RESPONSIBLE AI, COMPLIANCE, AND RISK

PRIVACY AND DATA PROTECTION Personal data is information about an identifiable person. Laws in many places set rules for collecting, storing, and sharing it, and the rules differ by country and by industry, so teams should check with legal experts about what applies to them. Good habits are widely shared. Collect only what you need, which is called data minimization. Mask sensitive items, for example by storing only the last four digits of an identification number. Keep personal data out of logs and traces, or protect it carefully. Delete data when it is no longer needed. Control who can see it, using the permissions in Chapter 37. AUDITABILITY AND RECORD KEEPING An audit is an independent review of what a system did and why. Auditability means the system keeps the records that make such a review possible. For an agent, this means recording the decisions it made, the data it considered, the tools it used, and who approved what, using the logs and traces from Part Seven. Records should be tamper-evident, meaning any change to them would be detectable, and kept for the required retention period, the length of time a rule says records must be kept.