In PMI-CPMAI, ongoing monitoring and performance management are core responsibilities during the AI lifecycle. A model that once performed well but later shows increased error rates often suffers from data drift or concept drift—situations where the real-world data distribution or underlying relationships change compared with the training data. PMI-CPMAI guidance stresses that identifying the root cause of such degradation requires examining how incoming production data differs from historical or training data.

By analyzing the distribution of real-world data for potential shifts, the project team can detect changes in key input features, population characteristics, usage patterns, or label definitions that may be driving performance decline. This aligns with recommended practices in AI operations (MLOps) such as monitoring feature distributions, stability metrics, and segment-level performance over time.

Other actions, like reviewing architecture or increasing regularization, are design-level changes and treat symptoms without first confirming whether the environment has changed. Similarly, checking the preprocessing pipeline is useful when suspecting a technical bug, but the question focuses on identifying the cause of a gradual or unexpected performance drop in real deployment. PMI-CPMAI emphasises that data and context drift analysis is the primary diagnostic step in such scenarios. Therefore, the most appropriate action is to analyze the distribution of real-world data for potential shifts.

The best answer is B. Create a detailed data usage policy. In PMI’s CPMAI framework, trustworthy AI requires more than technical security controls. It also requires clear rules for how data may be collected, accessed, shared, retained, and used responsibly, especially when personal data is involved. PMI’s official exam content outline includes establishing governance protocols for personally identifiable information, monitoring regulatory and policy compliance, coordinating with legal and compliance teams, and ensuring privacy and secure handling across the AI lifecycle.

A detailed data usage policy directly addresses the core issue in the question: ethical concerns about misuse. It defines acceptable and unacceptable uses of personal data, clarifies accountability, and supports responsible behavior by everyone involved in the AI system. PMI’s trustworthy AI guidance also emphasizes governance, responsibility, transparency, and ethics as foundational elements for building AI systems people can trust.

Option A is important, but access controls mainly restrict who can reach the data; they do not fully define responsible use. Option C is useful but too broad and ongoing rather than the most direct action. Option D improves visibility, but reporting alone does not prevent misuse. A clear data usage policy is the strongest first control for ethical and responsible data use.

The best answer is B. Outline the business objectives for the AI project . PMI-CPMAI begins with business understanding, not technology selection. The official exam outline emphasizes formulating AI-specific business questions, prioritizing and scoping AI projects, matching business needs to AI patterns, and conducting AI go/no-go assessments before deeper work on data, tools, and model development. This means the team must first define what outcome the project is meant to achieve. Without clear business objectives, it is impossible to know what data is required, what technology is appropriate, or what capabilities the team actually needs.

Option C is very important, but verifying data availability and quality belongs after the business objective is defined, because “required data” depends on the use case. Option A may reveal capability gaps, yet PMI’s methodology does not start with internal skill assessment as the primary driver. Option D is even later, since procurement decisions should be based on the defined objective and identified gaps. PMI’s structure is clear that AI projects should start from the business problem and intended value, then move into data understanding and technical readiness. That is why outlining the business objectives is the strongest first step.

PMI-CPMAI places strong emphasis on responsible and compliant AI, especially in domains like healthcare, where data is highly sensitive and regulations are strict and multi-jurisdictional. When AI systems must interoperate with existing healthcare databases containing patient information, the project manager must ensure that data use, access, storage, and sharing comply with privacy, consent, security, and cross-border transfer requirements.

A Privacy Impact Assessment (PIA) (often aligned with or equivalent to a Data Protection Impact Assessment) is highlighted as a critical step in such scenarios. It systematically identifies how personal data will be processed, maps data flows, evaluates risks to individuals’ privacy, and determines whether the AI solution complies with applicable laws (e.g., GDPR-like regimes, health data regulations, and medical confidentiality obligations). It also guides the design of safeguards such as data minimization, access controls, anonymization/pseudonymization, and audit trails.

While prediction accuracy, financial risk analysis, and regulatory reports are important, PMI-CPMAI frames PIAs as a foundational risk and governance control whenever AI operates on sensitive data across multiple legal contexts. Without a properly performed privacy impact assessment, the project would be exposed to legal non-compliance, ethical breaches, and loss of trust, regardless of how accurate or cost-effective the model might be. Therefore, implementing privacy impact assessments is the critical step that must be performed.

Scalability in AI initiatives is defined within PMI-CPMAI as the solution’s ability to maintain performance, reliability, and accuracy when subjected to increased data volume, user demand, or computational workload. The PMI AI Management Framework emphasizes that an AI system must be architected to “expand capacity, data throughput, and model processing without degradation of service quality” (PMI-CPMAI Learning Path: AI Solution Design and Implementation).

PMI further states that when assessing scalability, project managers must evaluate whether the AI system can “adapt to higher-than-forecast usage levels, larger datasets, and future feature growth using modular and distributed architectures.” The official guidance notes that scalable AI solutions often rely on elastic cloud environments, containerized deployments, and horizontally scalable compute layers. This is captured in PMI’s explanation that “AI performance must remain stable as demand increases, requiring testing against progressively higher loads to validate computational capacity, latency thresholds, and throughput expectations” (PMI-CPMAI: AI Technical Foundations).

The project manager’s responsibility includes verifying that the model pipelines, data ingestion systems, and inferencing services continue to operate effectively under expanded operational demand. PMI stresses that this factor—ability to handle increased loads—is the cornerstone of scalability evaluation, whereas regulatory compliance, human oversight, and integration concerns, while important, relate to governance, ethics, and interoperability rather than scalability.

Therefore, the correct factor that ensures AI scalability is the solution’s ability to handle increased loads.

PMI’s responsible AI emphasis treats privacy, security, and compliance as top-tier risks because failures can lead to immediate harm, legal penalties, loss of trust, and forced shutdown of the system—often outweighing technical or delivery risks. PMI notes that strong data governance creates a structured, secure environment that minimizes the risk of data security breaches and addresses compliance gaps as AI capabilities evolve faster than regulation. In a customer-service chatbot, sensitive data (account details, identifiers, interaction logs) is frequently processed and stored; a privacy breach can trigger regulatory action and reputational damage at a scale that eclipses integration delays (A), performance/scalability issues (C), or team capability gaps (D). PMI also frames trustworthy AI around governance and accountability practices that reduce fear and build trust—privacy compliance is foundational to that trust. While scalability is important for feasibility, it is generally a solvable engineering and capacity-planning challenge; by contrast, privacy noncompliance can be existential for the initiative. Therefore, the highest-risk option is breaching customer data privacy regulations with legal consequences.

In the PMI-CPMAI perspective on responsible AI and data governance, regulatory compliance starts with knowing exactly what data you have and how sensitive it is. Before you can design controls, encryption schemes, or risk plans, you must first perform a data audit and classification to identify personal, sensitive, and regulated data elements, as well as their sources, flows, and storage locations. This aligns with the guidance that early in the AI lifecycle, project teams should create a clear data inventory and mapping to understand which datasets fall under privacy regulations (such as health, financial, or personally identifiable information).

By conducting a thorough data audit to identify sensitive information, the project team can determine which regulations apply, what consent or legal basis is required, and where to apply specific safeguards (access controls, anonymization, retention limits, etc.). Encryption and broader risk management plans are important, but they are secondary steps that rely on the foundational insight gained from the audit. Verbal commitments from stakeholders have no formal regulatory standing. Therefore, in the initial stages of data collection and aggregation, the task that most directly supports regulatory compliance is a thorough data audit to identify sensitive information.

PMI-CPMAI places responsible AI, regulatory compliance, and ethical alignment on equal footing with performance and accuracy, especially in highly regulated sectors like financial services. Fraud detection models often operate on sensitive financial and personal data and can materially impact customers if they are biased or systematically unfair.

The PMI-CPMAI guidance on risk, ethics, and governance emphasizes that project managers must ensure AI systems are evaluated not only on predictive quality but also on fairness, bias, transparency, and explainability. A core expectation is that teams implement bias detection and mitigation strategies across the AI lifecycle: examining training data for representational bias, testing model outputs for disparate impact across customer segments, and applying corrective techniques such as rebalancing, re-weighting, or constraint-based training.

Focusing solely on accuracy (option A) contradicts responsible AI principles and can institutionalize harmful patterns. Using any available data without consent (option C) violates data protection and ethical standards. Assuming compliance without formal verification (option D) fails governance and auditability requirements. By contrast, implementing bias detection and mitigation strategies directly addresses regulatory and ethical concerns, while also supporting robust, trustworthy performance. It operationalizes responsible AI practices in line with PMI-CPMAI expectations, ensuring the fraud models are both effective and compliant.

The best answer is B. Develop a comprehensive usage scenario analysis . In PMI-CPMAI, a strong AI scope statement must reflect how and where the solution will actually be used. That includes the operating environment, device context, user roles, workflow touchpoints, and practical implementation assumptions. PMI’s exam outline emphasizes defining the AI project scope, documenting assumptions and constraints, planning integration with existing systems and workflows, and establishing solution requirements that support successful deployment and adoption.

A usage scenario analysis is the best way to capture those details because it translates business intent into realistic operational conditions: who will use the system, on what devices, in which environments, and under what constraints. A technical requirements audit may come later, but it is not the best primary method for describing user context in the scope statement. Stakeholder buy-in is important for alignment, yet it does not itself generate the needed scope content. “AI efficacy program” is not the clearest PMI-CPMAI-aligned artifact for this task. Since the question asks what the project manager should do to include environments, devices, and personnel in scope, scenario analysis is the most direct and defensible PMI-style answer.

For an AI-based fraud detection system, PMI-CPMAI–aligned guidance on benefits realization and performance management stresses that success metrics must be quantified against a clear baseline and monitored continuously over time. To properly define and measure KPIs such as detection accuracy, reduced investigation time, and cost savings, the project team should first establish a baseline using historical data comparisons (D). That means analyzing historical fraud cases, prior detection rates, average investigation duration, and historical financial losses to understand “pre-AI” performance. This provides a reference point against which improvements can be measured in a verifiable way.

In addition, PMI-CPMAI emphasizes continuous performance monitoring (B) as part of AI lifecycle governance. Fraud patterns, transaction volumes, and user behavior evolve, so model performance relative to KPIs must be tracked on an ongoing basis using dashboards and periodic evaluations. This supports early detection of performance degradation, allows recalibration of thresholds, and validates that business benefits (e.g., decreased losses, reduced workload) are being sustained.

Relying only on qualitative feedback, random benchmarks, or purely theoretical targets does not meet PMI-CPMAI expectations for evidence-based measurement and governance. Therefore, the two appropriate approaches are: implementing a continuous performance monitoring system (B) and establishing a baseline using historical data comparisons (D).