An AI solution handles confidential customer records. Its planning must address what data is collected and who may access it. Which approach best fits?

1. Use Google's Secure AI Framework as guidance alongside concrete controls.
2. Establish monitoring, evaluation ownership, and controlled update procedures.
3. Measure subgroup performance and investigate representativeness and bias.
4. Apply data minimization, approved processing, and least-privilege access.