AIGP Artificial Intelligence Governance Professional Questions and Answers

Theinitial deployment phaseof an AI model is critical forpost-deployment monitoring. When tracking forbias, the most important task is tocontinue disparity testingto determine whether outputs differ across protected groups.

From theAI Governance in Practice Report 2025:

“Performance monitoring protocols… should include mechanisms to assess and measure disparities in outcomes across different demographic groups.” (p. 12)

“Bias may not be evident during pre-deployment testing but can emerge in real-world use.” (p. 41)

B. Awareness trainingis helpful, but not a technical bias mitigation activity.

C. Analyzing training datais apre-deploymenttask.

D. Documenting human decisionsmay support auditability but doesn’t detect bias in AI outputs.

The White House Blueprint for an AI Bill of Rights focuses on protecting civil rights, privacy, and ensuring AI systems are safe and effective. It includes principles like data privacy (D), human alternatives (A), and safe and effective systems (C). However, it does not specifically address high-risk mitigation standards as a distinct category (B).

The correct answer isB. " Candidate quality " isnota negative consequence of using AI—rather, it is the intendedbenefitof using such tools (e.g., more efficient filtering of strong candidates).

From the AIGP ILT Guide:

“Automation bias, disparate impact, and privacy risks are well-documented concerns in AI-assisted hiring. These risks may arise when AI models replicate biases present in training data or obscure the decision logic.”

AI Governance in Practice Report 2025 (Bias and Fairness Section) also warns:

“Improper AI use in hiring can lead to disparate impact, where neutral criteria disproportionately disadvantage protected groups.”

Candidate quality is agoal, not a risk, makingB the correct answerfor what isnota negative outcome.

===========

Post-deployment AI maintenance typically includes ensuring that all model components are subject to a control framework, dedicating experts to continually monitor the model output, and evaluating the need for audits under certain standards. However, defining thresholds to conduct new impact assessments is usually part of the initial deployment and ongoing governance processes rather than a maintenance activity. Maintenance focuses more on the operational aspects of the AI system rather than setting new thresholds for impact assessments.

The best approach to enable a customer who wants information on the AI model ' s parameters for underwriting purposes is to provide a transparency notice. This notice should explain the nature of the AI system, how it uses customer data, and the decision-making process it follows. Providing a transparency notice is crucial for maintaining trust and compliance with regulatory requirements regarding the transparency and accountability of AI systems.

Providing the loan applicants with information about the model capabilities and limitations would not directly support fairness testing by the compliance team. Fairness testing focuses on evaluating the model ' s decisions for biases and ensuring equitable treatment across different demographic groups, rather than informing applicants about the model.

Data aggregators are third parties that collect and license data from various sources. They are responsible for ensuring thelawful collectionandproper usage rightsof the data they distribute — especially when such data is used to train foundational AI models.

From theAI Governance in Practice Report 2025:

“As organizations have neither proximity to how third-party data was first collected nor direct control over the data governance practices of third parties, an organization can benefit from carrying out its own legal due diligence and third-party risk management.” (p. 19)

“Legal due diligence may include verification of the personal data ' s lawful collection by the databroker...” (p. 19)

This confirms thatdata aggregatorsbear the legal and ethical burden to verify that data has been lawfully collected and is appropriately licensed for use, including in AI training.

A. The marketing agencyandD. its clientmay use data, but they rely on upstream providers for its lawful origin.

B. The tech companymay train the model but depends on lawful sourcing by data aggregators.

The correct answer is C because understanding algorithmic methodology is primarily a design, development, and model evaluation activity rather than part of a deactivation or sunset risk strategy. A deactivating risk strategy focuses on safely retiring or discontinuing an AI system, ensuring that operational, legal, and business risks are properly managed. This includes evaluating regulatory requirements such as data retention and deletion obligations, assessing business continuity and financial implications, and understanding dependencies with upstream and downstream systems to avoid disruption. These steps ensure a controlled and compliant system shutdown. In contrast, analyzing algorithmic methodology is relevant during system development, validation, and explainability efforts, not during the decommissioning phase of the AI lifecycle.

The AI risk that would not have been identified during the procurement process based on the categories of information requested by the third-party consultant is security. The consultant focused on accuracy rates, diversity of training data, and system functionality, which pertain to performance and fairness but do not directly address the security aspects of the AI system. Security risks involve ensuring that the system is protected against unauthorized access, data breaches, and other vulnerabilities that could compromise its integrity. Reference: AIGP Body of Knowledge on AI Security and Risk Management.

The correct answer is D. Key stroke dynamics, used to identify individuals, fall under biometric data, which is a special category of personal data under the GDPR and other frameworks.

From the AI Governance in Practice Report 2025:

“Keystroke dynamics may constitute biometric data if used to uniquely identify an individual… Biometric data is classified as special category personal data and requires higher protection standards.”

Also reflected in ILT Participant Guide:

“Biometric data, such as facial images, voiceprints, iris scans or keystroke patterns, are treated as special category data when they are used for the purpose of uniquely identifying individuals.”

Training data is used to enable a model to detect and learn patterns. During the training phase, the model learns from the labeled data, identifying patterns and relationships that it will later use to make predictions on new, unseen data. This process is fundamental in building an AI model ' s capability to perform tasks accurately. Reference: AIGP Body of Knowledge on Model Training and Pattern Recognition.

The correct answer isD. AI Impact Assessments are primarily used to identify and managerisks and harmsassociated with AI systems.

From the AIGP Body of Knowledge:

“The goal of an AI impact assessment is to ensure that risks are identified, evaluated, and mitigated prior to or during development and deployment.”

As further confirmed in the AI Governance in Practice Report 2025 (Part III):

“Risk-based tools like DPIAs and Algorithmic Impact Assessments help identify potential risks to individuals and society, enabling organizations to implement mitigation plans and safeguards.”

While benefits may be noted in such assessments, thecore objectiveis to manage risks andpromote responsible AI.

===========

The correct answer isB. According to responsible AI practices,pre-deployment testingto ensurethe model behaves as expected and aligns with organizational requirements is critical.

From the AIGP ILT Guide:

“Testing for unacceptable outcomes such as toxicity, discrimination, or hallucinations should be included in the AI governance life cycle, particularly during development and prior to deployment.”

Also emphasized in the AI Governance in Practice Report 2025:

“Organizations must verify legal and regulatory compliance, monitor performance, and mitigate risksprior to deployment.”

Testing the model tomeet safety and appropriateness standardsis more proactive and preventive than relying solely on user reporting or requesting documentation.

===========

Human-centric AI focuses on improving the human experience by addressing individual needs and enhancing human capabilities. Option D exemplifies this by using virtual assistants to tailor educational content to each student ' s unique abilities and needs, thereby supporting personalized learning and improving educational outcomes. This use case directly benefits individuals by providing customized assistance and adapting to their learning pace and style, aligning with the principles of human-centric AI.

The failures in semi-autonomous vehicles due to sensors misinterpreting environmental surroundings, such as sunlight, are examples of brittleness. Brittleness in AI systems refers to their inability to handle variations in input data or unexpected conditions, leading to failures when the system encounters situations that were not adequately covered during training. These systems perform well under specific conditions but fail when those conditions change. Reference: AIGP Body of Knowledge on AI System Robustness and Failures.

Testing data is a subset of data used to provide a robust evaluation of a final model. After training the model on training data, it is essential to test its performance on unseen data (testing data) to ensure it generalizes well to new, real-world scenarios. This step helps in assessing the model ' s accuracy, reliability, and ability to handle various data inputs. Reference: AIGP Body of Knowledge on Model Validation and Testing.

The correct answer is A because it directly demonstrates meaningful human oversight over AI-generated outcomes, which is a key requirement in AI governance frameworks and regulations such as the EU AI Act. Human oversight requires that a qualified human can review, intervene, and override AI decisions before they produce legal or significant real-world effects. In high-risk contexts like healthcare diagnostics, governance frameworks emphasize “human-in-the-loop” controls to prevent harm and ensure accountability. Option A ensures a licensed medical professional validates the AI output before it is finalized, aligning with safety, accountability, and risk mitigation principles. Other options describe training, system design, or monitoring, which are important governance measures but do not constitute direct oversight of individual AI decisions at the point of impact, making them insufficient under strict regulatory expectations.

Machine learning (ML) is a subset of artificial intelligence (AI) where systems use data to learn and improve over time without being explicitly programmed. Option B accurately describes machine learning by stating that systems can automatically improve from experience through predictive patterns. This aligns with the fundamental concept of ML where algorithms analyze data, recognize patterns, and make decisions with minimal human intervention. Reference: AIGP BODY OF KNOWLEDGE, which covers the basics of AI and machine learning concepts.

The correct answer is C because performing an impact assessment is the most effective proactive measure to identify and mitigate discrimination risks before model training and testing. AI governance frameworks emphasize early-stage risk identification, particularly for high-stakes domains like healthcare, where bias can lead to harmful or inequitable outcomes. Impact assessments, such as algorithmic or data protection impact assessments, evaluate potential harms, affected populations, and fairness risks prior to development. This enables organizations to design appropriate safeguards, adjust data selection, and implement mitigation strategies before biases become embedded in the model. Options like audits and bias bounty programs are reactive or post-development controls, while simply acquiring more data does not guarantee reduced bias without proper analysis. A structured impact assessment aligns with risk-based governance and supports fairness, accountability, and regulatory compliance.

Deployers of proprietary models arenot responsible for design, but they are accountable for how the system performsin their context of use, including ensuring ethical behavior, performance, and legal compliance.

From theAI Governance in Practice Report 2025:

“Deployers of AI systems must take reasonable steps to ensure that systems are used ethically, perform safely, and align with applicable laws and standards.” (p. 11–12)

“Operational governance… includes performance monitoring protocols, incident management plans, and regulatory oversight.” (p. 12)

Thus:

✅A. Ethical testing– Required to mitigate misuse and unintended harms.

❌B. Ethical design– Belongs todevelopers/providers, not deployers.

✅C. Technical performance– Deployers must ensure that AI performs as expected.

❌D. System documentation– This is theprovider’sobligation.

✅E. Regulatory compliance– Deployers must ensure system use complies with applicable laws.

The IEEE Ethical System Design Risk Management Framework (IEEE 7000-21) would be most appropriate for XYZ Corp ' s governance needs in addition to the NIST AI Risk Management Framework. The IEEE framework specifically addresses ethical concerns during system design, which is crucial for ensuring the responsible use of AI in hiring. It complements the NIST framework by focusing on ethical risk management, aligning well with XYZ Corp ' s goals of deploying AI responsibly and mitigating associated risks​​​​.

A best reflects practical application of data minimization to machine learning. Data minimization requires personal data to be adequate, relevant, and limited to what is necessary for the specified purpose. AI development does not categorically prohibit using personal data in training, so B is too absolute. Personal data may legitimately be required during both training and inference, making D incorrect. Manual review of every data item is neither the definition nor a necessary implementation of minimization. Privacy-enhancing techniques can instead reduce the amount or identifiability of personal data processed while retaining model utility. ICO AI guidance specifically identifies perturbation or adding noise, synthetic data, and federated learning as techniques that can support data minimization during model training. Thus, A is the technically and governance-aligned choice.

================

C is the strongest answer because proprietary deployment can give an organization greater control over system architecture, permissions, agent behavior, data access, escalation rules, and technical guardrails. This control is especially valuable for agentic AI, where systems may autonomously invoke tools, access organizational data, and execute multistep workflows. IAPP guidance emphasizes that agentic systems require purpose-specific guardrails, including controls limiting the data and actions available to an agent. Proprietary control can therefore enable safeguards to be tailored closely to organizational risk tolerances and business requirements. It does not provide immunity from intellectual-property claims, eliminating A. Organizations cannot simply transfer accountability or all risk to a cloud provider, eliminating B. Greater agent autonomy actually increases the importance of internal governance, monitoring, authorization, and human oversight rather than reducing it, eliminating D.

================

The White House Executive Order of November 2023 designates the National Institute of Standards and Technology (NIST) as the responsible body for creating guidelines to conduct red-teaming tests of AI systems. NIST is tasked with developing and providing standards and frameworks to ensure the security, reliability, and ethical deployment of AI systems, including conducting rigorous red-teaming exercises to identify vulnerabilities and assess risks in AI systems.

Biometric data in the U.S. refers to data that relates to measurable biological and behavioral characteristics that can be used to identify an individual. Examples include fingerprints, facial recognition, iris scans, and behavior-based data like gait or keystrokes.

According to definitions and discussions from theAI Governance in Practice Report 2025and U.S. privacy frameworks:

“Biometric data includes physical and behavioral human characteristics that can be used to digitally identify a person to grant access to systems, devices, or data. Examples include facial images, iris patterns, gait analysis, and voice recognition.” (Report context based on common frameworks in U.S. AI law and the use of biometrics in AI governance.)

Here’s how the options relate:

A. Iris scans– These are physical biometric identifiers.

B. Walking gait– Behavioral biometric used increasingly in surveillance and identification.

C. Keystroke dynamics– Behavioral biometric based on typing patterns.

D. GPS location of a user ' s fitness watch– This isnotbiometric data. It islocation data, which may be sensitive or personal, but not biometric.

During the first month of monitoring the model for bias, it is most important to continue disparity testing. Disparity testing involves regularly evaluating the model ' s decisions to identify and address any biases, ensuring that the model operates fairly across different demographic groups.

The correct answers are A, C, and D because multiple regulatory regimes apply based on jurisdiction, data use, and deceptive practices. The EU AI Act applies because the system is being developed and tested in cooperation with an EU-based university and involves behavioral influence, which may fall under prohibited or high-risk AI practices, especially where manipulation or deception is present. The General Data Protection Regulation applies due to the processing of personal data of EU-based participants, particularly given the misleading study protocol, which violates principles such as transparency and informed consent. The Federal Trade Commission Act applies to the US company because deceptive or unfair practices, such as misleading participants about the purpose of experiments, fall under FTC enforcement. The Digital Services Act and PCI standards are not relevant to this specific use case.

The correct answer is A because deploying a proprietary agentic AI model places direct responsibility on the organization for the actions and outcomes of that system. AI governance frameworks emphasize accountability as a core principle, meaning organizations must take responsibility for harms caused by their AI systems, including misleading, biased, or unsafe outputs. Agentic AI systems, which can act autonomously and make decisions, introduce heightened liability risks because their behavior may directly impact users or third parties. Regulatory approaches increasingly focus on ensuring that deployers cannot shift responsibility, especially when the system is proprietary and under their control. The other options relate to operational or technical considerations, not primary legal liability. Ensuring accountability for AI behavior is central to compliance, risk management, and maintaining trust.

The best reason for the police department to continue performing investigations even if the AI system scores an individual ' s likelihood of criminal activity at or above 90% is that AI systems affecting fundamental civil rights should not be fully automated. Human oversight is essential to ensure that decisions impacting civil liberties are made with due consideration of context and mitigating factors that an AI might not fully appreciate. This approach ensures fairness, accountability, and adherence to legal standards. Reference: AIGP Body of Knowledge on AI Ethics and Human Oversight.

A greedy algorithm is one that makes the best choice at each step to achieve an immediate objective, without considering the longer-term consequences. It focuses on local optimization at each decision point with the hope that these local solutions will lead to an optimal global solution. However, greedy algorithms do not always produce the best overall solution for certain problems, but they are useful when an immediate, locally optimal solution is desired. Reference: AIGP Body of Knowledge, algorithm types section.

Strong AI, also known as artificial general intelligence (AGI), refers to AI that possesses the ability to understand, learn, and apply intelligence across a broad range of tasks, similar to human cognitive abilities. For the self-driving car to be classified as " strong " AI, it would need to possess full human cognitive abilities to make independent decisions beyond pre-programmed instructions. Reference: AIGP BODY OF KNOWLEDGE and AI classifications.

The best reason for GVC to offer students the choice to utilize generative AI in limited, defined circumstances is to enable students to learn how to use AI as a supportive educational tool. By integrating AI in a controlled manner, students can learn the practical applications of AI and develop skills to use AI responsibly and effectively in their educational pursuits.

The correct answer isA. While TEVV is important inlater lifecycle phases, it isnot the primary considerationwhen evaluating and prioritizinguse cases.

From the AIGP Body of Knowledge – Use Case Assessment Module:

“Use case evaluation focuses on value, impact, fairness, and accessibility—technical testing considerations come later.”

ILT Guide confirms:

“Organizations should first assess whether the AI system provides equitable outcomes and aligns with stakeholder expectations. TEVV is part of implementation, not initial prioritization.”

Thus,Ais not a top-level consideration during use caseselection.

An AI system that maintains its level of performance within defined acceptable limits despite real-world or adversarial conditions is described as resilient. Resilience in AI refers to the system ' s ability to withstand and recover from unexpected challenges, such as cyber-attacks, hardware failures, or unusual input data. This characteristic ensures that the AI system can continue to function effectively and reliably in various conditions, maintaining performance and integrity. Robustness, on the other hand, focuses on the system ' s strength against errors, while reliability ensures consistent performance over time. Resilience combines these aspects with the capacity to adapt and recover.

Business A is integrating a generative AI model licensed from a third party (Business B) and is primarily concerned with the risk of toxic or obscene outputs being delivered to users. In this scenario,testing and validationof the AI model for such content risks is the most direct and effective governance strategy.

According to theAI Governance in Practice Report 2025, organizations thatdeployAI must engage inperformance monitoring protocolsand ensure systems perform adequately for theirintended purposes, including filtering harmful content:

“Operational governance… development of: →Performance monitoring protocols to ensure systems perform adequately for their intended purposes.” (p. 12)

“Product governance... includes: →System impact assessments to identify and address risk prior to product development or deployment.” (p. 11)

Furthermore, under theEU AI Act, which sets the global standard many organizations aim to align with, there is a clear obligation to test and monitor systems for potential harmful behavior:

“The act imposes regulatory obligations… such as establishing appropriate accountability structures,assessing system impact, providing technical documentation,establishing risk management protocols and monitoring performance...” (p. 7)

Option B directly reflects this best practice ofpre-deployment testing and validationto ensure that the model aligns with Business A’s minimum content safety requirements.

Let’s now evaluate the incorrect options:

A. Fine-tuning on verified user-generated textmay improve model alignment but does not guarantee that the model will generalize correctly, especially if Business A lacks access to model internals (common in third-party licensing scenarios). Fine-tuning also introduces its own risks and may be contractually restricted.

C. A user reporting featureisreactive, not preventive. While helpful for long-term monitoring and mitigation, it does not prevent the initial harm of toxic outputs, which isBusiness A ' s primary concern.

D. Requesting documentation from Business Bis useful for transparency and risk management, but it does not replaceindependent verificationthat the model meets Business A’s content safety standards.

Thus,testing the model ' s behavior for unacceptable outputs before deploymentis the most aligned approach with AI governance best practices and obligations.

The correct answer is C because simply publishing a general AI policy or code of conduct does not satisfy specific transparency obligations required by AI regulations. Transparency requirements focus on providing clear, context-specific disclosures to affected individuals about how AI is being used, particularly when it directly impacts them. For example, notifying users when they are interacting with an AI system or labeling AI-generated content are explicit transparency measures aligned with regulatory expectations. The AI Governance in Practice Report highlights that transparency includes informing users when they interact with AI systems and providing meaningful information about outputs and system behavior . Model cards and labels support system-level and output-level transparency, while real-time notices ensure user awareness. In contrast, a general policy link lacks immediacy, specificity, and user relevance, making it insufficient for mandatory transparency compliance.

Defining the roles and responsibilities of AI stakeholders is crucial for encouraging accountability over AI systems. Clear delineation of who is responsible for different aspects of the AI lifecycle ensures that there is a person or team accountable for monitoring, maintaining, and addressing issues that arise. This accountability framework helps in ensuring that ethical standards and regulatory requirements are met, and it facilitates transparency and traceability in AI operations. By assigning specific roles, organizations can better manage and mitigate risks associated with AI deployment and use.

When the accuracy of a model deteriorates, the best first step is to conduct champion/challenger testing. This involves deploying a new model (challenger) alongside the current model (champion) to compare their performance. This method helps identify if the new model can perform better under current conditions without immediately discarding the existing model. It provides a controlled environment to test improvements and understand the reasons behind the deterioration. This approach is preferable to directly replacing the model, performing audits, or running red-teaming exercises, which may be subsequent steps based on the findings from the champion/challenger testing.

An AI model is best defined as a program that has been trained on a set of data to find patterns within that data. This definition captures the essence of machine learning, where the model learns from the data to make predictions or decisions. Reference: AIGP BODY OF KNOWLEDGE, which provides a detailed explanation of AI models and their training processes​​.

The correct answer isB. The EU AI Act assigns atiered penalty systembased on the severity of the violation. A breach ofobligations related to high-risk AI systemsfalls into the mid-tier category, triggering fines of €15 million or 3% of annual global turnover.

From the AIGP ILT Guide – EU AI Act Module:

“Providers of high-risk AI systems must comply with strict documentation, testing, monitoring, and registration obligations. Breaches of these result in significant fines of up to €15 million or 3% of turnover.”

AI Governance in Practice Report 2025 supports this:

“Non-compliance with obligations under Title III (high-risk systems) leads to financial penalties under Article 71(3) of the EU AI Act.”

Note: Thehighest penalty (€35 million or 7%)applies toprohibited AI uses, not to obligations for high-risk systems.

===========

To protect the company ' s intellectual property, the most pertinent contractual provision is ensuring that the AI provider will defend and indemnify the company against infringement claims. This clause means the provider will take responsibility for any intellectual property disputes that arise, thereby safeguarding the company from potential legal and financial repercussions related to the use of the tool. Other options, while beneficial, do not directly address the protection of intellectual property. This concept is detailed in the contractual best practices section of the IAPP AIGP Body of Knowledge.

To maintain fairness in a deployed system, it is crucial to monitor for data drift that may affect performance and accuracy. Data drift occurs when the statistical properties of the input data change over time, which can lead to a decline in model performance. Continuous monitoring and updating of the model with new data ensure that it remains fair and accurate, adapting to any changes in the data distribution. Reference: AIGP Body of Knowledge on Post-Deployment Monitoring and Model Maintenance.

The White House Executive Order from November 2023 requires companies developing dual-use foundation models to report on their current training or development activities, the results of red-team testing, and the physical and cybersecurity protection measures. However, it does not mandate reports on environmental impact studies for each dual-use foundation model. While environmental considerations are important, they are not specified in this context as a reporting requirement under this Executive Order.

Risk impact estimation occurs in the design phase of the AI life cycle. This step involves evaluatingpotential risks associated with the AI system and estimating their impacts to ensure that appropriate mitigation strategies are in place. It helps in identifying and addressing potential issues early in the design process, ensuring the development of a robust and reliable AI system. Reference: AIGP Body of Knowledge on AI Design and Risk Management.

The correct answer is A because the most immediate governance step when a significant AI issue is identified is to formally log the incident within the organization’s incident management system. AI governance frameworks emphasize structured incident response processes to ensure issues are properly documented, tracked, escalated, and addressed in a controlled manner. Logging the incident triggers established workflows, including investigation, stakeholder notification, and remediation planning. While notifying stakeholders, auditing the system, or retraining the model are important follow-up actions, they should occur after the issue is formally recorded and managed through governance channels. This ensures accountability, traceability, and consistent handling of risks, particularly in cases involving bias and potential discrimination.

The correct answer isB – Proprietary methods. While transparency is important, organizations arenot obligated to disclose proprietary algorithms, methods, or trade secretsin public disclosures.

From the AIGP Body of Knowledge – Transparency & Disclosures:

“AI system users should disclose the purpose, capabilities, limitations, and applicable legal context—but not sensitive IP.”

AI Governance in Practice Report 2025 (Transparency Section) states:

“Disclosure requirements balance public understanding with the need to protect proprietary business interests. Proprietary training methods are not expected to be disclosed.”

Thus, while it’s best practice to disclose theintended purpose, legal compliance, and system limitations,internal proprietary techniquesare usually excluded.

===========

The third-party consultant asked each vendor for information about the diversity of their datasets to assist in ensuring the fairness of the AI system. Diverse datasets help prevent biases and ensure that the AI system performs equitably across different demographic groups. This is crucial for a law enforcement application, where fairness and avoiding discriminatory practices are of paramount importance. Ensuring diversity in training data helps in building a more just and unbiased AI system. Reference: AIGP Body of Knowledge on Ethical AI and Fairness.

The correct answer is C, the Federal Trade Commission. The FTC plays a central role in U.S. AI governance by enforcing consumer protection and unfair or deceptive practices laws. In the context of AI systems such as companion chatbots, the FTC has authority to investigate risks related to user harm, transparency, safety, and misleading claims. AI governance frameworks emphasize regulatory oversight where AI systems may impact individuals psychologically, financially, or socially. Agencies like the FTC focus on ensuring that companies deploying AI systems do not cause harm through unsafe or de ceptive practices and that they provide adequate disclosures about risks and system behavior. This aligns with broader AI governance principles of accountability, transparency, and risk management highlighted in the AI Governance in Practice Report 2024 , which stresses the importance of regulatory involvement in managing AI-related risks.

The correct answer is B because ensuring that training and testing data is representative is the most critical factor in mitigating bias in AI systems. AI governance frameworks emphasize that biased or unrepresentative datasets can lead to discriminatory outcomes, particularly when certain demographic groups are underrepresented or overrepresented. Representative data helps ensure that the model performs fairly and accurately across different populations. While privacy-enhancing tools and consent address legal and ethical data use, they do not directly prevent bias in model outcomes. Similarly, assessing the sufficiency of third-party data focuses on quantity rather than fairness or distribution. Effective bias mitigation begins with evaluating whether the dataset reflects the diversity and characteristics of the real-world population the AI system will impact.

The correct answer isD. Forming adedicated governance committeeensures continuous oversight, role clarity, and accountability throughout the AI lifecycle.

From the AIGP ILT Guide – Governance Structures:

“Organizations using AI in high-impact scenarios should establish a governance body responsible for oversight of risk, compliance, and ethical alignment.”

Also reflected in AI Governance in Practice Report 2025:

“Committees support cross-functional decision-making, provide guidance for updates, and maintain accountability. This is especially critical for high-stakes applications like marketing to diverse audiences.”

Options A, B, and C are valid supplementary actions, butDoffers a long-term and systematic governance mechanism.

The correct answer is B because ISO/IEC 42005 emphasizes integrating AI risk management into existing enterprise risk management frameworks rather than creating siloed or duplicative processes. Effective AI governance requires embedding AI-specific risks into established governance structures such as risk registers, controls, and monitoring systems. This ensures consistency, scalability, and alignment with organizational risk practices. Options C and D introduce parallel or fragmented processes, which contradict the principle of integrated governance and may create inefficiencies or gaps. Option A focuses only on data collection and does not address governance integration. The AI Governance in Practice Report highlights that organizations should incorporate AI risks into broader enterprise risk management and maintain unified risk registers to ensure visibility, accountability, and coordinated mitigation across the organization.

A, D, and E introduce processing materially different from the practices described in the existing privacy policy. Storing chatbot inputs for RAG creates an additional retention and reuse purpose that should be addressed through appropriate privacy disclosures and retention controls. Using customer-session information to retrain the underlying model creates a distinct secondary purpose beyond processing an order, even when the data is subsequently deleted. Scanning a customer ' s appearance to infer frustration or confusion introduces an entirely new category of observation and inference, requiring additional transparency, legal-basis analysis, proportionality assessment, and safeguards. By contrast, B involves transferring customer information to a service provider so the requested service can operate, which the existing policy already permits. C involves ordinary contact and delivery information retained through completion of the transaction, which also fits the stated policy.

The deployer is primarily responsible for operational oversight once an AI system has been placed into use within its organization. This includes monitoring performance, identifying drift or unexpected behavior, following the provider ' s instructions, escalating incidents, and ensuring that the system continues to operate within approved risk tolerances. Under Article 26 of the EU AI Act, deployers of high-risk AI systems are specifically required to monitor system operation based on the instructions for use and to inform the provider and relevant authorities when serious risks or incidents arise. Developers and providers remain responsible for important lifecycle activities such as design, documentation, updates, and technical support, but ongoing monitoring in the actual deployment environment rests principally with the deployer. A regulator provides external oversight, while an ordinary user does not carry organizational lifecycle responsibility.

================

Bias in AI can be reduced during the planning and design phases through stakeholder involvement, human oversight, and careful data collection. While feature selection is critical in the development phase, it does not specifically occur during planning and design. Ensuring diverse stakeholder involvement and human oversight helps identify and mitigate potential biases early, and data collection ensures a representative dataset. Reference: AIGP Body of Knowledge on AI Development Lifecycle and Bias Mitigation.

When assessing whether users should be given the right to opt out from an AI system, the primary considerations are feasibility, risk to users, and industry practice. Feasibility addresses whether the opt-out mechanism can be practically implemented. Risk to users assesses the potential harm or benefits users might face if they cannot opt out. Industry practice considers the norms and standards within the industry. However, the cost of alternative mechanisms, while important in the broader context of implementation, is not directly relevant to the ethical consideration of whether users should have the right to opt out. The focus should be on protecting user rights and ensuring ethical AI practices.

The potential negative consequences of using an AI tool in hiring include reputational harm (A), civil rights violations (B), and discriminatory treatment (C). These issues stem from biases in the AI system or its misuse, which can lead to unfair hiring practices and legal liabilities. Intellectual property infringement (D) is not a typical consequence of using AI in hiring, as it relates to the unauthorized use of protected intellectual property, which is not directly relevant to the hiring process or the potential biases within AI tools​​​​.

The EU AI Act outlines specific penalties and enforcement mechanisms to ensure compliance with its regulations. Among these, fines for violations of banned AI applications can be as high as €35 million or 7% of the global annual turnover of the offending organization, whichever is higher. Proportional caps on fines are applied to SMEs and startups to ensure fairness. General Purpose AI rules are to apply after a 6-month period as a specific provision to ensure that stakeholders have adequate time to comply. However, there is no provision for an " AI Pact " acting as a transitional bridge until the regulations are fully enacted, making option C the correct answer.

The TAKE IT DOWN Act, Public Law 119-12, criminalizes certain intentional disclosures of authentic and AI-generated nonconsensual intimate imagery. Offenses involving minors can carry imprisonment of up to three years, supporting A. Covered platforms must establish a notice-and-removal process and receive liability protection when they disable or remove reported material in good faith, supporting E. Violations of the platform requirements are enforceable by the FTC and can trigger substantial civil penalties, supporting D conceptually. The video ' s approximately $51,000 figure reflects the civil-penalty level used in supporting governance materials; current FTC guidance lists a higher inflation-adjusted maximum of $53,088 per violation. B is clearly incorrect because the statutory removal deadline is 48 hours , not 30 days. C is not itself a specified statutory penalty.

================

Biasis a common risk acrossboth proprietary and open-source models, andnot uniqueto proprietary deployments. All AI systems — regardless of origin — require evaluation for fairness, accuracy, and representativeness.

From theAI Governance in Practice Report 2025:

“Bias, discrimination and fairness challenges are present in both open and closed models, regardless of how the model is sourced.” (p. 41)

Autoregression is not a common optimization technique in deep learning to determine weights for artificial neurons. Common techniques include gradient descent, momentum, and backpropagation. Autoregression is more commonly associated with time-series analysis and forecasting rather than neural network optimization. Reference: AIGP BODY OF KNOWLEDGE, which discusses common optimization techniques used in deep learning​​.

The correct answer isB. AllowingPIIto be freely entered into prompts without safeguards is considered amajor privacy and security riskand is not a responsible governance practice.

From the AIGP ILT Guide – Generative AI & Third-Party Risk Management:

“Use of personal or sensitive information in AI prompts can result in unintended exposure, regulatory breaches, and downstream liability.”

The AI Governance in Practice Report 2025 highlights:

“PII should be minimized or protected by design. Prompt engineering should prevent entry of personally identifiable data unless legally and technically safeguarded.”

A, C, and D are established best practices under responsible AI procurement and use.

===========