Regulatory compliance (GDPR, AI Act) in MLOps - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding GDPR's Data Minimization Principle

Which of the following best describes the data minimization principle under GDPR when designing an MLOps pipeline?

A Collect and store only the data necessary for the specific ML task and no more.

B Collect as much data as possible to improve model accuracy, regardless of relevance.

C Store all raw data indefinitely to allow future model retraining without restrictions.

D Share collected data freely with third parties to enhance collaboration.

💡 Hint

Think about limiting data to what is strictly needed.

GDPR requires that only data necessary for the intended purpose is collected and processed, reducing privacy risks.

💻 Command Output

intermediate

Output of Data Access Log Query for GDPR Audit

You run this command to query user data access logs in your MLOps system for a GDPR audit:

kubectl logs mlops-data-access-pod | grep 'user123'

What output would you expect if user123 accessed data on 2024-06-01 at 10:00?

MLOps

kubectl logs mlops-data-access-pod | grep 'user123'

A Error: pod mlops-data-access-pod not found

B 2024-06-01T10:00:00Z user123 accessed dataset customer_data.csv

C No entries found for user123

D 2024-06-01T10:00:00Z user456 accessed dataset customer_data.csv

💡 Hint

Look for the exact user ID and timestamp in the logs.

The command filters logs for 'user123', so the output shows their access record with timestamp and dataset.

🔀 Workflow

advanced

Correct Workflow to Ensure AI Act Compliance in Model Deployment

Which workflow sequence correctly ensures compliance with the AI Act when deploying a high-risk AI model?

A 2,1,3,4

B 1,3,2,4

C 3,1,2,4

D 1,2,3,4

💡 Hint

Think about the logical order from assessment to deployment.

First assess risks, then implement transparency, get certifications, and finally deploy with monitoring.

❓ Troubleshoot

advanced

Troubleshooting Data Subject Access Request (DSAR) Automation Failure

Your automated DSAR system in the MLOps pipeline fails to retrieve all user data. Which cause is most likely?

A The data indexing service is not updated with recent user data changes.

B The Kubernetes cluster is running out of CPU resources.

C The ML model accuracy is below 90%.

D The AI Act requires manual DSAR processing only.

💡 Hint

Consider what affects data retrieval completeness.

If the indexing service is outdated, the DSAR system cannot find all user data, causing incomplete responses.

✅ Best Practice

expert

Best Practice for Logging to Meet GDPR and AI Act Requirements

Which logging practice best meets both GDPR and AI Act compliance in an MLOps environment?

A Log full user data in plaintext for easy debugging and audit.

B Log only errors without user context to reduce storage costs.

C Log all user interactions with anonymized identifiers and secure logs with restricted access.

D Disable logging to avoid storing any personal data.

💡 Hint

Think about privacy and auditability together.

Logging anonymized user interactions with secure access balances privacy and traceability required by GDPR and AI Act.

Practice

1. What is the main purpose of GDPR in the context of MLOps?

easy

A. To improve the speed of machine learning model training

B. To protect user data privacy and control how personal data is used

C. To increase the accuracy of AI predictions

D. To reduce the cost of cloud computing resources

Solution

1. Step 1: Understand GDPR's focus

   GDPR is a law designed to protect personal data and privacy of individuals in the EU.

2. Step 2: Relate GDPR to MLOps

   In MLOps, GDPR ensures that data used for training and deployment respects user privacy and consent.

3. Final Answer:

   To protect user data privacy and control how personal data is used -> Option B

4. Quick Check:

   GDPR = Protect user privacy [OK]

Hint: GDPR is about data privacy and user rights [OK]

Common Mistakes:

• Confusing GDPR with performance improvements
• Thinking GDPR controls AI accuracy
• Assuming GDPR reduces costs

2. Which of the following is the correct way to document AI model compliance with the AI Act?

easy

A. Document only the training code without data details

B. Only save the final model weights without any metadata

C. Avoid documenting to protect intellectual property

D. Keep a detailed record of data sources, model decisions, and risk assessments

Solution

1. Step 1: Understand AI Act documentation requirements

   The AI Act requires transparency, including data sources, model behavior, and risk management.

2. Step 2: Identify correct documentation practice

   Keeping detailed records ensures compliance and accountability for AI systems.

3. Final Answer:

   Keep a detailed record of data sources, model decisions, and risk assessments -> Option D

4. Quick Check:

   AI Act = Detailed compliance records [OK]

Hint: Document all data and risks for AI Act compliance [OK]

Common Mistakes:

• Ignoring data source documentation
• Saving only model weights without context
• Not assessing risks or model decisions

3. Consider this Python snippet used in an MLOps pipeline to check GDPR compliance:

def check_data_compliance(data):
    if 'user_consent' in data and data['user_consent'] == True:
        return 'Compliant'
    else:
        return 'Non-compliant'

result = check_data_compliance({'user_consent': False})
print(result)

What will be the output?

medium

A. Compliant

B. True

C. Non-compliant

D. KeyError

Solution

1. Step 1: Analyze the function logic

   The function checks if 'user_consent' key exists and is True; otherwise returns 'Non-compliant'.

2. Step 2: Evaluate the input data

   The input has 'user_consent' set to False, so condition fails and returns 'Non-compliant'.

3. Final Answer:

   Non-compliant -> Option C

4. Quick Check:

   Consent False means Non-compliant [OK]

Hint: Check boolean condition carefully for True/False [OK]

Common Mistakes:

• Assuming any 'user_consent' key means compliant
• Expecting a KeyError when key exists
• Confusing output with boolean True

4. You have this snippet to check AI Act compliance but it raises an error:

def validate_model_risk(risk_level):
    if risk_level = 'high':
        return 'Requires strict controls'
    else:
        return 'Standard controls'

What is the error and how to fix it?

medium

A. SyntaxError due to '=' instead of '==' in if condition; fix by using '=='

B. NameError because risk_level is undefined; fix by defining risk_level

C. IndentationError due to missing indent; fix by indenting return lines

D. TypeError because risk_level is not a string; fix by converting to string

Solution

1. Step 1: Identify the error in the if statement

   The if condition uses '=' which is assignment, not comparison, causing SyntaxError.

2. Step 2: Correct the comparison operator

   Replace '=' with '==' to compare risk_level to 'high' properly.

3. Final Answer:

   SyntaxError due to '=' instead of '==' in if condition; fix by using '==' -> Option A

4. Quick Check:

   Use '==' for comparison, not '=' [OK]

Hint: Use '==' for comparisons, '=' is assignment [OK]

Common Mistakes:

• Using '=' instead of '==' in conditions
• Confusing SyntaxError with NameError
• Ignoring indentation correctness

5. You want to automate GDPR compliance checks in your MLOps pipeline. Which approach best ensures compliance before model deployment?

hard

A. Integrate automated data scanning tools to detect personal data and verify consent flags

B. Deploy models immediately and fix compliance issues if users complain

C. Skip data checks and rely on manual audits after deployment

D. Only check compliance for models trained outside the EU

Solution

1. Step 1: Understand GDPR compliance automation

   Automated tools can scan data to detect personal information and check if user consent is present.

2. Step 2: Evaluate deployment strategies

   Deploying without checks or relying on manual audits risks legal issues and user trust loss.

3. Step 3: Choose best proactive approach

   Integrating automated compliance checks before deployment ensures issues are caught early and fixed.

4. Final Answer:

   Integrate automated data scanning tools to detect personal data and verify consent flags -> Option A

5. Quick Check:

   Automate compliance checks before deployment [OK]

Hint: Automate data and consent checks pre-deployment [OK]

Common Mistakes:

• Ignoring compliance until after deployment
• Relying only on manual audits
• Assuming non-EU models don't need checks