When evaluating a third-party AI service provider, which of the following master services agreement provisions is MOST critical for managing security risk?

The correct answer is A. Prohibiting the use of customer data for model training. Prohibiting the use of customer data for model training is the most critical provision because it directly protects the confidentiality of sensitive organizational data. When a provider uses customer queries or data to retrain its models, that information can potentially be surfa

AI Security Risk Management

Question

Options

AProhibiting the use of customer data for model training
BRestricting query volume thresholds
CSharing real-time log information
DGuaranteeing unlimited model retraining requests

How the community answered

(20 responses)

A
75% (15)
B
5% (1)
C
5% (1)
D
15% (3)

Explanation

Prohibiting the use of customer data for model training is the most critical provision because it directly protects the confidentiality of sensitive organizational data. When a provider uses customer queries or data to retrain its models, that information can potentially be surfaced in responses to other customers or retained beyond the intended use, creating a significant data leakage and privacy risk. Restricting query volume thresholds (B) is an operational concern, not a security control. Sharing real-time log information (C) is useful for incident response and monitoring but is secondary to preventing data misuse in the first place. Guaranteeing unlimited model retraining requests (D) is a service-level concern with no direct security relevance and could even increase risk if it involves customer data.

Topics

#Third-party risk#Contractual security#Data privacy#Model training data

Community Discussion

No community discussion yet for this question.

Full AAISM Practice