Question
Which of the following should an auditor reference when reviewing a company's human resources AI systems for legal non-compliance?
- A. Organization for Economic Cooperation and Development (OECD) standard
- B. National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF)
- C. European Union (EU) AI Act Correct
- D. International Organization for Standardization (ISO)
Explanation
Legal non-compliance can only be measured against law, and the EU AI Act is binding regulation; Annex III explicitly classes AI used for recruitment, selection, promotion, termination and performance monitoring as high-risk, with legal obligations attached. The OECD AI principles, the NIST AI RMF and ISO standards are voluntary guidance and frameworks, useful for good practice but not a basis for legal non-compliance findings.
