Artificial intelligence can significantly enhance efficiency when reviewing large volumes of privacy and data protection regulations across jurisdictions. However, regulators consistently emphasize that AI outputs must be subject to human oversight and validation.

AI-based systems may identify relevant laws, regulations, and obligations, but generated results still require expert assessment to confirm completeness, applicability, and relevance to a specific institution’s business model, jurisdictions, and data processing activities. Legal interpretation remains a human responsibility.

Training AI solely on rule content without understanding how models function undermines governance expectations. Additionally, analyzing a large volume of rules does not guarantee accuracy or applicability. AI systems can be trained to identify jurisdiction-specific rules, but they cannot independently determine legal applicability without contextual judgment.

Therefore, human review remains essential, making option A the correct answer.