governments may regulate AI, and courts have no role.
• D. AI systems are automatically granted legal personhood once deployed.

Why: The rule of law holds that all actors, including those who build and use AI, are bound by publicly known, consistently applied legal rules. It does not exempt technology from legal accountability, nor does it grant automatic legal personhood.

• A. Hard law is binding and enforceable by courts or regulators, while soft law consists of non-binding guidelines, principles, or standards. ✓
• B. Hard law applies only to private companies, while soft law applies only to governments.
• C. Hard law is created by technologists, while soft law is created by judges.
• D. There is no meaningful difference; both are legally enforceable in the same way.

Why: Hard law refers to legally binding statutes, regulations, and case law with enforcement mechanisms. Soft law includes non-binding instruments such as ethical guidelines and OECD principles, which shape behavior without creating direct legal liability.

• A. Jurisdiction
• B. Accountability ✓
• C. Precedent
• D. Sovereignty

Why: Accountability is the principle that a identifiable actor can be held responsible for an AI system's outcomes. Jurisdiction concerns which court has authority, precedent concerns prior decisions, and sovereignty concerns state authority; none of these directly addresses assigning responsibility.

• A. Because courts require that decisions affecting people's rights be reasoned and open to challenge, which can be difficult with opaque AI models. ✓
• B. Because AI systems are legally required to publish their source code.
• C. Because explainability determines whether a system can own intellectual property.
• D. Because explainable systems are automatically exempt from data protection laws.

Why: Legal systems often require reasons for decisions so that affected people can understand and contest them, a principle tied to due process. Opaque AI models can make this difficult, which is why explainability has become a legal and not only a technical concern.

• A. A controlled environment where developers can test innovative AI systems under regulatory supervision before full market deployment. ✓
• B. A court procedure for resolving disputes between AI companies.
• C. A permanent ban on experimenting with new AI technologies.
• D. A storage system that holds training data for public review.

Why: Regulatory sandboxes allow firms to trial new products under regulator oversight, with temporary relief from some rules, helping regulators learn about emerging technology while managing risk before wider release.

• A. A decision made by a human that is later reviewed by an AI system
• B. A decision made by an AI system without direct, real-time human control over the specific outcome ✓
• C. Any decision made by a company's board of directors without shareholder input
• D. A decision made by a court when no legislation applies to the case

Why: An autonomous decision is one made by an AI system operating without direct, real-time human control over the specific outcome, which is what raises distinctive questions about who should be held responsible for resulting harm.

• A. AI systems always have clear, human-readable reasoning logs
• B. The causal chain between a developer's, deployer's, or user's action and the harmful outcome can be difficult to trace ✓
• C. Courts have no jurisdiction over technology-related disputes
• D. Insurance is never available for technology products

Why: Many AI systems, especially those using complex machine learning, produce outputs through processes that are opaque, so it can be hard to establish that a specific party's conduct caused the harm, complicating liability allocation.

• A. The end user who activated the product
• B. The manufacturer or developer of the product ✓
• C. The AI system itself as a legal person
• D. The government regulator who approved the product's sale

Why: Traditional product liability typically places responsibility on the manufacturer or developer of a defective product, and this framework is often the starting point for analyzing harms caused by AI-driven products.

• A. To guarantee that the AI system will never make an error
• B. To establish that a party owed a reasonable standard of care to those foreseeably affected by their conduct ✓
• C. To transfer all liability automatically to the AI vendor
• D. To exempt developers from liability when systems are open source

Why: A duty of care requires parties to act reasonably toward those who could foreseeably be harmed by their actions, and negligence claims involving AI ask whether developers or deployers met that standard in design, testing, or oversight.

• A. Because AI systems have consciousness and can feel remorse
• B. Because it may offer a way to assign responsibility to the system itself, though this idea is widely debated and not yet adopted in most jurisdictions ✓
• C. Because AI systems already own property and sign contracts independently
• D. Because it eliminates the need for any insurance coverage

Why: Proposals to grant AI systems limited legal personhood are discussed as a possible way to address responsibility gaps, but they remain controversial and are not established law in most jurisdictions, and AI systems are not generally recognized as conscious or morally responsible agents.

• A. Data minimisation
• B. Purpose limitation ✓
• C. Storage limitation
• D. Accountability

Why: Purpose limitation, found in GDPR Article 5(1)(b), requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. This matters for AI training because data gathered for one service may not automatically be reusable to train a model.

• A. Only explicit consent from every data subject
• B. Only a government order
• C. Any of the six lawful bases in Article 6, such as consent, contract, or legitimate interests, provided the relevant conditions are met ✓
• D. Any data that is publicly available, without further conditions

Why: GDPR Article 6 lists six lawful bases for processing personal data, and an organisation must identify an appropriate one. Legitimate interests is commonly considered for AI training but requires a balancing test. Public availability alone does not remove GDPR obligations.

• A. Developers must delete all data after one training run
• B. Only personal data that is adequate, relevant and limited to what is necessary for the purpose should be used ✓
• C. Datasets must always be as large as possible to reduce bias
• D. Personal data must be stored in a single centralised location

Why: Data minimisation, under GDPR Article 5(1)(c), requires that personal data be adequate, relevant and limited to what is necessary. In AI training, this encourages developers to avoid collecting or retaining personal identifiers that the model does not need.

• A. The right to data portability
• B. The right to restriction of processing
• C. The right to be forgotten, or right to erasure, under GDPR Article 17 ✓
• D. The right to object to automated decisions

Why: Article 17 GDPR gives individuals the right to erasure in specified circumstances. Removing a person's data from a trained model is technically difficult, since information may be embedded in model parameters, making this a central tension in AI and privacy law.

• A. To replace the need for a privacy policy
• B. To identify and mitigate high risks to individuals' rights and freedoms before processing begins ✓
• C. To calculate the financial value of the training dataset
• D. To certify the AI system as free from bias

Why: A DPIA, required under GDPR Article 35 where processing is likely to result in high risk, helps organisations systematically assess risks to individuals and document measures to address them. It is a preventive, pre-processing exercise rather than a substitute for other compliance steps.

• A. AI-generated works are automatically protected because the developer owns the model
• B. Copyright protection requires human authorship, so works generated solely by AI without sufficient human creative control are not registrable ✓
• C. Any work that uses a prompt is fully protected as the work of the prompt writer
• D. AI-generated works fall into the public domain only after 70 years

Why: The U.S. Copyright Office takes the position that copyright requires human authorship. Works generated solely by AI, without sufficient human creative contribution, are not registrable, though human-selected or arranged elements and human modifications may be protected.

• A. Training data must be stored in a government registry
• B. Copying copyrighted works to train a model may constitute reproduction and raise infringement claims unless a defense such as fair use applies ✓
• C. Training on any dataset is illegal unless the data is open source under a permissive licence
• D. Copyright only applies to the final output, never to the data used during training

Why: Training involves making copies of works, which implicates the reproduction right. Developers face litigation over whether such copying is lawful, with fair use or equivalent exceptions (such as the EU text and data mining exceptions) being central defenses.

• A. They must publish the exact weights of the model
• B. They must provide a sufficiently detailed summary of the content used for training ✓
• C. They must delete all copyrighted data within one year
• D. They must obtain a licence from every individual author whose work was ever online

Why: The EU AI Act requires providers of general-purpose AI models to publish a sufficiently detailed summary of the training content and to have a policy respecting EU copyright law, including opt-outs under text and data mining rules. It does not require publishing model weights or licensing every individual work.

• A. Artistic style is protected by copyright in the same way as specific expressive works
• B. Copyright generally does not protect a general artistic style or idea, only concrete expression, which makes style imitation difficult to challenge directly ✓
• C. Style is registrable as a trademark for any artist who uses it
• D. AI models are legally required to label any output that imitates a known style

Why: Copyright protects original expression, not ideas, styles, or techniques. Because of this idea/expression distinction, imitating a recognisable artistic style is usually not infringement on its own, though specific copied elements or misleading uses (for example under trademark or passing off) may be actionable.

• A. The model's ability to remember user prompts across sessions
• B. The phenomenon where a model reproduces substantial portions of its training data nearly verbatim in its outputs ✓
• C. The legal requirement that AI systems store records of all copyrighted works
• D. The process of registering trained models with a copyright office

Why: Memorisation occurs when a model reproduces training material closely or verbatim. It is central to infringement arguments because verbatim outputs of protected works can look like copies, even though the model does not store the works in a conventional sense.

• A. Algorithmic bias ✓
• B. Data encryption
• C. Model compression
• D. Gradient inflation

Why: Algorithmic bias refers to systematic and repeatable errors in an automated system that create unfair outcomes, such as favoring one group over another, often arising from biased training data or design decisions.

• A. Disparate treatment
• B. Disparate impact ✓
• C. Vicarious liability
• D. Promissory estoppel

Why: Disparate impact doctrine, developed in US law (e.g., Griggs v. Duke Power, 1971), addresses facially neutral practices that disproportionately harm protected groups, regardless of discriminatory intent. It is highly relevant to algorithms that produce unequal outcomes without explicitly using protected characteristics.

• A. The Digital Markets Act
• B. The General Data Protection Regulation (GDPR) ✓
• C. The Copyright Directive
• D. The Cybersecurity Act

Why: Article 22 of the GDPR gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, subject to certain exceptions and safeguards.

• A. Postal codes are always illegal to store
• B. It can indirectly reproduce discrimination based on a protected characteristic like race, even when that characteristic is not an input ✓
• C. Postal codes reduce computing speed
• D. Proxies always improve model accuracy without risk

Why: Proxy variables correlated with protected characteristics can allow an algorithm to discriminate indirectly. Removing protected attributes from the data is therefore not sufficient to prevent discriminatory outcomes.

• A. Ignore all complaints permanently
• B. Show the practice serves a legitimate aim and is proportionate, meaning no less discriminatory alternative was reasonably available ✓
• C. Avoid all record-keeping obligations
• D. Transfer liability to the software vendor automatically

Why: Under many anti-discrimination frameworks, a practice with disparate impact may be lawful if the organisation shows it pursues a legitimate objective by proportionate means. Courts often examine whether a less discriminatory alternative was reasonably available.

• A. The General Data Protection Regulation (GDPR)
• B. The EU Artificial Intelligence Act ✓
• C. The Digital Services Act
• D. The Product Liability Directive

Why: The EU Artificial Intelligence Act is the first comprehensive horizontal regulation of AI in the EU. It sorts AI systems into risk categories (unacceptable, high, limited, and minimal risk) and attaches obligations to each tier. The GDPR governs personal data processing, not AI systems as such.

• A. Minimal-risk systems such as spam filters
• B. Limited-risk systems such as chatbots
• C. High-risk systems such as AI used in hiring decisions
• D. Unacceptable-risk systems such as social scoring by public authorities ✓

Why: Under risk-based frameworks like the EU AI Act, systems posing unacceptable risks to fundamental rights, such as government social scoring, are prohibited outright. High-risk systems face strict compliance requirements but are generally permitted if they meet them. Minimal and limited-risk systems face few or only transparency obligations.

• A. To permanently exempt AI developers from regulatory compliance
• B. To allow developers to test innovative AI systems under supervision before full market deployment ✓
• C. To store training data securely for government use
• D. To certify AI systems as safe for consumer use indefinitely

Why: Regulatory sandboxes are controlled environments where regulators allow developers to test innovative products under supervisory oversight, often with temporary relaxations. They help regulators learn about new technologies and help developers ensure compliance before full market launch. They are not permanent exemptions or certifications.

• A. A single federal statute creating a national AI regulator
• B. A sector-specific and guidance-based approach relying on agency action and voluntary commitments, rather than one comprehensive AI law ✓
• C. A complete ban on the development of frontier AI models
• D. Full delegation of AI regulation to individual US states with no federal role

Why: The United States has not enacted a single comprehensive federal AI law. Its approach has relied on executive orders, agency guidance (such as NIST's AI Risk Management Framework), sector-specific rules, and voluntary commitments from companies, alongside some state-level legislation. The 2023 Executive Order exemplifies this guidance-and-agency model.

• A. That AI source code must always be published publicly
• B. That users are informed when they are interacting with an AI system and that decisions can be explained in an understandable way ✓
• C. That AI companies disclose all their financial information
• D. That AI systems must operate without any human oversight to remain neutral

Why: Transparency in AI governance generally means users should know when they are interacting with AI, and that systems affecting people can be explained in meaningful terms. It does not require publishing source code or financial disclosures, and frameworks typically emphasize human oversight rather than its absence.

• A. Data minimisation
• B. Explainability ✓
• C. Proportionality
• D. Non-retroactivity

Why: Explainability (or transparency) requires that the logic behind AI outputs can be understood by users, regulators and affected individuals, which supports accountability and the ability to challenge decisions.

• A. A shortage of funding for AI research
• B. Difficulty identifying which person or organisation is legally responsible when an autonomous system causes harm ✓
• C. The time lag between developing a model and releasing it
• D. Gaps in the training data used for a model

Why: The accountability gap describes the difficulty of assigning legal responsibility when harm arises from systems that act with significant autonomy, involving developers, deployers, and users.

• A. Granting AI systems full legal personhood with unlimited assets
• B. Banning all use of machine learning in public settings
• C. Applying strict or product liability regimes to developers and deployers ✓
• D. Requiring AI systems to be licensed as medical professionals

Why: Many jurisdictions and scholars propose strict or product liability frameworks, which hold manufacturers or deployers responsible for defective AI products regardless of fault, rather than treating AI as a legal person.

• A. Training AI models using only human-written text
• B. Ensuring a human can review, override or intervene in an AI system's decisions ✓
• C. Keeping AI servers physically located in the same country as their users
• D. Allowing employees to vote on which AI tools the company adopts

Why: Human-in-the-loop oversight means a human retains the ability to review, correct, or override automated outputs, which is a safeguard emphasised in many AI ethics frameworks and regulations for high-risk uses.

• A. Determining whether AI-generated works qualify for copyright protection and who owns them ✓
• B. Setting maximum processing speeds for chips
• C. Regulating the physical weight of robots
• D. Standardising keyboard layouts for AI interfaces

Why: Generative AI raises open questions about authorship, copyright eligibility, and ownership of outputs, since many legal systems traditionally require a human author for copyright protection.