Free and Premium IAPP AIGP Dumps Questions Answers

Testing results need to bedocumented thoroughlyto ensuretraceability, accountability, and compliance. This is central to enabling audits, investigations, or regulatory inquiries into the system’s development and performance.

From theAI Governance in Practice Report 2025:

“Documentation and recordkeeping are essential components… to demonstrate AI system compliance, trace system behavior, and support audits and conformity assessments.” (p. 34–35)

“Maintaining audit trails across development and deployment enables transparency and accountability.” (p. 12)

AandBare benefits, but not theprimary governance justification.

D– Limiting future testing is not a recommended goal.

When monitoring the functional performance of a model deployed into production, concerns typically include feature drift, model drift, and data loss. Feature drift refers to changes in the input features that can affect the model ' s predictions. Model drift is when the model ' s performance degrades over time due to changes in the data or environment. Data loss can impact the accuracy and reliability of the model. However, system cost, while important for budgeting and financial planning, is not a direct concern when monitoring the functional performance of a deployed model. Reference: AIGP Body of Knowledge on Model Monitoring and Maintenance.

Under the EU regulations, particularly the GDPR, banks using AI for decision-making must inform users about the use of AI and provide mechanisms for users to contest decisions. This is part of ensuring transparency and accountability in automated processing. Explicit consent under the privacy directive (A) and disclosing under the Digital Services Act (B) are not specifically required in this context. An adequacy decision is related to data transfers outside the EU (C).

Model disgorgement is the technique used to remove the effects of improperly used data from an ML system. This process involves retraining or adjusting the model to eliminate any biases or inaccuracies introduced by the inappropriate data. It ensures that the model ' s outputs are not influenced by data that was not meant to be used or was used incorrectly. Reference: AIGP Body of Knowledge on Data Management and Model Integrity.

The correct answer isB – Proprietary methods. While transparency is important, organizations arenot obligated to disclose proprietary algorithms, methods, or trade secretsin public disclosures.

From the AIGP Body of Knowledge – Transparency & Disclosures:

“AI system users should disclose the purpose, capabilities, limitations, and applicable legal context—but not sensitive IP.”

AI Governance in Practice Report 2025 (Transparency Section) states:

“Disclosure requirements balance public understanding with the need to protect proprietary business interests. Proprietary training methods are not expected to be disclosed.”

Thus, while it’s best practice to disclose theintended purpose, legal compliance, and system limitations,internal proprietary techniquesare usually excluded.

===========

The correct answer is B because one of the primary advantages of cloud-based AI deployment is its ability to easily scale resources up or down based on demand. Cloud platforms provide elastic infrastructure, allowing organizations to dynamically allocate compute power, storage, and processing capacity as needed. This is especially important for AI systems that experience fluctuating workloads, such as peak inference requests or large-scale model training. While cloud deployment can improve accessibility and efficiency, it does not inherently reduce latency compared to edge deployments, nor does it automatically enhance privacy or transparency. In AI governance, scalability is a key operational benefit that supports performance monitoring, cost efficiency, and responsiveness, enabling organizations to manage AI systems effectively across different environments and usage levels.

According to the EU AI Act, providers of high-risk AI systems are required to register with an EU oversight agency before these systems can be placed on the market. This requirement is part of the Act ' s framework to ensure that high-risk AI systems comply with stringent safety, transparency, and accountability standards. High-risk systems are those that pose significant risks to health, safety, or fundamental rights. Registration with oversight agencies helps facilitate ongoing monitoring and enforcement of compliance with the Act ' s provisions. Systems categorized under other criteria, such as those trained on sensitive personal data or exhibiting " strong " general intelligence, also fall under scrutiny but are primarily covered under different regulatory requirements or classifications.

The GDPR ' s transparency principle requires that when personal data is processed for automated decision-making, including profiling, data subjects must be informed about the existence of such automated decision-making. Additionally, they must be provided with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for them. This requirement ensures that data subjects are fully aware of how their personal data is being used and the potential impacts, thereby promoting transparency and trust in the processing activities.

Data aggregators are third parties that collect and license data from various sources. They are responsible for ensuring thelawful collectionandproper usage rightsof the data they distribute — especially when such data is used to train foundational AI models.

From theAI Governance in Practice Report 2025:

“As organizations have neither proximity to how third-party data was first collected nor direct control over the data governance practices of third parties, an organization can benefit from carrying out its own legal due diligence and third-party risk management.” (p. 19)

“Legal due diligence may include verification of the personal data ' s lawful collection by the databroker...” (p. 19)

This confirms thatdata aggregatorsbear the legal and ethical burden to verify that data has been lawfully collected and is appropriately licensed for use, including in AI training.

A. The marketing agencyandD. its clientmay use data, but they rely on upstream providers for its lawful origin.

B. The tech companymay train the model but depends on lawful sourcing by data aggregators.

Differential privacy is a technique used to ensure that the inclusion or exclusion of a single data point does not significantly affect the outcome of any analysis, providing a way to mathematically prove that no specific piece of training data has more than a negligible effect on the model or its output. This is achieved by introducing randomness into the data or the algorithms processing the data. In the context of training large language models (LLMs), differential privacy helps in protecting individual data points while still enabling the model to learn effectively. By adding noise to the training process, differential privacy provides strong guarantees about the privacy of the training data.

The EU AI Act categorizes certain applications of AI as high-risk due to their potential impact on fundamental rights and safety. High-risk applications include those used in critical areas such as employment, education, and essential public services. A government-run social scoring tool, which assesses individuals based on their social behavior or perceived trustworthiness, falls under this category because of its profound implications for privacy, fairness, and individual rights. This contrasts with other AI applications like resume scanning tools or customer service chatbots, which are generally not classified as high-risk under the EU AI Act.

The correct answer is B because ISO/IEC 42005 emphasizes integrating AI risk management into existing enterprise risk management frameworks rather than creating siloed or duplicative processes. Effective AI governance requires embedding AI-specific risks into established governance structures such as risk registers, controls, and monitoring systems. This ensures consistency, scalability, and alignment with organizational risk practices. Options C and D introduce parallel or fragmented processes, which contradict the principle of integrated governance and may create inefficiencies or gaps. Option A focuses only on data collection and does not address governance integration. The AI Governance in Practice Report highlights that organizations should incorporate AI risks into broader enterprise risk management and maintain unified risk registers to ensure visibility, accountability, and coordinated mitigation across the organization.

For the artist to receive copyright protection, the most effective approach is to demonstrate that the final artwork includes sufficient creative input by the artist. By updating or altering the images in a way that reflects the artist ' s personal creativity, the artist can claim originality, which is a core requirement for copyright protection under U.S. law. The other options do not directly address the originality and creative input required for copyright. This is highlighted in the sections on copyright protection in the IAPP AIGP Body of Knowledge.

The correct answer is D. Key stroke dynamics, used to identify individuals, fall under biometric data, which is a special category of personal data under the GDPR and other frameworks.

From the AI Governance in Practice Report 2025:

“Keystroke dynamics may constitute biometric data if used to uniquely identify an individual… Biometric data is classified as special category personal data and requires higher protection standards.”

Also reflected in ILT Participant Guide:

“Biometric data, such as facial images, voiceprints, iris scans or keystroke patterns, are treated as special category data when they are used for the purpose of uniquely identifying individuals.”

An AI system that maintains its level of performance within defined acceptable limits despite real-world or adversarial conditions is described as resilient. Resilience in AI refers to the system ' s ability to withstand and recover from unexpected challenges, such as cyber-attacks, hardware failures, or unusual input data. This characteristic ensures that the AI system can continue to function effectively and reliably in various conditions, maintaining performance and integrity. Robustness, on the other hand, focuses on the system ' s strength against errors, while reliability ensures consistent performance over time. Resilience combines these aspects with the capacity to adapt and recover.

In the context of AI, particularly generative models, " hallucination " refers to the generation of outputs that are not based on the training data and are factually incorrect or non-existent. The scenario described involves the generative AI tool providing incorrect and non-existent information about restaurants, which fits the definition of hallucination. Reference: AIGP BODY OF KNOWLEDGE and various AI literature discussing the limitations and challenges of generative AI models.

Risk probability/severity testing is not typically used to evaluate the performance of an AI system. While important for risk management, it does not directly assess an AI system ' s operational performance. Adversarial robustness, statistical sampling, and decision analysis are all methods that can help evaluate the performance of a responsible AI system by testing its resilience, accuracy, and decision-making processes under various conditions. Reference: AIGP Body of Knowledge on AI Performance Evaluation and Testing.

In the selection and implementation of the AI hiring tool, involving Finance and Legal is crucial. The Finance team is essential for assessing cost implications, budget considerations, and financial risks. The Legal team is necessary to ensure compliance with applicable laws and regulations, including those related to data privacy, employment, and anti-discrimination. Involving these stakeholders ensures a comprehensive evaluation of both the financial viability and legal compliance of the AI tool, mitigating potential risks and aligning with organizational objectives and regulatory requirements.

The most comprehensive way to identify a full range of risks — legal, ethical, operational, and societal — for a new AI model is through aformal impact assessment, such as aData Protection Impact Assessment (DPIA)orAlgorithmic Impact Assessment.

From theAI Governance in Practice Report 2025:

“Risk-based approaches are often distilled into organizational risk management efforts, which put impact assessments at the heart of deciding whether harm can be reduced.” (p. 29)

“DPIAs… help organizations identify, analyze and minimize data-related risks and demonstrate accountability.” (p. 30)

A. Environmental scanis too general.

B. Red teamingis useful for adversarial risk but not broad.

C. Integration testingfocuses on technical/system compatibility, not overall risk.

The best reason for GVC to offer students the choice to utilize generative AI in limited, defined circumstances is to enable students to learn how to use AI as a supportive educational tool. By integrating AI in a controlled manner, students can learn the practical applications of AI and develop skills to use AI responsibly and effectively in their educational pursuits.

The correct answer isE – Superintelligence.

While the other options (Autonomy, Automation, Adaptability, Speed and Scale) are commonly cited as real-world characteristics that affect governance today,superintelligenceremainsa theoretical concept.

From the AIGP ILT Guide and AI Governance in Practice Report 2025:

“Core AI characteristics—such as automation, adaptability, speed, and autonomy—require active governance due to their impact on decision-making, legal liability, and risk.”

However,superintelligenceis speculative and not a current feature of AI systems under governance frameworks like theEU AI Act or NIST RMF.

Thus, it ' snot a current characteristicrequiring governance in real-world enterprise settings.

The correct answer is D because it directly reflects core data and model quality principles such as accuracy, performance consistency, and real-world effectiveness across different user groups. AI governance frameworks emphasize that quality must be evaluated based on whether outputs are accurate, complete, and fit for purpose in real-world conditions. Measuring accuracy by user group also supports fairness and bias detection, which are essential components of trustworthy AI. Option D captures outcome-based performance and aligns with continuous monitoring expectations across the AI lifecycle. In contrast, options A and C focus more on operational or technical metrics, while B reflects user sentiment rather than objective quality. According to AI governance principles, high-quality AI systems require ongoing evaluation of outputs against real-world results to ensure reliability, validity, and safe deployment.

During the first month of monitoring the model for bias, it is most important to continue disparity testing. Disparity testing involves regularly evaluating the model ' s decisions to identify and address any biases, ensuring that the model operates fairly across different demographic groups.

The EU AI Act outlines what must be included intechnical documentationfor high-risk systems. These requirements are designed to supportconformity assessment, transparency, and traceability.

From theAI Governance in Practice Report 2025:

“It mandates drawing up technical documentation… must include a general description of the AI system, the intended purpose, and a detailed description of the elements and development process.” (p. 34)

“Documentation… includes training, testing, evaluation procedures, andappropriateness of performance metrics.” (p. 34–35)

Therisk management systemis addressed separately through arisk management plan, not within the technical documentation itself.

Thus:

A, C, and Dare explicitly required in thetechnical documentation.

B, while important, is part of therisk management process, not a required section oftechnical documentation.

Theinitial deployment phaseof an AI model is critical forpost-deployment monitoring. When tracking forbias, the most important task is tocontinue disparity testingto determine whether outputs differ across protected groups.

From theAI Governance in Practice Report 2025:

“Performance monitoring protocols… should include mechanisms to assess and measure disparities in outcomes across different demographic groups.” (p. 12)

“Bias may not be evident during pre-deployment testing but can emerge in real-world use.” (p. 41)

B. Awareness trainingis helpful, but not a technical bias mitigation activity.

C. Analyzing training datais apre-deploymenttask.

D. Documenting human decisionsmay support auditability but doesn’t detect bias in AI outputs.

The correct answer is C, the Federal Trade Commission. The FTC plays a central role in U.S. AI governance by enforcing consumer protection and unfair or deceptive practices laws. In the context of AI systems such as companion chatbots, the FTC has authority to investigate risks related to user harm, transparency, safety, and misleading claims. AI governance frameworks emphasize regulatory oversight where AI systems may impact individuals psychologically, financially, or socially. Agencies like the FTC focus on ensuring that companies deploying AI systems do not cause harm through unsafe or deceptive practices and that they provide adequate disclosures about risks and system behavior. This aligns with broader AI governance principles of accountability, transparency, and risk management highlighted in the AI Governance in Practice Report 2024 , which stresses the importance of regulatory involvement in managing AI-related risks.

When anew versionof a third-party model is released, the deployer must ensure it still meets safety, performance, and compliance requirements — which calls for aformal audit.

From theAI Governance in Practice Report 2025:

“Any updates or changes to AI systems should trigger a re-evaluation to ensure continued compliance and performance.” (p. 12)

“Post-market monitoring includes reassessing the impact of updated models or retraining.” (p. 35)

The correct answer is C because differential privacy is specifically designed to ensure that the inclusion or exclusion of any single data point does not significantly affect the output of a model. This provides strong mathematical guarantees that individual training data cannot be reverse-engineered or identified from model outputs. Differential privacy works by introducing controlled noise into the data or model outputs, thereby protecting individual-level information while preserving overall statistical patterns. In AI governance, it is widely recognized as a key privacy-enhancing technology for mitigating risks such as data leakage, membership inference attacks, and re-identification. Other options, such as homomorphic encryption, focus on secure computation, while data sharding and compartmentalization address data management but do not provide formal privacy guarantees at the model output level.

The primary concern for a company adopting a policy prohibiting the use of generative AI is the risk of accidental disclosure of confidential and proprietary information. Generative AI tools can inadvertently leak sensitive data during the creation process or through data sharing. This risk outweighs the other reasons listed, as protecting sensitive information is critical to maintaining the company’s competitive edge and legal compliance. This rationale is discussed in the sections on risk management and data privacy in the IAPP AIGP Body of Knowledge.

The November 2023 White House Executive Order provides guidance that governmental agencies should limit access to specific uses of generative AI. This means that generative AI tools should be used in a controlled manner, where their applications are restricted to well-defined, approved use cases that ensure the security, privacy, and ethical considerations are adequately addressed. This approach allows for the benefits of generative AI to be harnessed while mitigating potential risks and abuses.

The IEEE 7000-2021 Standard focuses on a value-based engineering methodology for addressing ethical concerns during system design. This standard guides engineers and organizations in integrating ethical considerations into the design and development processes of AI systems, ensuring that these technologies are developed responsibly and align with human values. Reference: AIGP Study Material, section on risk management frameworks and standards.

According to the GDPR, individuals have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. However, there are exceptions to this right, one of which is when the decision is based on the data subject ' s explicit consent. This means that if an individual explicitly consents to the automated decision-making process, there is no requirement for human intervention to confirm or replace the decision. This exception ensures that individuals can have control over automated decisions that affect them, provided they have given clear and informed consent.

The correct answer is B because continuous monitoring is a core component of AI governance that ensures systems remain effective, reliable, and aligned with their intended objectives over time. AI systems can degrade due to data drift, model drift, or changing real-world conditions, making ongoing performance tracking essential. Monitoring allows organizations to detect anomalies, biases, or performance issues and take corrective actions such as retraining or recalibration. Governance frameworks emphasize post-deployment oversight to ensure systems continue to operate safely and within acceptable risk thresholds. Option A incorrectly suggests fully autonomous evolution without oversight, which contradicts governance principles. Options C and D address specific operational concerns but do not capture the primary purpose of continuous monitoring, which is maintaining performance, accountability, and alignment with defined goals.

The correct answer isA. Pre- and post-deployment testing ensuresbias, accuracy, and fairnessare evaluated and corrected as needed, which isessential for reputational risk mitigation.

From the AIGP Body of Knowledge:

“Testing AI systems before and after deployment is critical to ensure performance, fairness, and compliance. Failing to do so may result in reputational damage and legal exposure.”

AI Governance in Practice Report 2025 (Bias/Fairness and Risk Sections):

“System impact assessments, testing, and post-deployment monitoring are necessary to identify and mitigate risks… This supports both compliance and public trust.”

Testing is proactive, unlike indemnification (which transfers risk after damage), or requiring manual review (which defeats automation).

The common types of machine learning include supervised learning, unsupervised learning, reinforcement learning, and deep learning. Cognitive learning is not a type of machine learning; rather, it is a term often associated with the broader field of cognitive science and psychology. Reference: AIGP BODY OF KNOWLEDGE and standard AI/ML literature.

The primary reason the EU is considering updates to its Product Liability Directive is to address digital services and connected products. The current directive does not adequately cover the complexities and challenges posed by modern digital and connected technologies. By updating the directive, the EU aims to ensure that it remains relevant and effective in addressing the liabilities associated with these advanced products, ensuring consumer protection and fair market practices in the digital age.

The correct answer isB – The tech company. The party thatdevelops and trains the foundational modelis responsible for ensuring thelawful collection of training data.

From the AIGP ILT Guide – Foundational Models & Data Governance:

“Responsibility for the lawfulness of data collection typically lies with the party that trains the model—usually the provider or developer of the foundational model.”

AI Governance in Practice Report 2025 confirms:

“General Purpose AI providers are required to ensure that training data is lawfully acquired, including compliance with intellectual property and privacy requirements.”

The marketing agency is only auserordownstream integrator, not responsible for original data collection.

The correct answer is D, model disgorgement. This technique refers to removing or eliminating the influence of improperly obtained, biased, or unlawfully used data from a trained machine learning model. It is increasingly discussed in AI governance and regulatory enforcement, particularly where models have been trained on data collected without proper consent or in violation of legal requirements. Instead of merely cleaning datasets, model disgorgement may require retraining or discarding the model entirely to ensure that problematic data no longer influences outputs. This aligns with accountability and compliance principles in AI governance, where organizations must ensure lawful data use throughout the AI lifecycle. Other options like data cleansing and de-duplication address data quality but do not fully remove learned patterns already embedded in trained models.

Third-party risk management for AI systems should beproportional and risk-based, involvinginitial due diligenceandongoing monitoringthat reflects thelevel of risk posedby the third party ' s AI system.

From theAI Governance in Practice Report 2025:

“Third-party due diligence assessments to identify possible external risk and inform selection.” (p. 11)

“Legal due diligence may include verification of the personal data ' s lawful collection by the data broker, review of contractual obligations…” (p. 19)

Afocuses too narrowly on financial stability.

Cis excessive and not scalable or aligned with best practices.

Dinappropriately separates ethical and technical risks; both must be evaluated holistically.

Business A is integrating a generative AI model licensed from a third party (Business B) and is primarily concerned with the risk of toxic or obscene outputs being delivered to users. In this scenario,testing and validationof the AI model for such content risks is the most direct and effective governance strategy.

According to theAI Governance in Practice Report 2025, organizations thatdeployAI must engage inperformance monitoring protocolsand ensure systems perform adequately for theirintended purposes, including filtering harmful content:

“Operational governance… development of: →Performance monitoring protocols to ensure systems perform adequately for their intended purposes.” (p. 12)

“Product governance... includes: →System impact assessments to identify and address risk prior to product development or deployment.” (p. 11)

Furthermore, under theEU AI Act, which sets the global standard many organizations aim to align with, there is a clear obligation to test and monitor systems for potential harmful behavior:

“The act imposes regulatory obligations… such as establishing appropriate accountability structures,assessing system impact, providing technical documentation,establishing risk management protocols and monitoring performance...” (p. 7)

Option B directly reflects this best practice ofpre-deployment testing and validationto ensure that the model aligns with Business A’s minimum content safety requirements.

Let’s now evaluate the incorrect options:

A. Fine-tuning on verified user-generated textmay improve model alignment but does not guarantee that the model will generalize correctly, especially if Business A lacks access to model internals (common in third-party licensing scenarios). Fine-tuning also introduces its own risks and may be contractually restricted.

C. A user reporting featureisreactive, not preventive. While helpful for long-term monitoring and mitigation, it does not prevent the initial harm of toxic outputs, which isBusiness A ' s primary concern.

D. Requesting documentation from Business Bis useful for transparency and risk management, but it does not replaceindependent verificationthat the model meets Business A’s content safety standards.

Thus,testing the model ' s behavior for unacceptable outputs before deploymentis the most aligned approach with AI governance best practices and obligations.

The best approach to enable a customer who wants information on the AI model ' s parameters for underwriting purposes is to provide a transparency notice. This notice should explain the nature of the AI system, how it uses customer data, and the decision-making process it follows. Providing a transparency notice is crucial for maintaining trust and compliance with regulatory requirements regarding the transparency and accountability of AI systems.

Testing data is a subset of data used to provide a robust evaluation of a final model. After training the model on training data, it is essential to test its performance on unseen data (testing data) to ensure it generalizes well to new, real-world scenarios. This step helps in assessing the model ' s accuracy, reliability, and ability to handle various data inputs. Reference: AIGP Body of Knowledge on Model Validation and Testing.

Under the EU AI Act, high-risk AI systems like Crime Buster 9619 would require a detailed conformity assessment before being deployed in the EU market. This assessment ensures that the AI system complies with all relevant regulations and standards, addressing potential risks related to privacy, security, and discrimination. The company would not need to register the tool with the EU database (A), seek approval from an EU authority (B), or face a ban (D) as long as it meets the necessary conformity requirements​​​​.

Small language models (SLMs)arelightweight, requireless compute, and arebetter suited to low-resource or edge environments, making them ideal for agility and efficiency.

From general AI best practices:

“SLMs can be deployed in environments with limited computing power, ensuring lower cost and faster integration in constrained contexts.” (aligned with industry-wide AI deployment strategies)

Training an AI model is time-consuming primarily due tomodel complexity,large data volumes, and the need forhigh-quality, well-prepared data.

From theAI Governance in Practice Report 2025:

“Most AI requires sizeable amounts of high-quality data… to ensure desired and accurate output.” (p. 15)

“The accuracy of AI model outputs depends significantly on the quality of their inputs.” (p. 24)

“Complex AI systems… with many parameters… result in long development and training phases.” (p. 32)

B. Maturity of governanceaffects oversight, not training time.

D. Number of stakeholdersaffects alignment, not direct training duration.

The correct answer is A because the first step in any AI project lifecycle is to clearly define the business objective and justify the use of AI. AI governance frameworks emphasize that planning begins with understanding the purpose, value, and necessity of the system before moving into design or risk assessment stages. Establishing a business case ensures alignment with organizational goals, identifies expected benefits, and evaluates whether AI is the appropriate solution. This step corresponds to the planning phase of the AI lifecycle, where objectives and intended outcomes are documented. In contrast, TEVV processes occur during development and testing, while impact assessments and redress considerations arise later as part of risk management and governance. Starting with a clear “why AI” foundation ensures responsible, efficient, and goal-oriented system development.

Offeringloan products based on current offerings and rulesrequires a system that can followexplicit business logic, not generate open-ended content. Anexpert system, which is a rules-based AI that uses “if-then” logic, is ideal here.

From the AI governance context:

“Rule-based AI systems are often preferred when decisions must adhere to precise regulatory or financial criteria.” (aligned with AI best practices in regulated sectors)

A. RAGis used to integrate external knowledge—not suitable for structured, rule-based logic.

B. Multimodal modelshandle varied input types—not needed here.

D. Quantum computingis not yet practical or relevant for this business use case.

Establishing a global AI governance infrastructure involves several key elements, including providing training to foster a culture that promotes ethical behavior, creating policies and procedures to manage third-party risk, and understanding differences in norms across countries. While publicly disclosing ethical principles can enhance transparency and trust, it is not a core element necessary for the establishment of a governance infrastructure. The focus is more on internal processes and structures rather than public disclosure. Reference: AIGP Body of Knowledge on AI Governance and Infrastructure.

The EU AI Act outlines specific penalties and enforcement mechanisms to ensure compliance with its regulations. Among these, fines for violations of banned AI applications can be as high as €35 million or 7% of the global annual turnover of the offending organization, whichever is higher. Proportional caps on fines are applied to SMEs and startups to ensure fairness. General Purpose AI rules are to apply after a 6-month period as a specific provision to ensure that stakeholders have adequate time to comply. However, there is no provision for an " AI Pact " acting as a transitional bridge until the regulations are fully enacted, making option C the correct answer.

The correct answer is A because of the fundamental bias-variance tradeoff in machine learning. When model complexity is reduced, the model becomes simpler and less flexible, which decreases variance because it is less sensitive to fluctuations in the training data. However, this simplification comes at the cost of increased bias, meaning the model may oversimplify relationships and fail to capture underlying patterns accurately. This tradeoff is a core concept in AI fundamentals and directly impacts model per formance, reliability, and governance decisions. From an AI governance perspective, understanding this balance is critical when evaluating model risk, as high bias can lead to systematic errors and fairness issues, while high variance can result in instability and unpredictability in outputs. Proper model tuning aims to balance both for optimal and responsible performance.

An AI system’sfunction,industry, anddeployment locationdefine itsrisk profile, which directly influences theinternal governance structuresan organization must put in place.

From theAI Governance in Practice Report 2025:

“There are many challenges and potential solutions for AI governance, each with unique proximityand significance based on an organization’s role, footprint, broader risk-governance profile and maturity.” (p. 4)

“AI governance starts with defining the corporate strategy for AI… and formulating policy standards and operational procedures to reflect industry, use case, and location.” (p. 11)

A– Organizational accountability is broader and not directly scoped by industry or function.

C– Diversity of data sources is tied to data strategy.

D– Explainability is more influenced by model type, not use context.

Feature selection is the most important element of feature engineering to mitigate potential bias in an AI system. This process involves choosing the most relevant and representative features from the data set, which directly affects the model’s performance and fairness. By carefully selecting features, data scientists can reduce the influence of biased or irrelevant attributes, ensuring that the AI system is more accurate and equitable. Proper feature selection helps in eliminating biases that might stem from socio-demographic factors or other sensitive variables, leading to a more balanced and fair AI model. Reference: AIGP Body of Knowledge on Fairness in AI and Feature Engineering.

The failures in semi-autonomous vehicles due to sensors misinterpreting environmental surroundings, such as sunlight, are examples of brittleness. Brittleness in AI systems refers to their inability to handle variations in input data or unexpected conditions, leading to failures when the system encounters situations that were not adequately covered during training. These systems perform well under specific conditions but fail when those conditions change. Reference: AIGP Body of Knowledge on AI System Robustness and Failures.

The correct answer isD. Forming adedicated governance committeeensures continuous oversight, role clarity, and accountability throughout the AI lifecycle.

From the AIGP ILT Guide – Governance Structures:

“Organizations using AI in high-impact scenarios should establish a governance body responsible for oversight of risk, compliance, and ethical alignment.”

Also reflected in AI Governance in Practice Report 2025:

“Committees support cross-functional decision-making, provide guidance for updates, and maintain accountability. This is especially critical for high-stakes applications like marketing to diverse audiences.”

Options A, B, and C are valid supplementary actions, butDoffers a long-term and systematic governance mechanism.

When notifying an accused perpetrator, the police officer should provide information about how the individual was identified by the AI system. This transparency is crucial for maintaining trust and ensuring that the accused understands the basis of the charges against them. Information about the accuracy, how to oppose the charges, and the composition of the training data, while potentially relevant, do not directly address the immediate need for the accused to understand the specific process that led to their identification. Reference: AIGP Body of Knowledge on AI Transparency and Explainability.

When an AI system causessignificant false positives, especially in sensitive contexts likefraud detection, the priority is tohalt harmful activityand perform a full assessment. Continued use without understanding the fault may cause furthercustomer harmand legal exposure.

From theAI Governance in Practice Report 2025:

“Incident management plans should enable identification, escalation, and system rollback to prevent continued harm from malfunctioning AI systems.” (p. 12, 35)

Theprimary considerationin selecting any AI system, especially aproprietary model, is itsfit for business purpose. Whether it serves the intended goals is foundational before evaluating technical or governance features.

From theAI Governance in Practice Report 2025:

“AI governance starts with defining the corporate strategy for AI… and aligning systems with business purpose and operational context.” (p. 11)

B, C, Dare relevant for evaluation, but onlyafterconfirming business applicability.

The correct answer is D because AI impact assessments primarily focus on risks to individuals, society, and legal compliance, such as privacy, fairness, and potential harm. Core elements typically include evaluating the impact on privacy rights, identifying data sources and their lawfulness, and assessing potential bias or discriminatory outcomes. These factors are directly tied to regulatory expectations and ethical AI governance principles. While environmental considerations like energy consumption are increasingly discussed in broader AI sustainability conversations, they are not standard or required components of most AI impact assessments, especially for narrow use cases. AI governance frameworks prioritize human-centric risks, ensuring systems are lawful, fair, and safe, rather than focusing on operational metrics like energy usage in typical assessment processes.