AIGP Artificial Intelligence Governance Professional Question and Answers

The correct answer is B because one of the primary advantages of cloud-based AI deployment is its ability to easily scale resources up or down based on demand. Cloud platforms provide elastic infrastructure, allowing organizations to dynamically allocate compute power, storage, and processing capacity as needed. This is especially important for AI systems that experience fluctuating workloads, such as peak inference requests or large-scale model training. While cloud deployment can improve accessibility and efficiency, it does not inherently reduce latency compared to edge deployments, nor does it automatically enhance privacy or transparency. In AI governance, scalability is a key operational benefit that supports performance monitoring, cost efficiency, and responsiveness, enabling organizations to manage AI systems effectively across different environments and usage levels.

The AI risk that would not have been identified during the procurement process based on the categories of information requested by the third-party consultant is security. The consultant focused on accuracy rates, diversity of training data, and system functionality, which pertain to performance and fairness but do not directly address the security aspects of the AI system. Security risks involve ensuring that the system is protected against unauthorized access, data breaches, and other vulnerabilities that could compromise its integrity. Reference: AIGP Body of Knowledge on AI Security and Risk Management.

The most challenging aspect of managing a data access request in this scenario is dealing with unstructured data that cannot be easily disentangled from other data, including information about other individuals. Unstructured data, such as free-text inputs or social media posts, often lacks a clear structure and may be intermingled with data from multiple individuals, making it difficult to isolate the specific data related to the requester. This complexity poses significant challenges in complying with data access requests under privacy laws. Reference: AIGP Body of Knowledge on Data Subject Rights and Data Management.

The most critical reason for documenting AI-related risks is toreduce exposure to legal, regulatory, and reputational liabilities. Clear documentation demonstrates thatrisks were identified, assessed, and addressed, which is essential for accountability and defensibility in the face of audits, litigation, or enforcement actions.

From theAI Governance in Practice Report 2025:

“An effective AI governance model is about collective responsibility… which should encompass oversight mechanisms such as privacy, accountability, compliance.” (p. 13)

“Accountability… is based on the idea that there should be a person or entity that is ultimately responsible for any harm resulting from the use of the data, algorithm and AI system ' s underlying processes.” (p. 28)

While transparency, alignment with standards, and knowledge sharing are all secondary benefits,risk documentation’s primary role is liability mitigation.

The U.S. mortgage company ' s AI platform relates to housing and credit, making the Fair Housing Act (A), Fair Credit Reporting Act (B), and Equal Credit Opportunity Act (C) relevant. Title VII of the Civil Rights Act of 1964 deals with employment discrimination and is not directly relevant to the mortgage application context (D).

A multi-modal model is an AI system that can process and analyze multiple types of data, such as text, video, images, and sound. This type of AI integrates different data sources to enhance its understanding and decision-making capabilities. In the given scenario, the AI technology that tags content including names of animals, humans, and objects falls under this category. Reference: AIGP BODY OF KNOWLEDGE, which outlines the capabilities and use cases of multi-modal models​​.

The Singapore Model AI Governance Framework recommends several measures to promote the responsible use of AI, such as determining the level of human involvement in decision-making, adapting governance structures, and establishing communications and collaboration among stakeholders. However, employing human-over-the-loop protocols is not specifically mentioned in this framework. The focus is more on integrating human oversight appropriately within the decision-making process rather than exclusively employing such protocols. Reference: AIGP Body of Knowledge, section on AI governance frameworks.

A, D, and E introduce processing materially different from the practices described in the existing privacy policy. Storing chatbot inputs for RAG creates an additional retention and reuse purpose that should be addressed through appropriate privacy disclosures and retention controls. Using customer-session information to retrain the underlying model creates a distinct secondary purpose beyond processing an order, even when the data is subsequently deleted. Scanning a customer ' s appearance to infer frustration or confusion introduces an entirely new category of observation and inference, requiring additional transparency, legal-basis analysis, proportionality assessment, and safeguards. By contrast, B involves transferring customer information to a service provider so the requested service can operate, which the existing policy already permits. C involves ordinary contact and delivery information retained through completion of the transaction, which also fits the stated policy.

The correct answer is C, the Federal Trade Commission. The FTC plays a central role in U.S. AI governance by enforcing consumer protection and unfair or deceptive practices laws. In the context of AI systems such as companion chatbots, the FTC has authority to investigate risks related to user harm, transparency, safety, and misleading claims. AI governance frameworks emphasize regulatory oversight where AI systems may impact individuals psychologically, financially, or socially. Agencies like the FTC focus on ensuring that companies deploying AI systems do not cause harm through unsafe or de ceptive practices and that they provide adequate disclosures about risks and system behavior. This aligns with broader AI governance principles of accountability, transparency, and risk management highlighted in the AI Governance in Practice Report 2024 , which stresses the importance of regulatory involvement in managing AI-related risks.

The GDPR requires that individuals have the right to not be subject to decisions based solely on automated processing, including profiling, unless specific exceptions apply. One effective control is to establish a human-in-the-loop procedure (D), ensuring human oversight and the ability to contest decisions. This goes beyond just-in-time notices (A), data safeguarding (B), or review rights (C), providing a more robust mechanism to protect individuals ' rights.

A best reflects practical application of data minimization to machine learning. Data minimization requires personal data to be adequate, relevant, and limited to what is necessary for the specified purpose. AI development does not categorically prohibit using personal data in training, so B is too absolute. Personal data may legitimately be required during both training and inference, making D incorrect. Manual review of every data item is neither the definition nor a necessary implementation of minimization. Privacy-enhancing techniques can instead reduce the amount or identifiability of personal data processed while retaining model utility. ICO AI guidance specifically identifies perturbation or adding noise, synthetic data, and federated learning as techniques that can support data minimization during model training. Thus, A is the technically and governance-aligned choice.

================

D is the exception because the EU AI Act distinguishes obligations imposed on providers from those imposed on deployers. Under Article 16, providers of high-risk AI systems must maintain required documentation and automatically generated logs under their control. Article 17 requires providers to establish a documented quality management system, which includes setting up, implementing, and maintaining a post-market monitoring system. These provisions support A, B, and C. By contrast, Article 26 requires deployers to take appropriate organizational and technical measures to use high-risk systems according to the provider ' s instructions and to assign human oversight to suitably competent, trained, and authorized natural persons. Providers must design high-risk systems so effective human oversight is possible, but actually ensuring oversight during operational use in accordance with instructions is principally a deployer obligation.

================

The core ethical concern when deploying diagnostic AI in a healthcare setting is ensuringfairness and accuracy across diverse patient populations. If the AI is trained on a dataset that isnot representativeof the population it will serve, it risks reinforcing health disparities and leading to misdiagnoses.

From theAI Governance in Practice Report 2025:

“Training datasets lacking in diversity can produce outputs that systematically underperform for certain groups… this can lead to inaccurate or biased outcomes in healthcare settings.” (p. 41)

“Bias, discrimination and fairness challenge… inadequate or nonrepresentative training data can result in AI systems that propagate historical disparities.” (p. 42)

While physician oversight may reduce risk,biased data can still shape clinical decision-making.

A– Economic benefit is not central to ethical risk here.

C– Important but less critical than data representativeness.

D– Error rate matters but is addressed via validation; it’s not the core ethical issue.

Under the EU AI Act, organizations that develop and deploy high-risk AI systems are required to provide several key disclosures to ensure transparency and accountability. These include the human oversight measures employed, how individuals can contest decisions made by the AI system, and informing individuals that an AI system is being used. However, there is no specific requirement to disclose the exact locations where data is stored. The focus of the Act is on the transparency of the AI system ' s operation and its impact on individuals, rather than on the technical details of data storage locations.

The correct answers are A, C, and D because multiple regulatory regimes apply based on jurisdiction, data use, and deceptive practices. The EU AI Act applies because the system is being developed and tested in cooperation with an EU-based university and involves behavioral influence, which may fall under prohibited or high-risk AI practices, especially where manipulation or deception is present. The General Data Protection Regulation applies due to the processing of personal data of EU-based participants, particularly given the misleading study protocol, which violates principles such as transparency and informed consent. The Federal Trade Commission Act applies to the US company because deceptive or unfair practices, such as misleading participants about the purpose of experiments, fall under FTC enforcement. The Digital Services Act and PCI standards are not relevant to this specific use case.

Software-as-a-Service accessed through an API is the most practical deployment approach for a small organization with limited IT infrastructure and budget. SaaS allows the company to consume a provider-managed application without purchasing and maintaining the substantial computing infrastructure normally needed for modern generative AI. Under NIST ' s cloud-computing model, SaaS consumers use provider applications while the provider manages the underlying network, servers, operating systems, storage, and much of the supporting infrastructure. This makes implementation comparatively rapid and scalable. Running the model on the existing on-premises server could require hardware upgrades and specialized maintenance. A private-cloud deployment introduces additional infrastructure and administrative complexity. Edge deployment on customers ' devices would also create substantial technical and compatibility challenges. Therefore, considering the company ' s resources and desired speed of deployment, C is the strongest option.

================

The correct answer is C. This option concerns consent, which is generally a privacy, transparency, or institutional governance issue rather than a copyright issue. Copyright risk in AI governance usually relates to whether protected third party works were used in model training, whether generated outputs may reproduce copyrighted expression, and whether content is created without proper attribution or clear ownership boundaries. That makes options A, B, and D directly relevant to copyright and intellectual property concerns. In contrast, whether students must expressly consent deals with notice, fairness, and lawful or ethical use in an educational environment. For AIGP exam purposes, it is important to separate intellectual property risks from privacy and data protection obligations, even when both appear in the same classroom or organizational AI use case.

Autoregression is not a common optimization technique in deep learning to determine weights for artificial neurons. Common techniques include gradient descent, momentum, and backpropagation. Autoregression is more commonly associated with time-series analysis and forecasting rather than neural network optimization. Reference: AIGP BODY OF KNOWLEDGE, which discusses common optimization techniques used in deep learning​​.

AI governance frameworks consistently define the “unique characteristics” of AI that create novel governance challenges.

Across the OECD AI Principles, NIST AI RMF, ISO/IEC 42001, and the EU AI Act, the key characteristics requiring governance are:

Autonomy – AI systems act without direct human intervention and take context-dependent decisions.

Adaptability – AI systems learn, evolve, and update their behavior over time, making outputs non-deterministic.

These traits fundamentally distinguish AI from traditional software and shape all major governance activities (risk assessment, monitoring, assurance, accountability, alignment, etc.).

Below is why each option is correct or incorrect:

A. Autonomy — NOT selected

Reason:

Autonomy is repeatedly cited as one of the defining characteristics that necessitates governance.

NIST AI RMF references the risks of autonomous behavior .

ISO/IEC 42001 emphasizes governance controls for “systems operating with varying levels of autonomy.”

Thus, Autonomy IS a unique characteristic , so it is not an answer.

B. Automation — SELECTED

Reason:

“Automation” is not a unique AI property. Automation predates AI and applies to robotics, scripts, business process automation, etc.

AI governance literature does not classify automation as a unique AI-specific characteristic.

Automation is a result of AI, but not a distinguishing property .

Therefore, Automation is correctly selected as NOT a unique AI characteristic.

C. Adaptability — NOT selected

Reason:

Adaptability (systems that update, learn, or change behavior) is recognized universally as a core distinctive trait of AI.

EU AI Act emphasizes governance requirements for “adaptive systems.”

NIST AI RMF highlights “learning and emergent behavior.”

Thus, Adaptability IS a unique characteristic , so it should not be chosen as an exception.

D. Speed and scale — SELECTED

Reason:

While AI can operate at high speed and scale, these are not unique characteristics of AI .

Traditional computing systems, cloud workloads, and automation pipelines operate at similar scale.

AI governance documents mention speed/scale as a risk amplifier , not a defining characteristic.

Therefore, Speed and scale should be selected.

E. Superintelligence — SELECTED

Reason:

“Superintelligence” is not a characteristic of current AI systems and is not referenced as a governance-relevant attribute in mainstream policy documents (OECD, NIST, ISO, EU AI Act).

It is speculative rather than a defining feature.

Therefore, it is correctly chosen as NOT a unique characteristic requiring governance today.

The correct answer is D because the company has already addressed several key responsible AI principles, including fairness through discrimination risk mitigation, robustness through adversarial and edge-case testing, and reliability via repeatability testing. However, there is no indication that the company has addressed transparency, which involves providing clear information about how the model operates, how pricing decisions are made, and how outputs may affect consumers. Transparency is a critical AI governance principle, especially in consumer-facing applications like dynamic pricing, where decisions can significantly impact individuals. Governance frameworks emphasize that users and stakeholders should be informed about AI-driven decisions and their implications. Without transparency, even technically sound and fair systems may lack trustworthiness and fail to meet regulatory or ethical expectations.

The most significant risk from combining the healthcare network’s existing data with the clinical research partner data is privacy risk. Combining data sets, especially in healthcare, often involves handling sensitive information that could lead to privacy breaches if not managed properly. De-identified data can still pose re-identification risks when combined with other data sets. Ensuring privacy involves implementing robust data protection measures, maintaining compliance with privacy regulations such as HIPAA, and conducting thorough privacy impact assessments. Reference: AIGP Body of Knowledge on Data Privacy and Security.

For the artist to receive copyright protection, the most effective approach is to demonstrate that the final artwork includes sufficient creative input by the artist. By updating or altering the images in a way that reflects the artist ' s personal creativity, the artist can claim originality, which is a core requirement for copyright protection under U.S. law. The other options do not directly address the originality and creative input required for copyright. This is highlighted in the sections on copyright protection in the IAPP AIGP Body of Knowledge.

Training underwriters on the model prior to deployment is crucial so they can apply their own judgment to the initial assessment. While AI models can streamline the process, human judgment is still essential to catch nuances that the model might miss or to account for any biases or errors in the model ' s decision-making process.

Performing an impact assessment is the best step to mitigate the possibility of discrimination before training and testing the AI solution. An impact assessment, such as a Data Protection Impact Assessment (DPIA) or Algorithmic Impact Assessment (AIA), helps identify potential biases and discriminatory outcomes that could arise from the AI system. This process involves evaluating the data and the algorithm for fairness, accountability, and transparency. It ensures that any biases in the data are detected and addressed, thus preventing discriminatory practices and promoting ethical AI deployment. Reference: AIGP Body of Knowledge on Ethical AI and Impact Assessments.

Forcustomizable, interpretable modelsthat allow organizations toretain control and avoid vendor lock-in,classic ML models(e.g., regression, decision trees, random forests) are optimal.

From theAI Governance in Practice Report 2025:

“Organizations seeking transparency, customizability, and control often prefer classic ML models due to their flexibility and ease of governance.” (p. 33)

AandCmay have limited transparency and are often tied to specific providers.

Dinvolves ongoing costs and limited model control.

When anew versionof a third-party model is released, the deployer must ensure it still meets safety, performance, and compliance requirements — which calls for aformal audit.

From theAI Governance in Practice Report 2025:

“Any updates or changes to AI systems should trigger a re-evaluation to ensure continued compliance and performance.” (p. 12)

“Post-market monitoring includes reassessing the impact of updated models or retraining.” (p. 35)

A greedy algorithm is one that makes the best choice at each step to achieve an immediate objective, without considering the longer-term consequences. It focuses on local optimization at each decision point with the hope that these local solutions will lead to an optimal global solution. However, greedy algorithms do not always produce the best overall solution for certain problems, but they are useful when an immediate, locally optimal solution is desired. Reference: AIGP Body of Knowledge, algorithm types section.

The correct answer isB – Procedural. TheOECD Framework for Classifying AI Systemscategorizescodes of conduct and collective agreementsasprocedural toolsbecause they guide internal governance and decision-making processes.

From the AIGP ILT Participant Guide – Global Governance Models:

“Procedural tools include internal codes of conduct, collective agreements, and procedural audits that guide governance without necessarily involving technical measurement.”

AI Governance in Practice Report 2025 elaborates:

“These procedural tools support internal accountability mechanisms and ethics compliance frameworks… they are part of soft governance.”

These toolsdo not measure or analyze technical performance, hence they arenot technical or analytic.

===========

Respecting intellectual property rights means adhering to licensing terms and ensuring that generated content complies with these terms. A system that categorizes and applies filters based on licensing terms ensures that content is used legally and ethically, respecting the rights of content creators. While providing attribution is important, categorization and application of filters based on licensing terms are more directly tied to compliance with intellectual property laws. This principle is elaborated in the IAPP AIGP Body of Knowledge sections on intellectual property and compliance.

The correct answer is A because having a well-defined incident management process enables organizations to respond quickly and effectively when AI-related issues arise. AI governance frameworks emphasize incident management plans as a key component of operational governance, ensuring that risks such as system failures, harmful outputs, or security breaches are promptly identified, escalated, and resolved. A structured process reduces delays by clearly defining roles, responsibilities, and response procedures, thereby minimizing potential harm and operational disruption. While incident processes may also indirectly support compliance and reduce the impact of failures, their primary benefit is improving responsiveness and coordination. Efficient response times are critical in maintaining trust, ensuring safety, and limiting negative consequences in real-world AI deployments.

Importers of high-risk AI systems into the EU havespecific responsibilitiesunder the EU AI Act. They arenotthe parties responsible for affixing the CE marking or providing technical documentation—but they must verify that these have been done by the provider.

From theAI Governance in Practice Report 2025:

“Importers must verify that the appropriate conformity assessment has been carried out, the technical documentation is available, and the CE marking has been affixed.” (p. 34–35)

Thus:

A. Provide technical documentation– done by theprovider.

B. Affix the CE marking–provider ' sresponsibility.

C. Verify the Declaration of Conformity–importer obligation.

D. Conduct a DPIA– relevant under data protection laws,not requiredunder the EU AI Act forimporters.

The correct answer is D. Key stroke dynamics, used to identify individuals, fall under biometric data, which is a special category of personal data under the GDPR and other frameworks.

From the AI Governance in Practice Report 2025:

“Keystroke dynamics may constitute biometric data if used to uniquely identify an individual… Biometric data is classified as special category personal data and requires higher protection standards.”

Also reflected in ILT Participant Guide:

“Biometric data, such as facial images, voiceprints, iris scans or keystroke patterns, are treated as special category data when they are used for the purpose of uniquely identifying individuals.”

 

 

In selecting the specific type of algorithm for the AI solution, the healthcare network ' s data science team is most important. This team possesses the technical expertise and understanding of the data, the clinical context, and the performance requirements needed to make an informed decision about which algorithm is most suitable. While the cloud provider and consulting firm can offer support and infrastructure, and the AI governance committee provides oversight, the data science team’s specialized knowledge is crucial for selecting and implementing the appropriate algorithm. Reference: AIGP Body of Knowledge, AI governance and team roles section.

The GDPR privacy principles that this scenario violates are Purpose Limitation and Data Minimization. Purpose Limitation requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Data Minimization mandates that personal data collected should be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. In this case, collecting extensive personal information (e.g., IP address, location, gender) and potentially using it beyond the necessary scope for the app ' s functionality could violate these principles by collecting more data than needed and possibly using it for purposes not originally intended.

Under the EU regulations, particularly the GDPR, banks using AI for decision-making must inform users about the use of AI and provide mechanisms for users to contest decisions. This is part of ensuring transparency and accountability in automated processing. Explicit consent under the privacy directive (A) and disclosing under the Digital Services Act (B) are not specifically required in this context. An adequacy decision is related to data transfers outside the EU (C).

The IEEE Ethical System Design Risk Management Framework (IEEE 7000-21) would be most appropriate for XYZ Corp ' s governance needs in addition to the NIST AI Risk Management Framework. The IEEE framework specifically addresses ethical concerns during system design, which is crucial for ensuring the responsible use of AI in hiring. It complements the NIST framework by focusing on ethical risk management, aligning well with XYZ Corp ' s goals of deploying AI responsibly and mitigating associated risks​​​​.

GPUs (Graphical Processing Units) are well-suited to running AI applications due to their ability to run many tasks concurrently, which significantly enhances processing speed. This parallel processing capability makes GPUs ideal for handling the large-scale computations required in AI and deep learning tasks. Reference: AIGP BODY OF KNOWLEDGE, which explains the importance of compute infrastructure in AI applications​​.

To maintain fairness in a deployed system, it is crucial to monitor for data drift that may affect performance and accuracy. Data drift occurs when the statistical properties of the input data change over time, which can lead to a decline in model performance. Continuous monitoring and updating of the model with new data ensure that it remains fair and accurate, adapting to any changes in the data distribution. Reference: AIGP Body of Knowledge on Post-Deployment Monitoring and Model Maintenance.

Defining the roles and responsibilities of AI stakeholders is crucial for encouraging accountability over AI systems. Clear delineation of who is responsible for different aspects of the AI lifecycle ensures that there is a person or team accountable for monitoring, maintaining, and addressing issues that arise. This accountability framework helps in ensuring that ethical standards and regulatory requirements are met, and it facilitates transparency and traceability in AI operations. By assigning specific roles, organizations can better manage and mitigate risks associated with AI deployment and use.

The correct answer isC.Registration in the EU databaseis an obligation ofprovidersof high-risk AI systems—not distributors.

From the AIGP ILT Guide – Roles & Obligations Module:

“Distributors must verify CE marking, ensure instructions for use are provided, inform authorities of risks, and take corrective action when necessary. However, registration duties in the EU database lie with the provider.”

Also from the AI Governance in Practice Report 2025:

“The AI Act differentiates responsibilities for developers, providers, importers, and distributors. Only providers of high-risk systems are obligated to register their systems in the EU AI Database.”

Distributors focus onverification and communication, not formal registration.

 

 

Reviewing the terms of use is essential when gathering data from a clinical research partner. This step ensures that the healthcare network complies with all legal and contractual obligations related to data usage. It addresses data ownership, usage limitations, consent requirements, and privacy obligations, which are critical to maintaining ethical standards and avoiding legal repercussions. This review helps ensure that the data is used in a manner consistent with the agreements made and the regulatory environment, which is fundamental for lawful and ethical AI development. Reference: AIGP Body of Knowledge on Legal and Regulatory Considerations.

Human-centric AI focuses on improving the human experience by addressing individual needs and enhancing human capabilities. Option D exemplifies this by using virtual assistants to tailor educational content to each student ' s unique abilities and needs, thereby supporting personalized learning and improving educational outcomes. This use case directly benefits individuals by providing customized assistance and adapting to their learning pace and style, aligning with the principles of human-centric AI.

The primary reason the EU is considering updates to its Product Liability Directive is to address digital services and connected products. The current directive does not adequately cover the complexities and challenges posed by modern digital and connected technologies. By updating the directive, the EU aims to ensure that it remains relevant and effective in addressing the liabilities associated with these advanced products, ensuring consumer protection and fair market practices in the digital age.

The correct answer isE – Superintelligence.

While the other options (Autonomy, Automation, Adaptability, Speed and Scale) are commonly cited as real-world characteristics that affect governance today,superintelligenceremainsa theoretical concept.

From the AIGP ILT Guide and AI Governance in Practice Report 2025:

“Core AI characteristics—such as automation, adaptability, speed, and autonomy—require active governance due to their impact on decision-making, legal liability, and risk.”

However,superintelligenceis speculative and not a current feature of AI systems under governance frameworks like theEU AI Act or NIST RMF.

Thus, it ' snot a current characteristicrequiring governance in real-world enterprise settings.

 

 

Random forest algorithms are classified as discriminative models. Discriminative models are used to classify data by learning the boundaries between classes, which is the core functionality of random forest algorithms. They are used for classification and regression tasks by aggregating the results of multiple decision trees to make accurate predictions.

When an AI system causessignificant false positives, especially in sensitive contexts likefraud detection, the priority is tohalt harmful activityand perform a full assessment. Continued use without understanding the fault may cause furthercustomer harmand legal exposure.

From theAI Governance in Practice Report 2025:

“Incident management plans should enable identification, escalation, and system rollback to prevent continued harm from malfunctioning AI systems.” (p. 12, 35)

C is the correct statement, subject to the statutory thresholds. Article 36 of South Korea ' s AI Basic Act requires an AI business operator without an address or business office in Korea to designate a domestic representative when it meets prescribed criteria concerning users, revenue, or other specified conditions. The implementing decree establishes those thresholds, including qualifying revenue and Korean-user levels. The Act also applies extraterritorially where conduct outside Korea affects the Korean market or users. Generative AI is not categorically excluded, eliminating B. The Korean framework does not simply reproduce the EU AI Act ' s prohibited-practices regime described in D, and " frontier models " are not established as the distinct regulatory category suggested by A. Therefore, domestic-representative requirements make C the best answer.

================

Establishing a global AI governance infrastructure involves several key elements, including providing training to foster a culture that promotes ethical behavior, creating policies and procedures to manage third-party risk, and understanding differences in norms across countries. While publicly disclosing ethical principles can enhance transparency and trust, it is not a core element necessary for the establishment of a governance infrastructure. The focus is more on internal processes and structures rather than public disclosure. Reference: AIGP Body of Knowledge on AI Governance and Infrastructure.

The correct answer isA. TheAcceptable Use Policy (AUP)sets the primary terms and conditions under which the AI model can be used, including limitations, prohibited uses, and operational constraints.

From the AIGP ILT Guide:

“The AUP is the most critical document to assess what you can and cannot do with the AI system. It governs use cases, outlines forbidden uses (e.g., disinformation), and supports responsible AI practices.”

Also confirmed in the AI Governance in Practice Report 2025 (Third-Party AI Assurance section):

“Reviewing and adhering to the acceptable use policy ensures that the model is being used in a manner that aligns with both provider expectations and ethical AI practices.”

===========

The 1956 Dartmouth summer research project on AI is best known as a meeting focused on the founding of the AI field. This conference is historically significant because it marked the formal beginning of artificial intelligence as an academic discipline. The term " artificial intelligence " was coined during this event, and it laid the foundation for future research and development in AI.

The correct answer isD. While modernization through software may support efficiency, it isnot a foundational or essential componentof designing an integrated strategy.

From the AI Governance in Practice Report 2025:

“Integrated strategies rely on senior management support, ethical reviews, and stakeholder engagement... The use of tools and platforms may come later as an operational enhancement.”

Also confirmed in AIGP Body of Knowledge:

“Key components of a governance framework include leadership buy-in, ethical analysis, and stakeholder input. Tools are supporting elements—not strategic drivers.”

===========

The correct answer is B because continuous monitoring is a core component of AI governance that ensures systems remain effective, reliable, and aligned with their intended objectives over time. AI systems can degrade due to data drift, model drift, or changing real-world conditions, making ongoing performance tracking essential. Monitoring allows organizations to detect anomalies, biases, or performance issues and take corrective actions such as retraining or recalibration. Governance frameworks emphasize post-deployment oversight to ensure systems continue to operate safely and within acceptable risk thresholds. Option A incorrectly suggests fully autonomous evolution without oversight, which contradicts governance principles. Options C and D address specific operational concerns but do not capture the primary purpose of continuous monitoring, which is maintaining performance, accountability, and alignment with defined goals.

Deploying a challenger AI model alongside a champion model is a strategy used to compare the performance of different models in a real-world environment. This approach helps in providing a framework to consider alternatives to the champion model, automating real-time monitoring of the champion model, and performing testing on the champion model. However, retraining the champion model is not a reason to deploy a challenger model. Retraining is a separate process that involves updating the champion model with new data or techniques, which is not related to the use of a challenger model.

An AI system that maintains its level of performance within defined acceptable limits despite real-world or adversarial conditions is described as resilient. Resilience in AI refers to the system ' s ability to withstand and recover from unexpected challenges, such as cyber-attacks, hardware failures, or unusual input data. This characteristic ensures that the AI system can continue to function effectively and reliably in various conditions, maintaining performance and integrity. Robustness, on the other hand, focuses on the system ' s strength against errors, while reliability ensures consistent performance over time. Resilience combines these aspects with the capacity to adapt and recover.

Post-deployment AI maintenance typically includes ensuring that all model components are subject to a control framework, dedicating experts to continually monitor the model output, and evaluating the need for audits under certain standards. However, defining thresholds to conduct new impact assessments is usually part of the initial deployment and ongoing governance processes rather than a maintenance activity. Maintenance focuses more on the operational aspects of the AI system rather than setting new thresholds for impact assessments.

The three most directly relevant risks are misinformation, source credibility, and unauthorized or inappropriate access to restricted information. Generative AI can produce inaccurate or misleading summaries, making B an important information-integrity consideration. Because the system crawls online sources and transforms them into authoritative-looking summaries, the process used to determine credible sources is also essential, making D correct. Accessing information from restricted social-media profiles raises significant privacy, authorization, and data-governance concerns, supporting E. NIST ' s Generative AI Profile identifies confabulation, information integrity, privacy, and content provenance as important generative-AI risks. Environmental impact is a legitimate broader AI governance consideration, but it is less specific to this particular web-crawling and profiling use case than B, D, and E. Physical safety procedures have no material connection to the described system.

================

The correct answer isB – Proprietary methods. While transparency is important, organizations arenot obligated to disclose proprietary algorithms, methods, or trade secretsin public disclosures.

From the AIGP Body of Knowledge – Transparency & Disclosures:

“AI system users should disclose the purpose, capabilities, limitations, and applicable legal context—but not sensitive IP.”

AI Governance in Practice Report 2025 (Transparency Section) states:

“Disclosure requirements balance public understanding with the need to protect proprietary business interests. Proprietary training methods are not expected to be disclosed.”

Thus, while it’s best practice to disclose theintended purpose, legal compliance, and system limitations,internal proprietary techniquesare usually excluded.

===========

Theprimary considerationin selecting any AI system, especially aproprietary model, is itsfit for business purpose. Whether it serves the intended goals is foundational before evaluating technical or governance features.

From theAI Governance in Practice Report 2025:

“AI governance starts with defining the corporate strategy for AI… and aligning systems with business purpose and operational context.” (p. 11)

B, C, Dare relevant for evaluation, but onlyafterconfirming business applicability.

The White House Executive Order from November 2023 requires companies developing dual-use foundation models to report on their current training or development activities, the results of red-team testing, and the physical and cybersecurity protection measures. However, it does not mandate reports on environmental impact studies for each dual-use foundation model. While environmental considerations are important, they are not specified in this context as a reporting requirement under this Executive Order.

The correct answer isA. Only GPAI modelswith systemic riskmustpublish a detailed summary of training datato meet transparency and accountability standards under the EU AI Act.

From the AI Governance in Practice Report 2025 (EU AI Act Section):

“For GPAI systems with systemic risk, providers must publish sufficiently detailed summaries of the content used to train the model.”

Also, the AIGP ILT Guide confirms:

“The obligation to disclose summaries of training data applies only to systemic-risk GPAI models, not all general-purpose models or high-risk systems.”

This unique requirement is part of the Act’s effort to increasetransparency and auditabilityfor powerful foundational models.

===========

The TAKE IT DOWN Act, Public Law 119-12, criminalizes certain intentional disclosures of authentic and AI-generated nonconsensual intimate imagery. Offenses involving minors can carry imprisonment of up to three years, supporting A. Covered platforms must establish a notice-and-removal process and receive liability protection when they disable or remove reported material in good faith, supporting E. Violations of the platform requirements are enforceable by the FTC and can trigger substantial civil penalties, supporting D conceptually. The video ' s approximately $51,000 figure reflects the civil-penalty level used in supporting governance materials; current FTC guidance lists a higher inflation-adjusted maximum of $53,088 per violation. B is clearly incorrect because the statutory removal deadline is 48 hours , not 30 days. C is not itself a specified statutory penalty.

================