AAISM identifies fairness constraints as a direct mechanism to mitigate and control model bias by embedding fairness requirements into optimization objectives during training.
Data augmentation (B) helps but is not a primary anti-bias control. Adversarial training (C) focuses on robustness, not fairness. Minimization (A) reduces data, often making bias worse.
References: AAISM Study Guide - Fairness, Bias Mitigation Techniques, Ethical AI Controls.

According to AAISM governance principles, when AI functionality is added to existing services, the first consideration is contractual and service-level accountability. If AI outputs cannot be predefined, the existing service agreements may no longer reflect performance responsibilities or liability. Revising or updating the agreement ensures governance alignment, accountability, and risk management for AI-driven behavior.
Phased approaches and performance explanations are valuable but occur later in project management.
Developer accountability for customer inquiries is not a primary governance step. The most immediate consideration is revising service agreements when AI introduces new uncertainties.
References:
AAISM Exam Content Outline - AI Governance and Program Management (Policies and Service Agreements) AI Security Management Study Guide - Accountability in AI Deployments

AI/ML threat modeling is the most effective structured method to both identify and address model security risks. It systematically surfaces attack classes (poisoning, evasion, membership inference, model extraction, inversion), maps system-specific attack surfaces (data pipelines, feature stores, training artifacts, inference APIs), and drives prioritized mitigations (ingestion validation, robust training, rate-limiting, watermarking, differential privacy, monitoring, red teaming). Output spot-checking (A) finds errors but not security vulnerabilities; encryption (C) protects confidentiality but does not reveal threats or mitigate inference-time attacks; adding data (D) may improve accuracy but does not target adversarial risk.
References: AI Security Management (AAISM) Body of Knowledge - AI Risk Identification & Threat Modeling; Attack Surface Analysis for ML; Risk Treatment Planning. AAISM Study Guide - Evasion
/Poisoning/Extraction Controls; Mapping Risks to Controls; Validation and Assurance Activities.

AAISM's technical control guidance emphasizes that when using open-source libraries, the best safeguard for integrity is to scan the packages for malware before installation. This ensures that compromised or malicious code does not enter the AI system environment. Maintaining lists aids consistency but not security. Always using the latest versions may introduce unverified vulnerabilities. Retraining models addresses functionality but not software integrity. Therefore, the strongest protective measure is pre-installation malware scanning of open-source packages.
References:
AAISM Exam Content Outline - AI Technologies and Controls (Software Supply Chain Security) AI Security Management Study Guide - Open-Source Package Risk Mitigation

AAISM states that anonymization is not permanent and may be reversible through re-identification attacks.
The first action should be to evaluate and measure the actual privacy risk through:
* adversarial re-identification testing
* privacy audits
* monitoring for misuse
This provides the factual basis needed before making destructive or operational decisions.
Access control (D) is important but not the FIRST step. Deleting datasets (B) is premature. Assuming anonymization is permanent (A) violates AI privacy principles.
References: AAISM Study Guide - Privacy Risk, Re-Identification Threats, Adversarial Testing.