IAPP AIGP Practice Questions with Explanations

Correct answer: B

Machine learning is fundamentally defined as a system's ability to automatically improve and learn from experience without being explicitly programmed. Option B captures this core concept by emphasizing automatic improvement from experience through predictive patterns, which is the defining characteristic of machine learning.

Why the other options are wrong:

• A. This describes AI broadly (mimicking human intelligence) rather than the specific mechanism of machine learning (learning from experience).
• C. This focuses on statistical inference from samples to predict human intelligence, which is not the defining characteristic of machine learning.
• D. While data analysis occurs in machine learning, this describes data mining or knowledge discovery rather than the learning mechanism itself.

Correct answer: C

Random forest algorithms are ensemble methods used for classification and regression tasks where the goal is to discriminate between classes based on input features. They are discriminative models because they learn to distinguish between different classes by modeling the decision boundaries directly, rather than modeling the probability distribution of the data itself.

Why the other options are wrong:

• A. Symbolic models use explicit rules and logical representations, not the ensemble tree-based approach of random forests.
• B. Generative models learn the underlying probability distribution of data to generate new samples; random forests directly discriminate between classes.
• D. Natural language processing is a specific application domain, not a model type classification.

Correct answer: B

A system that processes and analyzes multiple types of data modalities (text, video, images, and sound) simultaneously to perform unified tagging and recognition is the definition of a multi-modal model. Multi-modal AI integrates information from different input types to achieve comprehensive understanding and analysis.

Why the other options are wrong:

• A. Deductive inference involves drawing specific conclusions from general principles, not processing multiple data types.
• C. Transformative AI refers to AI with broad societal impact, not the technical architecture of processing multiple data modalities.
• D. Expert systems use knowledge bases and rules to emulate human expertise in specific domains, not unified multi-modal analysis.

Correct answer: C

Explainability specifically refers to the ability of an AI system to provide a clear rationale or explanation for its outputs and decisions. When a system can articulate why it made a particular decision, it is demonstrating explainability, which is crucial for user trust and understanding of AI behavior.

Why the other options are wrong:

• A. Accountability refers to being answerable for actions and outcomes, not specifically the ability to provide rationale.
• B. Transparency means the system's operations are visible, but not necessarily that explanations are provided for specific outputs.
• D. Reliability refers to consistent and dependable performance, not the provision of decision rationales.

Correct answer: C

When implementing an AI system that collects and processes personal biometric data (typing patterns), the organization must ensure compliance with data protection principles, particularly the requirement that personal data be processed only for specific, lawful, and justified purposes. This is a fundamental requirement under privacy regulations like GDPR and ensures the organization uses personal data ethically and legally.

Why the other options are wrong:

• A. While third-party data sharing may be relevant, the primary concern is ensuring lawful processing of personal data for a specific purpose.
• B. Security controls are important but secondary to establishing the lawful basis and purpose for processing personal data.
• D. Policy complexity reduction for non-technical employees is a communications issue, not the primary governance priority for this scenario.

Correct answer: D

AI systems with resource-intensive computing demands consume significant electricity and generate substantial carbon emissions, creating environmental risks. The energy consumption required for training and running large-scale AI models contributes to climate impact and resource depletion, making this an organizational environmental risk.

Why the other options are wrong:

• A. People risk relates to workforce impacts and human factors, not computational resource demands.
• B. Security risk concerns data protection and system vulnerabilities, not energy consumption.
• C. Third-party risk involves dependencies on external vendors and suppliers, not the environmental impact of computing resources.

Correct answer: C

A disease diagnosis system based on historical patient data uses probabilistic modeling because it must estimate the probability of different diagnoses given symptoms and patient history. Probabilistic models explicitly handle uncertainty and provide probability distributions over possible outcomes, which is essential for medical diagnosis where multiple conditions may be possible with varying likelihoods.

Why the other options are wrong:

• A. Inference is the process of making predictions, not a model type classification.
• B. Statistical models encompass a broad category; probabilistic models are the specific type that handles uncertainty with probability distributions.
• D. Deterministic models produce fixed outputs for given inputs with no uncertainty, unsuitable for diagnosis where multiple outcomes have different probabilities.

Correct answer: D

Human-centric AI prioritizes human well-being, autonomy, and individual needs. Option D describes virtual assistants that personalize educational content based on individual ability and needs, directly supporting human development and respecting individual differences. This approach centers on enhancing human capability and choice rather than just optimizing processes or outcomes.

Why the other options are wrong:

• A. While beneficial to many, improving weather predictions is more about general utility than focusing on individual human needs and autonomy.
• B. Autonomous robots reducing physical strain benefits workers, but the focus is on automation efficiency rather than personalized human development.
• C. Demand forecasting and inventory management are business optimization goals that benefit consumers generally, not human-centric applications focused on individual needs.

Correct answer: A

Effective AI governance requires cross-functional collaboration involving developers, deployers, business stakeholders, compliance, ethics, and risk management teams. A cross-functional team ensures diverse perspectives on technical, legal, ethical, and operational concerns. While vendor management and policy uniformity are important, they are supporting practices rather than foundational characteristics. Public filings review is too narrow in scope and not inherently characteristic of internal governance effectiveness.

Why the other options are wrong:

• B. Vendor management is important but is a supporting process, not a foundational characteristic of effective AI governance.
• C. Public filings review may provide external context but is not a core foundational element of internal governance.
• D. Uniform policies across all roles would be ineffective; different roles require different governance approaches and responsibilities.

Correct answer: A

As a data controller under privacy frameworks like GDPR, the company must allow data subject access requests, implement technical and organizational security measures, and conduct impact assessments for high-risk processing. However, there is no requirement that third-party processors be based in the same country as the company. Controllers can use processors in other jurisdictions provided appropriate safeguards and contractual arrangements are in place. Geography alone is not a determining factor for processor selection under modern data protection law.

Why the other options are wrong:

• B. Data subject access requests (DSARs) are a core obligation of data controllers under privacy regulations.
• C. Technical and organizational measures to protect personal data are mandatory obligations of data controllers.
• D. Conducting a DPIA/PIA for AI systems processing biometric data for authentication is a legal obligation for high-risk processing.

Correct answer: D

Biometric data such as typing patterns, speed, rhythm, and pressure are special category data when used to uniquely identify a person. Biometric information for identification or authentication purposes falls under special category data (previously called 'sensitive personal data') in privacy frameworks like GDPR because it reveals information about the individual's unique physical characteristics. This classification applies regardless of whether it reveals health, gender, or race-biometric identifiers themselves constitute special category data due to their inherent nature and identification capability.

Why the other options are wrong:

• A. Biometric data is special category data regardless of whether it reveals health, gender, or race; the identifier itself is sensitive.
• B. Being part of an authentication process does not change the data classification; it remains personal data and is special category if biometric.
• C. Biometric data is personal data by definition when it can uniquely identify a person, regardless of whether it is linked to a user ID.

Correct answer: A

Organizations responsible for AI governance typically use role-specific, ethics-focused, and user education approaches tailored to different stakeholder needs. Providing technical AI development education to all technical employees is least likely because: (1) not all technical employees need to retool for AI development, (2) the focus should be on governance and responsible use rather than universal development capability, and (3) large organizations use specialized development teams. In contrast, training on ethics, role-specific governance, and customer education are standard responsible AI practices.

Why the other options are wrong:

• B. Ethics-based training is a core component of building a responsible AI culture in large organizations.
• C. Role-specific training based on governance mode (centralized, federated, or decentralized) is a best practice for effective AI governance.
• D. Educating customers and users about AI tool capabilities and limitations is essential for transparent and responsible AI deployment.

Correct answer: D

Establishing global AI governance requires training programs for ethical behavior, third- party risk management policies, and understanding cross-cultural norms due to varying regulations. However, publicly disclosing ethical principles is a disclosure practice rather than an infrastructural element. Infrastructure encompasses internal systems, policies, procedures, training, and processes. While public disclosure may flow from ethical commitments, it is not a necessary element of the underlying governance infrastructure itself. The core infrastructure focuses on internal capability and controls.

Why the other options are wrong:

• A. Training to foster an ethical culture is a foundational infrastructure element for responsible AI governance.
• B. Managing third-party risk through policies and procedures is essential infrastructure for global AI governance.
• C. Understanding differences in norms, regulations, and expectations across countries is critical for global governance infrastructure.

Correct answer: B

Regular audits of AI models directly address AI-specific risks to personal data by assessing model behavior, data handling, bias, and compliance. This is the most effective policy addition because it creates ongoing monitoring of the actual AI systems processing personal data. Senior management review is a process step but not a policy addition; prohibiting AI is impractical; and security training alone does not address model-level risks. Audits provide continuous oversight of the most critical AI-related data protection concern: ensuring models behave as intended and do not create unintended privacy or discrimination risks.

Why the other options are wrong:

• A. Senior management review is a governance process but not an effective policy addition to address AI-specific data risks.
• C. Prohibiting AI tools is neither feasible nor an effective approach to updating privacy policies for responsible AI use.
• D. Employee security training is important but does not directly address AI model- specific risks to personal data.

Correct answer: D

When a management consulting firm implements an AI system to support its own employees' operations, it is acting as a deployer. A deployer is an organization that uses an AI system in its operations. The firm is not a provider (vendor/developer), not a distributor (reseller), and not an authorized representative (legal agent for another party). The deployer role encompasses organizations that integrate AI systems into their business processes and bear responsibility for how those systems operate within their organization.

Why the other options are wrong:

• A. An authorized representative acts as a legal agent for another party, not for internal use of AI systems.
• B. A distributor sells or supplies AI systems; the firm is using the system internally, not distributing it.
• C. A provider develops or sells AI systems; the consulting firm is a user/operator of the technology, not the developer.

Correct answer: B

Using AI for resume screening and hiring decisions creates multiple documented risks: automation bias (over-relying on AI decisions), privacy violations (handling sensitive candidate data), and disparate impacts (algorithm perpetuating historical discrimination patterns). However, candidate quality is not a negative consequence created by the AI tool; in fact, addressing bias through AI screening could potentially improve candidate quality by reducing human reviewer bias. The other three options are well-established risks specific to AI hiring systems that organizations implementing such tools must mitigate.

Why the other options are wrong:

• A. Automation bias-over-trusting AI recommendations without human review-is a significant risk of AI hiring tools.
• C. Privacy violations through improper handling of candidate personal data is a major compliance and ethical risk of AI hiring systems.
• D. Disparate impacts-the algorithm may discriminate against protected groups-is a documented risk of AI hiring tools.

Correct answer: A

Finance and Legal are the critical additional stakeholders for AI hiring tool selection. Finance must evaluate costs and ROI to balance procurement's cost-reduction goals with responsible AI implementation. Legal is essential to ensure compliance with varying anti- discrimination and employment laws across jurisdictions, particularly given the company's global operations and stated concern that relevant laws vary and continue to change. These two departments address the core risks and compliance requirements specific to AI hiring.

Why the other options are wrong:

• B. While Compliance is relevant, Marketing has no critical role in hiring tool selection and implementation.
• C. Supply Chain is not relevant to hiring tool decisions, and Marketing lacks a key compliance role.
• D. Litigation is reactive rather than proactive in tool selection, and Product Development focuses on payroll offerings, not hiring infrastructure.

Correct answer: B

Product liability laws are the exception. Product liability applies to tangible goods with manufacturing defects or design flaws that cause injury. An AI hiring tool is a service/software solution, not a consumer product sold to the public. In contrast, anti- discrimination laws directly prohibit biased hiring practices, accessibility laws require equal access for disabled applicants, and privacy laws govern collection and use of applicant data. All three of these would increase liability for irresponsible deployment, but product liability laws would not apply to this hiring service.

Why the other options are wrong:

• A. Anti-discrimination laws directly apply to hiring and would increase liability if the AI tool discriminates.
• C. Accessibility laws require hiring processes to be accessible to individuals with disabilities.
• D. Privacy laws apply to how applicant data is collected, stored, and used by the AI tool.

Correct answer: D

The primary purpose of an AI impact assessment is to anticipate and manage potential risks and harms of an AI system. This is a foundational governance activity that identifies negative impacts before deployment, such as bias, privacy violations, safety issues, and fairness concerns. While impact assessments may inform whether conformity assessment is needed or require escalation to owners, these are downstream activities. Identifying benefits is secondary to risk identification. The core function is prospective risk and harm management.

Why the other options are wrong:

• A. Determining whether conformity assessment is needed may result from impact assessment findings but is not the primary purpose.
• B. Escalation is a follow-on action after findings are identified, not the primary purpose.
• C. Measuring benefits is not the main focus; impact assessments prioritize identifying risks and harms.

Correct answer: A

Aligning organizational impact assessment activities with relevant regulatory or legal requirements is the most effective governance action for high-risk third-party AI systems. This establishes a systematic, compliant framework that identifies and documents risks upfront, ensuring the organization understands legal obligations and can make informed decisions about the system's use. This approach is preventive and creates accountability. While re-evaluating purchases, establishing failure policies, and delegating authority are all relevant, none fundamentally addresses the core governance need to assess and understand regulatory alignment before or concurrent with implementation.

Why the other options are wrong:

• B. Re-evaluating and considering other vendors is reactive and may not solve inherent high-risk characteristics.
• C. Establishing failure policies is important but does not proactively assess or manage the initial risk.
• D. Delegating authority without impact assessment and regulatory alignment lacks the structure needed to manage high-risk systems.

Correct answer: A

Testing the AI tool pre- and post-deployment is the best measure to mitigate reputational harm. Pre-deployment testing identifies bias, errors, and fairness issues before the tool affects real hiring decisions. Post-deployment testing monitors ongoing performance and detects any emerging problems. This directly addresses the company's stated concern about bias and demonstrates responsible stewardship, protecting reputation. Indemnification shifts liability but does not prevent harm; stakeholder agreement alone does not ensure responsible use; and manually screening all applicants defeats the purpose of the tool and is not practical for the company's scale.

Why the other options are wrong:

• B. Indemnification transfers financial risk but does not prevent reputational harm from biased or unfair outcomes.
• C. Team agreement on selection does not ensure responsible deployment or mitigate reputational risk.
• D. Manual screening of all applicants is impractical, expensive, and contradicts the stated goal of the AI tool.

Correct answer: D

The most challenging aspect is that some of the data subject's data is unstructured and cannot be untangled from other data, including information about other individuals. When AI systems create profiles using scraped social media data, chatbot interactions, and website behavior, the resulting datasets are often intermingled and unstructured. Extracting only one user's data without exposing or inadvertently sharing other users' information is technically and logistically difficult. This directly impacts the company's ability to fulfill the access request. The other options are incorrect: synthetic data arguments are weaker legally, structured data is easier to search, and public data does not exempt disclosure obligations under most US state privacy laws.

Why the other options are wrong:

• A. Synthetic data arguments are not well-established in privacy law; disclosure obligations typically still apply.
• B. Structured data is actually easier to search, compile, and review than unstructured data.
• C. Public source origin does not exempt the company from providing the data subject's personal information under state privacy laws.

Correct answer: D

Updating the images in a creative way to demonstrate that it is the artist's work is most likely to enable copyright protection. U.S. copyright law requires human authorship and creative contribution. While an AI generates initial outputs, the artist's creative modifications, edits, curation, and artistic judgment applied post-generation establish sufficient human authorship to qualify for protection. The training data sources, tool mechanics, and prompt logs do not demonstrate the artist's creative contribution-they document AI input rather than human creativity applied to the final work.

Why the other options are wrong:

• A. Training data provenance does not establish the artist's copyright eligibility; the issue is human authorship of the final work.
• B. Understanding how the tool works does not demonstrate the artist's creative contribution to the output.
• C. A log of prompts alone does not establish sufficient human creativity; prompts are input instructions, not creative modification.

Correct answer: C

Under GDPR Article 9, processing special categories of personal data (including genetic and health data) is generally prohibited unless specific conditions are met. Explicit consent from data subjects is one of the primary lawful bases that allows such processing. While anonymization, preventive medicine purposes, and EU location may be relevant considerations, explicit consent is the fundamental requirement that must be ensured to guarantee compliance when processing genetic and health data.

Why the other options are wrong:

• A. Designing for preventive medicine does not automatically authorize processing of special category data without proper legal basis.
• B. Anonymized data falls outside GDPR scope entirely, but true anonymization is difficult to achieve with genetic data and is not the requirement here; consent is still needed for non-anonymized data.
• D. The processor's location and whether it uses cloud services are operational considerations unrelated to the fundamental requirement for lawful basis to process special categories of data.

Correct answer: A

GDPR Article 13/14 and Article 22 require controllers to provide data subjects with meaningful information about automated decision-making processes, specifically the existence of automated decision-making, meaningful information concerning the logic involved, and the consequences of such processing. This is the core transparency obligation for automated decision-making.

Why the other options are wrong:

• B. While controllers must provide information about personal data processed, the specific requirement for automated decision-making focuses on the logic and consequences rather than a detailed inventory of all data and inferences.
• C. Data protection impact assessments and legal bases are internal compliance documents that need not be disclosed to data subjects as part of the transparency principle.
• D. Contact details of the DPO and national authority are required disclosures but are separate from transparency obligations specific to automated decision-making logic and consequences.

Correct answer: A

To ensure GDPR compliance in AI model training, the most important foundational action is to fully anonymize training data. Anonymized data is not subject to GDPR, eliminating the regulatory burden entirely. This is more fundamental than retention schedules, data source selection, or volume minimization, as it addresses the root compliance question of whether GDPR applies at all to the training dataset.

Why the other options are wrong:

• B. A retention schedule is important for data governance but does not address the primary GDPR compliance concern for training data, which is whether the data is subject to regulation in the first place.
• C. Sourcing from reputable companies does not guarantee GDPR compliance or address the fundamental requirements for lawful processing of training data.
• D. While data minimization is a GDPR principle, full anonymization eliminates regulatory requirements entirely, making it the most important compliance action.

Correct answer: A

Under the EU AI Act, General Purpose AI models with systemic risk face additional stringent requirements beyond those for other AI systems. Publishing a detailed summary of training data is a compliance obligation specific to GPAI models with systemic risk, designed to ensure transparency about these high-impact systems. This requirement is not imposed equally on all AI models.

Why the other options are wrong:

• B. Maintaining technical documentation and testing details is required for high-risk AI systems generally, not uniquely for GPAI models with systemic risk.
• C. Intellectual property policies related to copyright compliance are general business requirements, not specific obligations under the EU AI Act for systemic risk GPAI.
• D. Making information available to downstream providers is a general requirement for providers in the AI value chain, not specific to GPAI with systemic risk.

Correct answer: D

Offering personalized recommendations and targeted advertising to users based on their behavior is a standard, well-established e-commerce and digital marketing practice that has long been permitted under consumer protection laws. While it raises privacy considerations, it does not inherently raise novel consumer protection concerns. In contrast, AI in credit decisions, false claims about AI accuracy, and using scraped content all trigger specific consumer protection, fair lending, unfair competition, or copyright concerns.

Why the other options are wrong:

• A. AI in credit decisions raises serious fair lending and discrimination concerns under consumer protection and financial regulation laws.
• B. Making false or unsubstantiated claims that AI is as accurate as humans constitutes deceptive advertising under consumer protection laws.
• C. Using scraped digital content to generate summaries raises copyright infringement and intellectual property concerns under consumer and content protection laws.

Correct answer: C

The primary driver for EU Product Liability Directive updates is to modernize liability rules for digital services, AI systems, and connected/smart products that did not exist when the original directive was enacted. The directive needs updating to address software defects, AI system failures, and networked product vulnerabilities that fall outside traditional product liability concepts.

Why the other options are wrong:

• A. Increasing minimum warranty levels is not the focus of the Product Liability Directive updates.
• B. The directive updates aim to clarify liability rather than create new exemptions, particularly for digital and AI products.
• D. While open-source software raises interesting questions, addressing digital services and connected products is the primary regulatory concern driving the updates.

Correct answer: D

Under the EU AI Act, AI systems that assess the risk of a person committing a crime based on profiling or personal characteristics are explicitly prohibited. CrimeBuster 7909, which predicts recidivism based on information about incarcerated individuals, falls into this prohibited category of social scoring and criminal risk assessment AI that the EU AI Act bans to protect fundamental rights.

Why the other options are wrong:

• A. The EU does not have a registration database for all AI tools; this system would simply be prohibited, not registered.
• B. Privacy enhancing technologies would not cure the fundamental prohibition on this type of criminal risk assessment system.
• C. There is no approval process that would allow this system to operate in the EU; it falls under prohibited practices, not regulated high-risk systems.

Correct answer: C

Under the EU AI Act, organizations deploying high-risk AI systems must disclose the fact that AI is being used, human oversight measures, and how individuals may contest decisions. However, specific information about where data is stored is not a required disclosure under the high-risk AI transparency obligations, as it is operational rather than necessary for understanding the AI system's impact on the data subject.

Why the other options are wrong:

• A. Human oversight measures are explicitly required to be disclosed for high-risk AI systems.
• B. Information on how to contest decisions is a core requirement for high-risk AI transparency and due process.
• D. The fact that an AI system is being used is a fundamental disclosure requirement under the EU AI Act for high-risk systems.

Correct answer: A

The EU AI Act requires providers of high-risk AI systems to keep relevant documentation available to national competent authorities for 10 years after the system has been placed on the market. This extended retention period ensures regulatory oversight, investigation capabilities, and accountability for systems that pose significant risks to fundamental rights and safety.

Why the other options are wrong:

• B. 8 years is shorter than the actual requirement under the EU AI Act.
• C. 6 years does not align with the EU AI Act's documentation retention timeframe.
• D. 5 years is insufficient for the compliance period specified in the regulation.

Correct answer: D

The OECD's Ethical AI Governance Framework proposes a balanced approach that seeks to prevent societal harms by balancing AI innovation with ethical considerations. This reflects the OECD's philosophy of enabling beneficial AI development while ensuring safeguards, rather than focusing narrowly on technical design, data sourcing, or industry- specific requirements alone.

Why the other options are wrong:

• A. While explainability and data ethics are important, this is too narrow and specific to be the main purpose of the framework.
• B. The OECD framework is not sector-specific; it provides general guidance applicable across domains.
• C. Technical design and monitoring are components, but not the overarching purpose of balancing innovation with ethics.

Correct answer: B

ISO 42001 is based on continuous improvement principles similar to other ISO management system standards. It requires organizations to establish processes for continuously improving the effectiveness of their AI management systems through monitoring, measurement, and iterative enhancement, ensuring that AI governance remains effective over time.

Why the other options are wrong:

• A. ISO 42001 does not impose specific minimum parameters but rather establishes a management system framework.
• C. While high-risk aspects are important, the standard's primary guidance is on establishing effective management systems broadly.
• D. ISO standards are additive; new standards do not explicitly override previous ones but rather complement the standards landscape.

Correct answer: A

Under the NIST AI Risk Management Framework's Govern function, accountability structures are designed to empower and train appropriate cross-functional teams to take responsibility for AI governance activities. This ensures that teams have the authority, skills, and resources needed to manage AI risks effectively across the organization.

Why the other options are wrong:

• B. While diversity and inclusion are important values, they are not the main purpose of accountability structures.
• C. Budgetary allocation is a resource management concern, not the primary purpose of establishing accountability.
• D. External stakeholder participation is beneficial but is not the main purpose of internal accountability structures.

Correct answer: A

NIST's Assessing Risks and Impacts of AI (ARIA) Program's initial pilot effort focuses on large language models (LLMs). This reflects the significant current impact and rapid deployment of LLMs in various applications, making them a priority area for systematic risk assessment and impact evaluation.

Why the other options are wrong:

• B. Text-to-image models, while important, were not the focus of ARIA's initial pilot effort.
• C. Recommender systems, though significant, were not selected for ARIA's initial pilot phase.
• D. Facial recognition systems have been studied extensively; LLMs represent a newer priority area for ARIA.

Correct answer: C

In the AI supply chain, the data aggregator is responsible for lawful collection of data used to train foundational models. The data aggregator is the entity that sources, curates, and provides training data, and must ensure that collection complies with applicable data protection, intellectual property, and other legal requirements. The technology company (who builds the model) and the marketing agency (who adapts it) rely on the aggregator's lawful data sourcing.

Why the other options are wrong:

• A. The marketing agency adapts the model but does not bear responsibility for the original training data collection.
• B. While the tech company may provide guidance, the data aggregator is the party responsible for actual data collection practices.
• D. The client uses the final advertising output but has no role in the foundational model's training data procurement.

Correct answer: A

Sending ads to construction companies rather than individual workers is a targeting and distribution decision, not a bias in the AI system's outputs. The product is designed for all construction workers regardless of gender, so targeting by company is a legitimate marketing channel choice. The other options (B, C, D) all represent problematic biases: insufficient content for minorities, sexualized imagery, and gendered messaging both represent discriminatory AI outputs.

Why the other options are wrong:

• B. Generating insufficient content for minority workers is discriminatory bias in output quality.
• C. Hyper-sexualized images of female workers represent objectifying and biased outputs.
• D. Focusing on color and style for female audiences while presumably emphasizing protection for others is gender-based bias in messaging.

Correct answer: B

Proprietary methods and trade secrets should not be disclosed in marketing and compliance disclosures, as they represent confidential business information that the company has a right to protect. Disclosures should include intended purpose, legal compliance, and limitations to ensure transparency and user understanding, but proprietary methodology details remain protected intellectual property.

Why the other options are wrong:

• A. Intended purpose must be disclosed so users understand how the AI is meant to be used.
• C. Compliance with applicable laws is essential information that must be communicated.
• D. Acknowledgement of limitations is crucial for transparent and responsible AI disclosure.

Correct answer: D

While the marketing agency has completed numerous individual risk mitigation measures (impact assessments, bias guidance, technical controls, legal disclosures), establishing a governance committee would provide ongoing oversight, decision-making authority, and accountability throughout the project lifecycle. A governance committee ensures coordinated review of AI outputs, manages emerging risks, facilitates cross-functional collaboration, and provides structured governance-something that existing individual measures do not collectively accomplish. This is a best practice for responsible AI deployment.

Why the other options are wrong:

• A. IP indemnity addresses intellectual property risk but does not provide holistic governance oversight of AI project risks.
• B. Evaluating industry best practices is valuable but occurs too late; the agency should establish governance before or concurrent with implementation.
• C. Third-party procurement selection does not address the governance and oversight needed for an active AI project already underway.

Correct answer: A

A non-profit developing a social media presence can be best served by non-AI solutions such as standard social media platforms, content calendars, community management tools, and manual posting schedules. This use case does not require pattern detection, personalization, automation, or complex decision-making that would justify AI complexity and cost. Options B, C, and D inherently benefit from AI's capacity for pattern recognition, personalization, and automated decision-making.

Why the other options are wrong:

• B. Business analysts developing advertising campaigns benefit significantly from AI- driven insights, audience segmentation, and campaign optimization.
• C. E-commerce personalized recommendations are a core AI application that learns customer preferences and improves through machine learning.
• D. Automating answers to common customer service questions is a standard and effective AI use case that reduces manual effort and improves response time.

Correct answer: A

Training data is the subset of data used to enable a model to detect and learn patterns through iterative optimization during the training process. This is the fundamental definition and primary purpose of training data. Options B, C, and D describe other data-related concepts or purposes that occur at different stages of the AI lifecycle but are not the core definition of training data itself.

Why the other options are wrong:

• B. Fine-tuning and overfitting prevention typically use validation/test data, not the definition of training data.
• C. Detecting initial bias sources is an analysis step separate from training data's core function of pattern learning.
• D. Resembling production data structure is a goal in data preparation but not the definition of what training data is used for.

Correct answer: C

Impact assessment occurs in the design phase of the AI lifecycle, where stakeholders evaluate potential risks, harms, and implications before development and deployment. This forward-looking analysis is essential for responsible project planning and scoping. Options A, B, and D occur in later phases: data augmentation is a data preparation/preprocessing activity, model explainability is developed during modeling, and performance evaluation occurs during testing and validation phases.

Why the other options are wrong:

• A. Data augmentation is a data preparation technique occurring before or during model training, not in the design phase.
• B. Model explainability is developed during the modeling and implementation phases, after design is complete.
• D. Performance evaluation occurs during testing and validation phases, after the model is built.

Correct answer: A

The first action in mapping, planning, and scoping an AI project is defining the business case and performing a cost/benefit analysis to answer 'why AI?'-establishing whether AI is the appropriate solution. This foundational step precedes all other activities. Without clarity on business justification and whether AI is necessary, subsequent technical and governance steps lack proper direction. Options B, C, and D are important but occur after this initial business validation.

Why the other options are wrong:

• B. TEVV (test, evaluation, verification, validation) is a quality assurance process occurring during and after development, not at project initiation.
• C. Algorithmic impact assessment occurs during design, after the business case has justified the AI approach.
• D. Determining feasibility and redress options occurs after business justification and during project planning phases.

Correct answer: D

A typical AI impact assessment covers fundamental rights (fairness, non-discrimination, autonomy), data protection (privacy, consent, data governance), and safety (robustness, security, reliability). These are the core ethical and regulatory domains assessed in responsible AI governance frameworks. Options A, B, and C include relevant considerations but do not accurately reflect the standard subject areas covered by formal impact assessments.

Why the other options are wrong:

• A. While third-party, model, and legal risks are important, they are not the standard subjects of an impact assessment.
• B. Datasets, behavior, and tooling are implementation details, not the ethical and rights- focused subjects of impact assessments.
• C. Toxicity, accuracy, and development are technical concerns but do not comprehensively describe impact assessment subject matter.

Correct answer: C

The most important reason for requiring cross-functional stakeholder collaboration during the AI development lifecycle is to establish accountability. By involving diverse perspectives (technical, legal, ethical, business, domain-specific), responsibility for decisions and outcomes becomes distributed and traceable across the organization, ensuring no single perspective dominates and that decision-making is transparent and defensible. This foundational principle enables all other good outcomes.

Why the other options are wrong:

• A. Minimizing third-party involvement is not a primary goal; third-party expertise is often necessary and valuable.
• B. User-centric design is a benefit of cross-functional collaboration but not the most fundamental reason for requiring it.
• D. Minimizing liability is a motivation but less fundamentally important than establishing clear accountability for ethical and responsible AI development.

Correct answer: B

The most important ethical concern is whether the AI was trained on a representative dataset. If the training data does not adequately represent the diverse patient populations the hospital serves (by demographics, medical conditions, etc.), the AI may produce biased or inaccurate diagnoses for underrepresented groups, leading to disparities in care quality. This directly impacts patient safety and fairness. While options C and D address related quality concerns, representativeness of training data is the foundational ethical issue that determines whether the system can safely serve all patients equitably.

Why the other options are wrong:

• A. Economic benefit to patients, while desirable, is not the primary ethical concern in diagnostic AI safety and fairness.
• C. Physician understanding of the AI is important for appropriate use but is secondary to ensuring the AI itself is fair and accurate across populations.
• D. Comparable error rates to human physicians, while important, do not address whether those errors are distributed equitably across patient populations.

Correct answer: A

When a development team departs, comprehensive documentation of the entire AI lifecycle becomes critical institutional knowledge. A library of all documentation ensures continuity of governance, allows new teams to understand model design decisions, deployment considerations, and oversight procedures. This is the only option that preserves organizational knowledge independent of personnel changes.

Why the other options are wrong:

• B. Non-compete clauses don't guarantee these employees will return or maintain the model effectively.
• C. An oversight committee cannot function without proper understanding of the model's history and design principles.
• D. A trust center describes public ethical principles but doesn't address internal governance and operational maintenance of the specific model.

Correct answer: D

Under the EU AI Act, high-risk AI systems must comply with requirements including system-generated log retention for at least six months (A), post-market monitoring (B), and conformity assessments (C). However, publishing a detailed report on training data is not an explicit requirement for high-risk systems under the EU AI Act's main provisions, though data documentation may be required in certain contexts.

Why the other options are wrong:

• A. Six-month log retention is explicitly required for high-risk systems.
• B. Post-market monitoring is a mandatory obligation for high-risk AI system providers.
• C. Conformity assessment is a core requirement for high-risk AI systems before market placement.

Correct answer: C

The EU AI Act's enforcement provisions include warnings for violations (A), proportionally capped fines for SMEs and startups (B), and significant fines up to €35 million or 7% of global turnover for banned AI applications (D). However, rules on General Purpose AI will be enforced 12 months (not 6 months) after the Act comes into force, making option C the exception.

Why the other options are wrong:

• A. Warnings are explicitly allowed as enforcement measures for violations.
• B. SMEs and startups do receive proportional caps on fines under the Act.
• D. The €35 million or 7% turnover fine threshold is correct for banned AI applications.