Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Which of the following deployments of generative Al best respects intellectual property rights?
Respecting intellectual property rights means adhering to licensing terms and ensuring that generated content complies with these terms. A system that categorizes and applies filters based on licensing terms ensures that content is used legally and ethically, respecting the rights of content creators. While providing attribution is important, categorization and application of filters based on licensing terms are more directly tied to compliance with intellectual property laws. This principle is elaborated in the IAPP AIGP Body of Knowledge sections on intellectual property and compliance.
CASE STUDY
Please use the following answer the next question:
A local police department in the United States procured an Al system to monitor and analyze social media feeds, online marketplaces and other sources of public information to detect evidence of illegal activities (e.g., sale of drugs or stolen goods). The Al system works by surveilling the public sites in order to identify individuals that are likely to have committed a crime. It cross-references the individuals against data maintained by law enforcement and then assigns a percentage score of the likelihood of criminal activity based on certain factors like previous criminal history, location, time, race and gender.
The police department retained a third-party consultant assist in the procurement process, specifically to evaluate two finalists. Each of the vendors provided information about their system's accuracy rates, the diversity of their training data and how their system works. The consultant determined that the first vendor's system has a higher accuracy rate and based on this information, recommended this vendor to the police department.
The police department chose the first vendor and implemented its Al system. As part of the implementation, the department and consultant created a usage policy for the system, which includes training police officers on how the system works and how to incorporate it into their investigation process.
The police department has now been using the Al system for a year. An internal review has found that every time the system scored a likelihood of criminal activity at or above 90%, the police investigation subsequently confirmed that the individual had, in fact, committed a crime. Based on these results, the police department wants to forego investigations for cases where the Al system gives a score of at least 90% and proceed directly with an arrest.
Which Al risk would NOT have been identified during the procurement process based on the categories of information requested by the third-party consultant?
The AI risk that would not have been identified during the procurement process based on the categories of information requested by the third-party consultant is security. The consultant focused on accuracy rates, diversity of training data, and system functionality, which pertain to performance and fairness but do not directly address the security aspects of the AI system. Security risks involve ensuring that the system is protected against unauthorized access, data breaches, and other vulnerabilities that could compromise its integrity. Reference: AIGP Body of Knowledge on AI Security and Risk Management.
CASE STUDY
Please use the following to answer the next question:
You have recently assumed the role of AI Governance leader for a California-based medical technology company. The organization primarily serves hospitals and has recently expanded to include walk-in clinics located within local pharmacies.
The company's core business focuses on diagnostic assistance powered by a large language model LLM and back-office process optimization using Agentic AI, including chatbots, medical record request handling, scheduling and billing.
In preparation for its next round of funding, the board has asked you to prepare an AI Risk report to demonstrate to investors how the company is addressing AI-related risks. In preparing the report you learn that last year the company generated 30 million dollars in gross revenue across the US, EU, India, and South Korea and that vendors are engaged for various activities, including model testing and providing third-party AI solutions for chatbots.
Which of the following best exemplifies human oversight capabilities you should enable under the relevant AI laws?
The correct answer is A because it directly demonstrates meaningful human oversight over AI-generated outcomes, which is a key requirement in AI governance frameworks and regulations such as the EU AI Act. Human oversight requires that a qualified human can review, intervene, and override AI decisions before they produce legal or significant real-world effects. In high-risk contexts like healthcare diagnostics, governance frameworks emphasize ''human-in-the-loop'' controls to prevent harm and ensure accountability. Option A ensures a licensed medical professional validates the AI output before it is finalized, aligning with safety, accountability, and risk mitigation principles. Other options describe training, system design, or monitoring, which are important governance measures but do not constitute direct oversight of individual AI decisions at the point of impact, making them insufficient under strict regulatory expectations.
Business A sells software that provides users with writing and grammar assistance. Business B is a cloud services provider that trains its own AI models.
* Business A has decided to add generative AI features to their software.
* Rather than create their own generative AI model, Business A has chosen to license a model from Business B.
* Business A will then integrate the model into their writing assistance software to provide generative AI capabilities.
* Business A is most concerned that its writing assistance software could recommend toxic or obscene text to its users.
Which of the following governance processes should Business A take to best protect its users against potentially inappropriate text?
Business A is integrating a generative AI model licensed from a third party (Business B) and is primarily concerned with the risk of toxic or obscene outputs being delivered to users. In this scenario,testing and validationof the AI model for such content risks is the most direct and effective governance strategy.
According to theAI Governance in Practice Report 2025, organizations thatdeployAI must engage inperformance monitoring protocolsand ensure systems perform adequately for theirintended purposes, including filtering harmful content:
''Operational governance... development of: Performance monitoring protocols to ensure systems perform adequately for their intended purposes.'' (p. 12)
''Product governance... includes: System impact assessments to identify and address risk prior to product development or deployment.'' (p. 11)
Furthermore, under theEU AI Act, which sets the global standard many organizations aim to align with, there is a clear obligation to test and monitor systems for potential harmful behavior:
''The act imposes regulatory obligations... such as establishing appropriate accountability structures,assessing system impact, providing technical documentation,establishing risk management protocols and monitoring performance...'' (p. 7)
Option B directly reflects this best practice ofpre-deployment testing and validationto ensure that the model aligns with Business A's minimum content safety requirements.
Let's now evaluate the incorrect options:
A . Fine-tuning on verified user-generated textmay improve model alignment but does not guarantee that the model will generalize correctly, especially if Business A lacks access to model internals (common in third-party licensing scenarios). Fine-tuning also introduces its own risks and may be contractually restricted.
C . A user reporting featureisreactive, not preventive. While helpful for long-term monitoring and mitigation, it does not prevent the initial harm of toxic outputs, which isBusiness A's primary concern.
D . Requesting documentation from Business Bis useful for transparency and risk management, but it does not replaceindependent verificationthat the model meets Business A's content safety standards.
Thus,testing the model's behavior for unacceptable outputs before deploymentis the most aligned approach with AI governance best practices and obligations.
A deployer discovers that a high-risk AI recruiting system has been making widespread errors, resulting in harms to the rights of a considerable number of EU residents who are denied consideration for jobs for improper reasons such as ethnicity, gender and age.
According to the EU AI Act, what should the company do first?
Under theEU AI Act, serious incidents involvinghigh-risk AI systemsmust be reported. The deployer is required topromptly inform the provider and relevant authoritiesabout the issue.
From theAI Governance in Practice Report 2025:
''Serious incidents involving high-risk systems... must be reported to the provider and relevant market surveillance authority.'' (p. 35)
''Timely reporting is required when AI systems result in or may result in violations of fundamental rights.'' (p. 35)
According to the GDPR, what is an effective control to prevent a determination based solely on automated decision-making?
The GDPR requires that individuals have the right to not be subject to decisions based solely on automated processing, including profiling, unless specific exceptions apply. One effective control is to establish a human-in-the-loop procedure (D), ensuring human oversight and the ability to contest decisions. This goes beyond just-in-time notices (A), data safeguarding (B), or review rights (C), providing a more robust mechanism to protect individuals' rights.
Pursuant to the White House Executive Order of November 2023, who is responsible for creating guidelines to conduct red-teaming tests of Al systems?
The White House Executive Order of November 2023 designates the National Institute of Standards and Technology (NIST) as the responsible body for creating guidelines to conduct red-teaming tests of AI systems. NIST is tasked with developing and providing standards and frameworks to ensure the security, reliability, and ethical deployment of AI systems, including conducting rigorous red-teaming exercises to identify vulnerabilities and assess risks in AI systems.
Exam domains verified against: Official IAPP AIGP exam guide, last checked October 2026.
Understand core concepts of AI and machine learning, different types of AI models and systems, and the AI development life cycle.
Identify core harms and impacts of AI, recognize characteristics of trustworthy AI systems, and apply ethical guidance.
Establish AI strategy and AI governance, conduct AI risk identification and assessment, and apply risk management frameworks and standards.
Sample question from this domain above: Q4
Apply global AI-specific regulations, understand existing laws that apply to AI, navigate GDPR intersections, assess IP legislation and AI impacts, and evaluate liability reform.
Govern design and development of AI systems and manage the collection and use of data in training and testing.
Assess key factors and risks relevant to deployment decisions, evaluate the AI model, and establish governance for deployment and use.
Common questions about the exam itself
