{
  "lesson": "26-compliance-frameworks",
  "title": "Compliance — SOC 2, HIPAA, GDPR, PCI-DSS, EU AI Act, ISO 42001",
  "questions": [
    {
      "stage": "pre",
      "question": "When does EU AI Act enforcement for high-risk systems begin?",
      "options": [
        "Already fully enforced in 2024",
        "August 2, 2026",
        "February 2, 2025",
        "January 1, 2030"
      ],
      "correct": 1,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "Which two-tier fine ceiling does the EU AI Act define?",
      "options": [
        "Up to €100K for any violation",
        "Up to €15M or 3% global annual turnover for high-risk-system obligations (Art. 99(4)); up to €35M or 7% for prohibited AI practices (Art. 99(3))",
        "Up to €1M flat for any violation",
        "No financial penalties, only takedown orders"
      ],
      "correct": 1,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "Why is post-processing PII cleanup not a defensible GDPR posture?",
      "options": [
        "The model already saw the data, so real-time inference-layer redaction (before the LLM call) is the defensible 2026 standard",
        "GDPR forbids redaction entirely",
        "It is too slow at scale",
        "Post-processing is identical to real-time"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What is the practical difference between SOC 2 Type I and Type II?",
      "options": [
        "Type I requires HIPAA BAA",
        "Type I is more rigorous than Type II",
        "Type I attests controls designed and documented; Type II attests controls operating effectively over 6-12 months",
        "Type II is for startups only"
      ],
      "correct": 2,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "What does cross-framework control mapping aim to deliver?",
      "options": [
        "Eliminating audits",
        "Replacing all frameworks with ISO 42001",
        "One control policy that satisfies multiple framework requirements (e.g. access logging maps to ISO 27001 A.5.15-5.18, GDPR Art. 32, HIPAA §164.312(a))",
        "More distinct controls per framework"
      ],
      "correct": 2,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "What does the lesson recommend for HIPAA + LLM workloads?",
      "options": [
        "Use only on-prem models, never managed",
        "Ship PHI to any provider; BAA is optional",
        "HIPAA does not apply to LLMs",
        "Never send PHI to an external AI service without a signed BAA; all three hyperscalers and major LLM API providers offer BAAs"
      ],
      "correct": 3,
      "explanation": ""
    }
  ]
}