AIGP Artificial Intelligence Governance Professional Questions and Answers

The correct answer is A because of the fundamental bias-variance tradeoff in machine learning. When model complexity is reduced, the model becomes simpler and less flexible, which decreases variance because it is less sensitive to fluctuations in the training data. However, this simplification comes at the cost of increased bias, meaning the model may oversimplify relationships and fail to capture underlying patterns accurately. This tradeoff is a core concept in AI fundamentals and directly impacts model performance, reliability, and governance decisions. From an AI governance perspective, understanding this balance is critical when evaluating model risk, as high bias can lead to systematic errors and fairness issues, while high variance can result in instability and unpredictability in outputs. Proper model tuning aims to balance both for optimal and responsible performance.

The U.S. mortgage company ' s AI platform relates to housing and credit, making the Fair Housing Act (A), Fair Credit Reporting Act (B), and Equal Credit Opportunity Act (C) relevant. Title VII of the Civil Rights Act of 1964 deals with employment discrimination and is not directly relevant to the mortgage application context (D).

In the selection and implementation of the AI hiring tool, involving Finance and Legal is crucial. The Finance team is essential for assessing cost implications, budget considerations, and financial risks. The Legal team is necessary to ensure compliance with applicable laws and regulations, including those related to data privacy, employment, and anti-discrimination. Involving these stakeholders ensures a comprehensive evaluation of both the financial viability and legal compliance of the AI tool, mitigating potential risks and aligning with organizational objectives and regulatory requirements.

The OECD ' s Ethical AI Governance Framework aims to ensure that AI development and deployment are carried out ethically while fostering innovation. The framework includes principles like transparency, accountability, and human rights protections to prevent societal harm. It does not focus solely on technical design or post-deployment monitoring (C), nor does it establish industry-specific requirements (B). While explainability is important, the primary goal is to balance innovation with ethical considerations (D).

The potential negative consequences of using an AI tool in hiring include reputational harm (A), civil rights violations (B), and discriminatory treatment (C). These issues stem from biases in the AI system or its misuse, which can lead to unfair hiring practices and legal liabilities. Intellectual property infringement (D) is not a typical consequence of using AI in hiring, as it relates to the unauthorized use of protected intellectual property, which is not directly relevant to the hiring process or the potential biases within AI tools​​​​.

A multi-modal model is an AI system that can process and analyze multiple types of data, such as text, video, images, and sound. This type of AI integrates different data sources to enhance its understanding and decision-making capabilities. In the given scenario, the AI technology that tags content including names of animals, humans, and objects falls under this category. Reference: AIGP BODY OF KNOWLEDGE, which outlines the capabilities and use cases of multi-modal models​​.

The NIST AI Risk Management Framework’s Govern function emphasizes the importance of establishing accountability structures that empower and train cross-functional teams. This is crucial because cross-functional teams bring diverse perspectives and expertise, which are essential for effective AI governance and risk management. Training these teams ensures that they are well-equipped to handle their responsibilities and can make informed decisions that align with the organization’s AI principles and ethical standards. Reference: NIST AI Risk Management Framework documentation, Govern function section.

The correct answer is C because simply publishing a general AI policy or code of conduct does not satisfy specific transparency obligations required by AI regulations. Transparency requirements focus on providing clear, context-specific disclosures to affected individuals about how AI is being used, particularly when it directly impacts them. For example, notifying users when they are interacting with an AI system or labeling AI-generated content are explicit transparency measures aligned with regulatory expectations. The AI Governance in Practice Report highlights that transparency includes informing users when they interact with AI systems and providing meaningful information about outputs and system behavior . Model cards and labels support system-level and output-level transparency, while real-time notices ensure user awareness. In contrast, a general policy link lacks immediacy, specificity, and user relevance, making it insufficient for mandatory transparency compliance.

The correct answer isD. Forming adedicated governance committeeensures continuous oversight, role clarity, and accountability throughout the AI lifecycle.

From the AIGP ILT Guide – Governance Structures:

“Organizations using AI in high-impact scenarios should establish a governance body responsible for oversight of risk, compliance, and ethical alignment.”

Also reflected in AI Governance in Practice Report 2025:

“Committees support cross-functional decision-making, provide guidance for updates, and maintain accountability. This is especially critical for high-stakes applications like marketing to diverse audiences.”

Options A, B, and C are valid supplementary actions, butDoffers a long-term and systematic governance mechanism.

Genetic and health information are special categories of personal data under Article 9 of the GDPR, for which processing is generally prohibited unless a valid Article 9 exception applies. Among the available answers, explicit consent provides the clearest applicable condition: Article 9(2)(a) permits processing where the data subject has explicitly consented to processing for specified purposes. Importantly, explicit consent is not the only possible legal condition under the GDPR; scientific research and healthcare processing may sometimes rely on other Article 9 conditions where applicable law and safeguards permit. However, A merely describing a preventive-medicine purpose does not itself establish the necessary legal condition. D is irrelevant because EU establishment and non-cloud processing do not establish lawfulness. B would materially change the analysis only if the data were genuinely anonymized so that they were no longer personal data.

================

Under the EU AI Act, a deployer is a natural or legal person, public authority, agency, or other body that uses an AI system under its authority, except where the system is used in a personal, non-professional activity. The consulting firm is using an existing AI system to support its employees and is therefore acting as a deployer. It is not a provider because the scenario does not state that the firm develops the AI system, has it developed, or places it on the market under its own name or trademark. It is not a distributor because it is not making the system available in the supply chain. An authorized representative acts on behalf of a provider established outside the EU. Consequently, D correctly describes the firm ' s role.

================

The correct answer is D because AI impact assessments primarily focus on risks to individuals, society, and legal compliance, such as privacy, fairness, and potential harm. Core elements typically include evaluating the impact on privacy rights, identifying data sources and their lawfulness, and assessing potential bias or discriminatory outcomes. These factors are directly tied to regulatory expectations and ethical AI governance principles. While environmental considerations like energy consumption are increasingly discussed in broader AI sustainability conversations, they are not standard or required components of most AI impact assessments, especially for narrow use cases. AI governance frameworks prioritize human-centric risks, ensuring systems are lawful, fair, and safe, rather than focusing on operational metrics like energy usage in typical assessment processes.

The EU AI Act outlines what must be included intechnical documentationfor high-risk systems. These requirements are designed to supportconformity assessment, transparency, and traceability.

From theAI Governance in Practice Report 2025:

“It mandates drawing up technical documentation… must include a general description of the AI system, the intended purpose, and a detailed description of the elements and development process.” (p. 34)

“Documentation… includes training, testing, evaluation procedures, andappropriateness of performance metrics.” (p. 34–35)

Therisk management systemis addressed separately through arisk management plan, not within the technical documentation itself.

Thus:

A, C, and Dare explicitly required in thetechnical documentation.

B, while important, is part of therisk management process, not a required section oftechnical documentation.

The correct answer is C because it follows a structured, risk-based AI governance approach aligned with best practices and regulatory expectations. AI governance frameworks emphasize identifying and assessing risks through probability and severity analysis before deployment. This allows organizations to prioritize the most critical risks, such as bias and discrimination in loan approvals. Applying a risk mitigation hierarchy ensures that controls are implemented proactively rather than reactively. Only after risks are assessed and mitigated should pilot testing occur to validate system performance in a controlled environment. Other options either delay risk assessment until after deployment or focus on limited aspects like benchmarking or explainability without addressing core risk management principles. A proactive, risk-first approach is essential for compliance, fairness, and responsible AI deployment.

A, B, and E are the intended privacy-preserving choices. Data minimization limits processing to information that is adequate, relevant, and necessary for the defined purpose, reducing privacy exposure during AI development. Anonymization protects individuals by transforming information so that people are no longer identifiable under the applicable standard. Federated learning is a recognized privacy-enhancing technology that enables models to be trained across distributed datasets without centrally sharing the underlying raw training data. The ICO specifically identifies federated learning and related privacy-preserving methods as useful during AI training and explains the relationship between anonymization and data minimization. Data mapping is primarily a governance and inventory activity used to understand data flows, while data cleansing principally improves data quality by correcting or removing inaccurate, incomplete, or unsuitable records; neither is inherently a PET.

C is the correct statement, subject to the statutory thresholds. Article 36 of South Korea ' s AI Basic Act requires an AI business operator without an address or business office in Korea to designate a domestic representative when it meets prescribed criteria concerning users, revenue, or other specified conditions. The implementing decree establishes those thresholds, including qualifying revenue and Korean-user levels. The Act also applies extraterritorially where conduct outside Korea affects the Korean market or users. Generative AI is not categorically excluded, eliminating B. The Korean framework does not simply reproduce the EU AI Act ' s prohibited-practices regime described in D, and " frontier models " are not established as the distinct regulatory category suggested by A. Therefore, domestic-representative requirements make C the best answer.

================

The failures in semi-autonomous vehicles due to sensors misinterpreting environmental surroundings, such as sunlight, are examples of brittleness. Brittleness in AI systems refers to their inability to handle variations in input data or unexpected conditions, leading to failures when the system encounters situations that were not adequately covered during training. These systems perform well under specific conditions but fail when those conditions change. Reference: AIGP Body of Knowledge on AI System Robustness and Failures.

The correct answer isA. Sending ads to construction companies (business entities) rather than individual workers isa business targeting decision, not inherently a biased AI output.

From the AIGP ILT Participant Guide – Bias & Fairness Module:

“Biased outputs often include stereotyping, exclusion of underrepresented groups, or reinforcing harmful societal assumptions.”

Examples likeinsufficient representation of minority groupsorgender-stereotyping in visuals or languageare typical manifestations of bias.

AI Governance in Practice Report 2025 also notes:

“Bias in generative models may manifest in representation gaps, stereotyping, or unequal performance across demographic groups.”

Option A, by contrast, describes adistribution strategy, not a bias generated by the AI model.

===========

The EU AI Act categorizes certain applications of AI as high-risk due to their potential impact on fundamental rights and safety. High-risk applications include those used in critical areas such as employment, education, and essential public services. A government-run social scoring tool, which assesses individuals based on their social behavior or perceived trustworthiness, falls under this category because of its profound implications for privacy, fairness, and individual rights. This contrasts with other AI applications like resume scanning tools or customer service chatbots, which are generally not classified as high-risk under the EU AI Act.

Training an AI model is time-consuming primarily due tomodel complexity,large data volumes, and the need forhigh-quality, well-prepared data.

From theAI Governance in Practice Report 2025:

“Most AI requires sizeable amounts of high-quality data… to ensure desired and accurate output.” (p. 15)

“The accuracy of AI model outputs depends significantly on the quality of their inputs.” (p. 24)

“Complex AI systems… with many parameters… result in long development and training phases.” (p. 32)

B. Maturity of governanceaffects oversight, not training time.

D. Number of stakeholdersaffects alignment, not direct training duration.

The greatest risk from AI systems generatingrealistic synthetic mediaisdownstream harm, such asdeepfakes, misinformation, reputational damage, and erosion of trust.

From theAI Governance in Practice Report 2025:

“With generative AI, downstream harms such as deception, reputational damage, misinformation, and manipulation can emerge even if original use was lawful.” (p. 55–56)

The correct answer is A because the first step in any AI project lifecycle is to clearly define the business objective and justify the use of AI. AI governance frameworks emphasize that planning begins with understanding the purpose, value, and necessity of the system before moving into design or risk assessment stages. Establishing a business case ensures alignment with organizational goals, identifies expected benefits, and evaluates whether AI is the appropriate solution. This step corresponds to the planning phase of the AI lifecycle, where objectives and intended outcomes are documented. In contrast, TEVV processes occur during development and testing, while impact assessments and redress consid erations arise later as part of risk management and governance. Starting with a clear “why AI” foundation ensures responsible, efficient, and goal-oriented system development.

To protect the company ' s intellectual property, the most pertinent contractual provision is ensuring that the AI provider will defend and indemnify the company against infringement claims. This clause means the provider will take responsibility for any intellectual property disputes that arise, thereby safeguarding the company from potential legal and financial repercussions related to the use of the tool. Other options, while beneficial, do not directly address the protection of intellectual property. This concept is detailed in the contractual best practices section of the IAPP AIGP Body of Knowledge.

When notifying an accused perpetrator, the police officer should provide information about how the individual was identified by the AI system. This transparency is crucial for maintaining trust and ensuring that the accused understands the basis of the charges against them. Information about the accuracy, how to oppose the charges, and the composition of the training data, while potentially relevant, do not directly address the immediate need for the accused to understand the specific process that led to their identification. Reference: AIGP Body of Knowledge on AI Transparency and Explainability.

The third-party consultant asked each vendor for information about the diversity of their datasets to assist in ensuring the fairness of the AI system. Diverse datasets help prevent biases and ensure that the AI system performs equitably across different demographic groups. This is crucial for a law enforcement application, where fairness and avoiding discriminatory practices are of paramount importance. Ensuring diversity in training data helps in building a more just and unbiased AI system. Reference: AIGP Body of Knowledge on Ethical AI and Fairness.

GPUs (Graphical Processing Units) are well-suited to running AI applications due to their ability to run many tasks concurrently, which significantly enhances processing speed. This parallel processing capability makes GPUs ideal for handling the large-scale computations required in AI and deep learning tasks. Reference: AIGP BODY OF KNOWLEDGE, which explains the importance of compute infrastructure in AI applications​​.

The correct answer isA. TheARIA programby NIST is explicitly designed tosupport stakeholders in understanding and managing the risks and impactsof AI systems.

From the AIGP ILT Guide – U.S. Risk Frameworks Module:

“NIST’s ARIA program develops and pilots assessment tools for AI risks and impacts, aimed at improving organizational capacity for responsible AI use.”

Also cited in the AI Governance in Practice Report 2025 (Frameworks Section):

“ARIA supports and aligns with the AI Risk Management Framework by helping organizations assess AI harms, safety concerns, and societal implications.”

ARIA isnota red-teaming or sandbox program—it’s anassessment and governance resource.

===========

The GDPR ' s transparency principle requires that when personal data is processed for automated decision-making, including profiling, data subjects must be informed about the existence of such automated decision-making. Additionally, they must be provided with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for them. This requirement ensures that data subjects are fully aware of how their personal data is being used and the potential impacts, thereby promoting transparency and trust in the processing activities.

The correct answer isA. Pre- and post-deployment testing ensuresbias, accuracy, and fairnessare evaluated and corrected as needed, which isessential for reputational risk mitigation.

From the AIGP Body of Knowledge:

“Testing AI systems before and after deployment is critical to ensure performance, fairness, and compliance. Failing to do so may result in reputational damage and legal exposure.”

AI Governance in Practice Report 2025 (Bias/Fairness and Risk Sections):

“System impact assessments, testing, and post-deployment monitoring are necessary to identify and mitigate risks… This supports both compliance and public trust.”

Testing is proactive, unlike indemnification (which transfers risk after damage), or requiring manual review (which defeats automation).

In the context of AI, particularly generative models, " hallucination " refers to the generation of outputs that are not based on the training data and are factually incorrect or non-existent. The scenario described involves the generative AI tool providing incorrect and non-existent information about restaurants, which fits the definition of hallucination. Reference: AIGP BODY OF KNOWLEDGE and various AI literature discussing the limitations and challenges of generative AI models.

AI models are intrinsically dependent on the data used to train, validate, and test them. NIST specifically identifies AI ' s inherent dependence on training data and links model reliability to data quality and representativeness. Therefore, A is correct. Training-data characteristics—including modality, structure, features, quantity, and complexity—also influence the appropriate model design and architecture, supporting D. E is correct because biases, gaps, nonrepresentative samples, and other limitations in training data can become embedded in model behavior and subsequently affect outputs. Privacy-enhancing technologies may reduce privacy risks, but they do not define data dependency, eliminating B. Likewise, improving dataset size and quality can improve performance but does not remove the model ' s fundamental dependence on data, so C is incorrect.

================

Testing data is a subset of data used to provide a robust evaluation of a final model. After training the model on training data, it is essential to test its performance on unseen data (testing data) to ensure it generalizes well to new, real-world scenarios. This step helps in assessing the model ' s accuracy, reliability, and ability to handle various data inputs. Reference: AIGP Body of Knowledge on Model Validation and Testing.

An AI system that maintains its level of performance within defined acceptable limits despite real-world or adversarial conditions is described as resilient. Resilience in AI refers to the system ' s ability to withstand and recover from unexpected challenges, such as cyber-attacks, hardware failures, or unusual input data. This characteristic ensures that the AI system can continue to function effectively and reliably in various conditions, maintaining performance and integrity. Robustness, on the other hand, focuses on the system ' s strength against errors, while reliability ensures consistent performance over time. Resilience combines these aspects with the capacity to adapt and recover.

The correct answer is D, model disgorgement. This technique refers to removing or eliminating the influence of improperly obtained, biased, or unlawfully used data from a trained machine learning model. It is increasingly discussed in AI governance and regulatory enforcement, particularly where models have been trained on data collected without proper consent or in violation of legal requirements. Instead of merely cleaning datasets, model disgorgement may require retraining or discarding the model entirely to ensure that problematic data no longer influences outputs. This aligns with accountability and compliance principles in AI governance, where organizations must ensure lawful data use throughout the AI lifecycle. Other options like data cleansing and de-duplication address data quality but do not fully remove learned patterns already embedded in trained models.

Third-party risk management for AI systems should beproportional and risk-based, involvinginitial due diligenceandongoing monitoringthat reflects thelevel of risk posedby the third party ' s AI system.

From theAI Governance in Practice Report 2025:

“Third-party due diligence assessments to identify possible external risk and inform selection.” (p. 11)

“Legal due diligence may include verification of the personal data ' s lawful collection by the data broker, review of contractual obligations…” (p. 19)

Afocuses too narrowly on financial stability.

Cis excessive and not scalable or aligned with best practices.

Dinappropriately separates ethical and technical risks; both must be evaluated holistically.

Post-deployment AI maintenance typically includes ensuring that all model components are subject to a control framework, dedicating experts to continually monitor the model output, and evaluating the need for audits under certain standards. However, defining thresholds to conduct new impact assessments is usually part of the initial deployment and ongoing governance processes rather than a maintenance activity. Maintenance focuses more on the operational aspects of the AI system rather than setting new thresholds for impact assessments.

The best reason for GVC to offer students the choice to utilize generative AI in limited, defined circumstances is to enable students to learn how to use AI as a supportive educational tool. By integrating AI in a controlled manner, students can learn the practical applications of AI and develop skills to use AI responsibly and effectively in their educational pursuits.

When an AI system causessignificant false positives, especially in sensitive contexts likefraud detection, the priority is tohalt harmful activityand perform a full assessment. Continued use without understanding the fault may cause furthercustomer harmand legal exposure.

From theAI Governance in Practice Report 2025:

“Incident management plans should enable identification, escalation, and system rollback to prevent continued harm from malfunctioning AI systems.” (p. 12, 35)

Conformity assessmentsare a core requirement under theEU AI Actfor high-risk systems and serve to confirm that the AI meetsregulatory, safety, and ethical standardsbefore it is put into production.

From theAI Governance in Practice Report 2025:

“Conformity assessments… ensure that systems comply with legal requirements, safety criteria, and intended purpose before being placed on the market.” (p. 34)

“They are a critical step to demonstrate safety and trustworthiness in AI deployment.” (p. 35)

Ensuring fairness when training an AI system largely depends on the data attributes and variability. This involves having a diverse and representative dataset that accurately reflects the population the AI system will serve. Fairness can be compromised if the data is biased or lacks variability, as the model may learn and perpetuate these biases. Diverse data attributes ensure that the model learns from a wide range of examples, reducing the risk of biased predictions. Reference: AIGP Body of Knowledge on Ethical AI Principles and Data Management.

The White House Executive Order of November 2023 designates the National Institute of Standards and Technology (NIST) as the responsible body for creating guidelines to conduct red-teaming tests of AI systems. NIST is tasked with developing and providing standards and frameworks to ensure the security, reliability, and ethical deployment of AI systems, including conducting rigorous red-teaming exercises to identify vulnerabilities and assess risks in AI systems.

The White House Executive Order from November 2023 requires companies developing dual-use foundation models to report on their current training or development activities, the results of red-team testing, and the physical and cybersecurity protection measures. However, it does not mandate reports on environmental impact studies for each dual-use foundation model. While environmental considerations are important, they are not specified in this context as a reporting requirement under this Executive Order.

The IEEE Ethical System Design Risk Management Framework (IEEE 7000-21) would be most appropriate for XYZ Corp ' s governance needs in addition to the NIST AI Risk Management Framework. The IEEE framework specifically addresses ethical concerns during system design, which is crucial for ensuring the responsible use of AI in hiring. It complements the NIST framework by focusing on ethical risk management, aligning well with XYZ Corp ' s goals of deploying AI responsibly and mitigating associated risks​​​​.

The Singapore Model AI Governance Framework recommends several measures to promote the responsible use of AI, such as determining the level of human involvement in decision-making, adapting governance structures, and establishing communications and collaboration among stakeholders. However, employing human-over-the-loop protocols is not specifically mentioned in this framework. The focus is more on integrating human oversight appropriately within the decision-making process rather than exclusively employing such protocols. Reference: AIGP Body of Knowledge, section on AI governance frameworks.

The correct answer isD. AI Impact Assessments are primarily used to identify and managerisks and harmsassociated with AI systems.

From the AIGP Body of Knowledge:

“The goal of an AI impact assessment is to ensure that risks are identified, evaluated, and mitigated prior to or during development and deployment.”

As further confirmed in the AI Governance in Practice Report 2025 (Part III):

“Risk-based tools like DPIAs and Algorithmic Impact Assessments help identify potential risks to individuals and society, enabling organizations to implement mitigation plans and safeguards.”

While benefits may be noted in such assessments, thecore objectiveis to manage risks andpromote responsible AI.

===========

The White House Blueprint for an AI Bill of Rights focuses on protecting civil rights, privacy, and ensuring AI systems are safe and effective. It includes principles like data privacy (D), human alternatives (A), and safe and effective systems (C). However, it does not specifically address high-risk mitigation standards as a distinct category (B).

The EU AI Act imposes severalmandatory obligationson high-risk AI systems, butpublishing a detailed report on training dataisnotone of them.

From theAI Governance in Practice Report 2025:

“It mandates drawing up technical documentation for high-risk AI systems, and requires high-risk AI systems to come with instructions for use that disclose various information, including characteristics, capabilities and performance limitations.” (p. 34)

“To make high-risk AI systems more traceable, it also requires AI systems to be able to automatically allow for the maintenance of logs throughout the AI life cycle.”

“Conducting post-market monitoring” and “conformity assessments” areexplicitrequirements for high-risk systems. (p. 34–35)

However,publishingdetailed training data is typicallyrequired only for general-purpose AI systems with systemic risk, not standard high-risk AI systems.

A. Log retention,B. Post-market monitoring, andC. Conformity assessmentsareall requiredunder the EU AI Act for high-risk systems.

A privacy impact assessment (PIA) can be effectively leveraged to create an AI impact assessment. A PIA evaluates the potential privacy risks associated with the use of personal data and helps in implementing measures to mitigate those risks. Since AI systems often involve processing large amounts of personal data, the principles and methodologies of a PIA are highly applicable and can be extended to assess broader impacts, including ethical, social, and legal implications of AI. Reference: AIGP Body of Knowledge on Impact Assessments.

Anonymization is a privacy-enhancing technique that involves removing or permanently altering personal data elements to prevent the identification of individuals. In this case, the company obfuscated all personal data elements before training the model, which aligns with the definition of anonymization. This ensures that the data cannot be traced back to individuals, thereby protecting their privacy while still allowing the company to derive value from the dataset. Reference: AIGP Body of Knowledge, privacy-enhancing techniques section.

Opacity creates a governance problem because stakeholders may be unable to understand, trace, or adequately explain how an AI system arrived at a particular output. This weakens accountability, effective human oversight, auditing, contestability, and risk management. NIST ' s AI Risk Management Framework connects trustworthy AI with transparency, accountability, explainability, and interpretability, including documenting how systems operate and how outputs are interpreted. Option A incorrectly equates opacity with autonomous operation; an opaque system can still involve humans. Option B concerns regulatory access and intellectual-property issues rather than the fundamental governance problem created by opacity. Option D is also too absolute: lack of interpretability does not automatically make a model unreliable. Therefore, the principal concern is difficulty tracing and justifying outputs, making C the best answer.

================

When anew versionof a third-party model is released, the deployer must ensure it still meets safety, performance, and compliance requirements — which calls for aformal audit.

From theAI Governance in Practice Report 2025:

“Any updates or changes to AI systems should trigger a re-evaluation to ensure continued compliance and performance.” (p. 12)

“Post-market monitoring includes reassessing the impact of updated models or retraining.” (p. 35)

Paid public generative AI services can be attractive because organizations can adopt them rapidly without developing and maintaining foundational models themselves. Commercial offerings may also provide organizational privacy, security, access-management, and administrative controls beyond those available through basic public access, while centrally managed services can receive frequent provider-driven feature enhancements. These characteristics support A, B, and C. However, payment does not guarantee transparency into proprietary model architecture, training data, weights, or decision processes, so D is incorrect. Nor does a paid service eliminate concerns regarding training-data provenance, intellectual property, personal information, confidential prompts, data retention, or generated outputs; consequently, E is incorrect. AI governance still requires vendor due diligence, contractual safeguards, acceptable-use controls, security assessment, and continuing monitoring when organizations depend on third-party generative AI services.

================

The correct answer is D because conformity requirements are primarily intended to ensure that AI systems meet applicable legal, regulatory, and safety standards before deployment. AI governance frameworks, including the EU AI Act and international standards, require conformity assessments to verify that systems are safe, reliable, and compliant with risk management, documentation, and performance obligations. These assessments help identify and mitigate risks prior to market release, particularly for high-risk AI systems that may impact individuals’ rights, health, or safety. Conformity ensures accountability, transparency, and trustworthiness, which are central principles of responsible AI governance. The other options relate to usability or technical considerations, but they do not address the primary purpose of conformity assessments, which is regulatory compliance and risk mitigation prior to deployment.

The most challenging aspect of managing a data access request in this scenario is dealing with unstructured data that cannot be easily disentangled from other data, including information about other individuals. Unstructured data, such as free-text inputs or social media posts, often lacks a clear structure and may be intermingled with data from multiple individuals, making it difficult to isolate the specific data related to the requester. This complexity poses significant challenges in complying with data access requests under privacy laws. Reference: AIGP Body of Knowledge on Data Subject Rights and Data Management.

The EU AI Act outlines specific penalties and enforcement mechanisms to ensure compliance with its regulations. Among these, fines for violations of banned AI applications can be as high as €35 million or 7% of the global annual turnover of the offending organization, whichever is higher. Proportional caps on fines are applied to SMEs and startups to ensure fairness. General Purpose AI rules are to apply after a 6-month period as a specific provision to ensure that stakeholders have adequate time to comply. However, there is no provision for an " AI Pact " acting as a transitional bridge until the regulations are fully enacted, making option C the correct answer.

Importers of high-risk AI systems into the EU havespecific responsibilitiesunder the EU AI Act. They arenotthe parties responsible for affixing the CE marking or providing technical documentation—but they must verify that these have been done by the provider.

From theAI Governance in Practice Report 2025:

“Importers must verify that the appropriate conformity assessment has been carried out, the technical documentation is available, and the CE marking has been affixed.” (p. 34–35)

Thus:

A. Provide technical documentation– done by theprovider.

B. Affix the CE marking–provider ' sresponsibility.

C. Verify the Declaration of Conformity–importer obligation.

D. Conduct a DPIA– relevant under data protection laws,not requiredunder the EU AI Act forimporters.

The correct answer is Explainable Ai because it specifically refers to the ability of a system to describe the logic behind its decisions or output in a way that is understandable to humans. This is a key part of regulatory and ethical frameworks and is directly related to addressing the black-box problem in AI.

From the AIGP ILT Participant Guide (Module on Transparency and Explainability):

“Explainability refers to the understanding of how a black-box model works. The black-box problem exists because some models are too complex for human interpretation. Explainability methods aim to provide meaningful insight into the logic and decision-making of AI systems.”

Also, according to the AI Governance in Practice Report 2025:

“Explainability refers to the representation of the underlying mechanisms of the AI system’s operation... a key tenet of AI governance due to the desire to understand how AI systems are built, managed and maintained.”

Thus, while Trustworthy and Responsible AI are broader concepts,explainabilityspecifically targets the regulatory concern about understanding outputs.

===========

Software-as-a-Service accessed through an API is the most practical deployment approach for a small organization with limited IT infrastructure and budget. SaaS allows the company to consume a provider-managed application without purchasing and maintaining the substantial computing infrastructure normally needed for modern generative AI. Under NIST ' s cloud-computing model, SaaS consumers use provider applications while the provider manages the underlying network, servers, operating systems, storage, and much of the supporting infrastructure. This makes implementation comparatively rapid and scalable. Running the model on the existing on-premises server could require hardware upgrades and specialized maintenance. A private-cloud deployment introduces additional infrastructure and administrative complexity. Edge deployment on customers ' devices would also create substantial technical and compatibility challenges. Therefore, considering the company ' s resources and desired speed of deployment, C is the strongest option.

================

The correct answer is C because understanding algorithmic methodology is primarily a design, development, and model evaluation activity rather than part of a deactivation or sunset risk strategy. A deactivating risk strategy focuses on safely retiring or discontinuing an AI system, ensuring that operational, legal, and business risks are properly managed. This includes evaluating regulatory requirements such as data retention and deletion obligations, assessing business continuity and financial implications, and understanding dependencies with upstream and downstream systems to avoid disruption. These steps ensure a controlled and compliant system shutdown. In contrast, analyzing algorithmic methodology is relevant during system development, validation, and explainability efforts, not during the decommissioning phase of the AI lifecycle.

The correct answer is B because continuous monitoring is a core component of AI governance that ensures systems remain effective, reliable, and aligned with their intended objectives over time. AI systems can degrade due to data drift, model drift, or changing real-world conditions, making ongoing performance tracking essential. Monitoring allows organizations to detect anomalies, biases, or performance issues and take corrective actions such as retraining or recalibration. Governance frameworks emphasize post-deployment oversight to ensure systems continue to operate safely and within acceptable risk thresholds. Option A incorrectly suggests fully autonomous evolution without oversight, which contradicts governance principles. Options C and D address specific operational concerns but do not capture the primary purpose of continuous monitoring, which is maintaining performance, accountability, and alignment with defined goals.

The most comprehensive way to identify a full range of risks — legal, ethical, operational, and societal — for a new AI model is through aformal impact assessment, such as aData Protection Impact Assessment (DPIA)orAlgorithmic Impact Assessment.

From theAI Governance in Practice Report 2025:

“Risk-based approaches are often distilled into organizational risk management efforts, which put impact assessments at the heart of deciding whether harm can be reduced.” (p. 29)

“DPIAs… help organizations identify, analyze and minimize data-related risks and demonstrate accountability.” (p. 30)

A. Environmental scanis too general.

B. Red teamingis useful for adversarial risk but not broad.

C. Integration testingfocuses on technical/system compatibility, not overall risk.