According to the AI Security ManagementTM (AAISM) study framework, compliance with privacy and regulatory standards must begin with a formalized process of identifying, documenting, and maintaining applicable obligations. The guidance explicitly notes that organizations should maintain a comprehensive register of legal and regulatory requirements to ensure accountability and alignment with privacy laws. This register serves as the foundation for all governance, risk, and control practices surrounding AI systems that handle personal data.
Maintaining such a register ensures that the recommendation system operates under the principles of privacy by design and privacy by default. It allows decision-makers and auditors to trace every AI data processing activity back to relevant compliance obligations, thereby demonstrating adherence to laws such as GDPR, CCPA, or other jurisdictional mandates.

Themodel cardis a governance artifact that communicatesintended use, performance characteristics, limitations, fairness considerations, and ethical notesof an ML model.
AAISM governance materials highlight thatstakeholder trustcomes from transparency and explainability.
While hyperparameters and data quality controls are technical details, they lack stakeholder-facing clarity.
Model prototyping is part of development but not a governance record.
Model cards are explicitly recommended to:
* Provideexplainabilityand context for decision-making.
* Demonstrate governance, transparency, and compliance.
* Enable stakeholders (regulators, auditors, business leaders) to trust the system.
Therefore, themodel cardis the artifact that best enhances trust.

AAISM emphasizes that the right to audit is the most critical contractual safeguard when outsourcing AI services. This allows the contracting organization to independently verify that the vendor is applying appropriate protections to training data, meeting compliance obligations, and upholding privacy requirements.
Pseudonymization is a technical method, monitoring is operational, and certifications provide external assurance, but none give the direct, enforceable oversight that audit rights provide. In vendor contracts, the right to audit is the primary safeguard for data protection and governance.
References:
AAISM Study Guide - AI Governance and Program Management (Third-Party Contracts and Audit Rights) ISACA AI Security Management - Vendor Governance Controls

AAISM materials describe that GAN-based systems excel at generating synthetic data-including simulated attack traffic-which can significantly enhance anomaly-based intrusion detection capabilities. The guidance emphasizes that synthetic attack samples help strengthen the model's ability to detect rare or emerging intrusion types. This aligns with the principle that AI security controls should leverage adversarially generated data during training to improve resilience.
Options A and C describe generic ML enhancements, but not GAN-specific advantages. Option B is useful but insufficient for anomaly detection, which relies heavily on recognizing atypical, previously unseen patterns.
References: AAISM Study Guide - AI Security Controls; Adversarial Simulation and Synthetic Data Generation.

Conducting a model review helps identify why legitimate transactions are being incorrectly flagged and enables improvements to model accuracy. Adding explainability techniques also helps analysts and stakeholders better understand decision outcomes, reducing operational issues while maintaining effective fraud detection capabilities.