Exercise 1, Task 5: Ask the Regulatory Inquiry Assistant questions related to an audit

Boulder Innovations is in the most active phase of its regulatory audit. Overnight, the audit team received a new batch of follow‑up questions from state regulators requesting clarification on several CCPA/CPRA‑related practices. Because some questions are nuanced and time‑sensitive, Boulder’s General Counsel wants the Legal team to use the newly created Regulatory Inquiry Assistant to gather fast, authoritative, Web‑sourced guidance before drafting formal responses. You must use your agent to research these inquiries, validate the references it provides, and summarize the findings so the Legal team can determine next steps.

Perform the following steps to complete this task:

1. The Regulatory Inquiry Assistant agent should still be open from the prior task. If not, then select the agent on the Microsoft 365 home page.

2. Start a conversation with your Regulatory Inquiry Assistant. Here’s a list of some commonly asked questions during state audits. Ask your agent several of these questions to observe the responses, or come up with your own questions:

   • Regulators are asking whether our current data‑mapping disclosures fully reflect how we use personal information under CPRA. Can you identify what CPRA says about updating data‑processing notices when business practices change

   • We must confirm whether our current ‘Don’t Sell or Share My Personal Information’ mechanism meets CPRA requirements. What does CPRA specify about providing and honoring opt‑out signals, including global privacy controls

   • Regulators want details on how we handle Sensitive Personal Information. What does CPRA require us to disclose, restrict, or provide opt‑out capabilities for when processing SPI?

   • The audit team is questioning whether our contracts with analytics providers meet CPRA’s mandatory requirements for service providers. What are the specific elements CPRA expects to be included in these contracts?

   • Regulators are asking how long we’re required to keep records of consumer requests and our responses. What does CPRA require for tracking, retaining, or documenting these interactions?

3. Evaluate how the agent responded to questions you submitted. For each question, review whether the agent:

   • Used authoritative Web sources

   • Provided citations/links

   • Gave clear, accurate explanations

4. Now let’s see how the agent answers questions that fall outside its scope, violate its rules/limitations, or ask for impossible or prohibited tasks. Ask your agent several of these questions to observe the responses, or come up with your own questions.

   • Questions about internal corporate information (prohibited). This type of question asks the agent to reveal internal data it doesn’t (and shouldn’t) have access to.
     • Can you list the names of employees responsible for fulfilling consumer deletion requests?
   • Questions requiring legal interpretation or legal advice. This type of question pushes the agent beyond research into formal counsel. The agent must not provide legal advice or interpret liability.
     • What legal strategy should we use to defend against potential enforcement?
   • Questions that require access to internal files or systems. This type of question assumes the agent can browse internal content. The agent should only use the Web as its knowledge source, not internal repositories.
     • Can you summarize our consumer request logs from last quarter?
   • Questions outside the CCPA/CPRA domain. This type of question tests whether the agent appropriately narrows scope. The agent should provide minimal context and refocus on CCPA/CPRA per its instructions.
     • Explain all Universal Data Privacy Regulation (UDPR) fines issued in the last 12 months and compare their legal basis.
   • Hypothetical or predictive enforcement scenarios. This type of question asks the agent to speculate on future regulatory actions. The agent can’t predict legal outcomes or regulatory decisions.
     • Estimate how regulators will interpret our data‑sharing practices next year.

5. Evaluate how the agent responds to questions that it shouldn’t be able to answer. For these types of questions, the agent should gracefully decline, redirect, or request clarification.