The best answer is A. Pipelines are pattern- and model-needs specific . PMI-CPMAI treats data preparation as something that must be tailored to the AI use case, the data involved, and the model being developed. The official outline includes defining required data, mapping data requirements to business objectives, overseeing data cleaning and preprocessing workflows, managing normalization, augmentation, and feature-related activities, and verifying that preprocessing results are valid before model training. In the CPMAI v7 outline, PMI also emphasizes engineering AI data pipelines, creating separate training and inference pipelines, and addressing AI-specific needs in data preparation . These points strongly support the idea that a previous project’s pipeline should not be reused blindly.

This answer is also consistent with PMI’s pattern-based thinking: different AI patterns and model approaches require different data structures, labels, transformations, and quality controls. As an inference from PMI’s methodology, a pipeline that worked for one project may be unsuitable for another because the new project may have different objectives, preprocessing requirements, or model behaviors. Option B is too broad, Option C is too permissive, and Option D is too narrow because the issue begins before operationalization.

PMI-CPMAI treats data as a central asset and states that representative, high-quality training data is essential for safe and effective AI in sensitive domains such as healthcare. Before sophisticated bias metrics or advanced KPIs are useful, the guidance stresses a phase of data understanding and preparation, where teams analyze data sources, coverage, completeness, and consistency, and ensure that the training set reflects the relevant populations, geographies, and use cases. PMI describes this as “profiling and exploring data to understand distributions, outliers, missingness, and segment coverage, then cleaning, integrating, and transforming it into a trusted, analysis-ready dataset.” In a multi-country health insurance scenario, with diverse hospitals and different privacy regimes, this step includes mapping schemas, resolving identifiers, handling missing or noisy records, and ensuring that patients from different regions, demographics, and care pathways are adequately represented without oversampling or excluding key groups. Simply increasing the size of the dataset without ensuring diversity and representativeness may reinforce existing biases or create blind spots. Likewise, KPI enhancement comes later, once the data foundation is sound. Therefore, the critical step to optimize representative training data in this context is to improve data understanding and preparation, ensuring that the integrated dataset is complete, consistent, diverse, and properly structured for training.

Within PMI-CPMAI’s “Support Responsible and Trustworthy AI Efforts,” privacy and security are treated as core, high-severity risks because they can trigger regulatory violations, reputational damage, and harm to individuals. PMI explicitly calls out the need to establish a privacy/security plan with encryption and access controls, privacy impact assessments, and secure handling of personally identifiable information (PII) across the AI lifecycle. If user data is stored in an unsecured database, the agency faces immediate exposure to breach, unauthorized access, and misuse—risks that are typically higher impact than stale data, vendor reliance, or even lack of transparency. In PMI guidance on AI data life cycle management, prolonged retention and weak security increase breach likelihood over time, making insecure storage a critical vulnerability that undermines trust and compliance. While transparency gaps are serious (PMI also emphasizes explainability requirements and audit trails), a direct security failure that exposes user data is generally the most acute and consequential risk because it can cause harm quickly and irreversibly, and it can halt the program through legal and policy intervention.