Free AIGP Practice Test Questions and Answers (2026)

Under the EU AI Act, an importer is the entity that first places an AI system from a third country onto the EU market. Their primary role is to act as a gatekeeper by verifying compliance. Article 26 of the Act obligates the importer to ensure that the provider has carried out the necessary conformity assessment procedure and has drawn up the required technical documentation and the EU Declaration of Conformity. This verification is a crucial step before the product can be marketed in the EU, ensuring that non-EU systems meet the same high standards.

A. Provide technical documentation.

This is an obligation of the provider of the AI system, who develops the system and must create this documentation. The importer only verifies its existence.

B. Affix the CE marking.

This is the responsibility of the provider after successfully completing the conformity assessment. The importer's duty is to check that this marking is present.

D. Conduct a data protection impact assessment.

This is an obligation under the GDPR for the deployer (user) of the AI system if it processes personal data in a way that poses a high risk.

1. European Commission

Proposal for a Regulation on a European approach for Artificial Intelligence (consolidated text

Jan. 2024).

Correct Answer (C): Article 26(1) outlines the obligations of importers

stating they shall ensure "the appropriate conformity assessment procedure referred to in Article 43 has been carried out by the provider" and that the provider "has drawn up the EU declaration of conformity in accordance with Article 48."

Incorrect Option (A): Article 16(1)(g) specifies that providers shall "draw up the technical documentation referred to in Article 11."

Incorrect Option (B): Article 16(1)(j) and Article 49 mandate that the provider is responsible for drawing up the EU declaration of conformity and affixing the CE marking.

2. General Data Protection Regulation (GDPR) (EU) 2016/679.

Incorrect Option (D): Article 35 requires the controller (often the deployer/user of an AI system) to carry out a data protection impact assessment prior to processing that is likely to result in a high risk. This is not an importer's obligation under the AI Act.

Supervised learning is a fundamental paradigm in machine learning where an algorithm learns from a dataset containing input-output pairs, known as "labeled data." The goal is for the model to learn a mapping function that can predict the output variable (label) for new, unseen input data. The "supervision" comes from the labeled training data, which acts as a teacher, guiding the algorithm to produce correct outcomes. Common supervised learning tasks include classification (predicting a category) and regression (predicting a continuous value).

A. Segmentation is a task, often associated with clustering in unsupervised learning, that involves dividing a dataset into groups of similar items. It is not a learning paradigm defined by labeled data.

B. Generative AI is a category of AI focused on creating new content. While it can be trained using supervised methods, its defining characteristic is generation, not the specific training methodology.

C. Expert systems are a form of AI that relies on a pre-programmed knowledge base and a set of rules to solve problems, rather than learning from labeled data like machine learning models.

1. Russell

S. J.

& Norvig

P. (2020). Artificial Intelligence: A Modern Approach (4th ed.). Pearson. In Chapter 19

"Learning from Examples

" the text defines supervised learning: "In supervised learning

the agent observes some example input–output pairs and learns a function that maps from input to output." (p. 694).

2. Stanford University. (2018). CS229 Machine Learning Course Notes. "In supervised learning

we are given a data set and already know what our correct output should look like

having the idea that there is a relationship between the input and the output. Supervised learning problems are categorized into 'regression' and 'classification' problems." (p. 2).

3. Ayodele

T. O. (2010). Types of machine learning algorithms. In New Advances in Machine Learning. IntechOpen. This chapter distinguishes the major types

stating

"Supervised learning is the machine learning task of inferring a function from labeled training data." (Section 2.1

para. 1). DOI: https://doi.org/10.5772/9385

Testing an AI tool both before deployment and continuously after deployment is a cornerstone of responsible AI governance and risk management. Pre-deployment testing allows XYZ to assess the tool for fairness, accuracy, and potential biases using historical or synthetic data before it impacts real job applicants. Post-deployment monitoring is crucial for detecting model drift, performance degradation, or emergent biases that can arise when the tool interacts with new, real-world data. This comprehensive "Test, Evaluation, Validation, and Verification" (TEVV) approach is the most direct and effective method to ensure the tool functions as intended and to prevent discriminatory or unfair outcomes that would lead to severe reputational harm.

B. This is a risk transference strategy for financial liability, but it does not prevent the initial incident or the resulting reputational damage to XYZ Corp.

C. Prioritizing the most economical tool over one with robust safety, fairness, and transparency features is likely to increase, not mitigate, the risk of reputational harm.

D. This avoids using the AI tool rather than mitigating the risks of its use, thereby failing to achieve the organization's stated goals of improving efficiency and cost-effectiveness.

---

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Page 19

Section 3.3.3

MEASURE Function: The framework states

"Pre-deployment TEVV is necessary but not sufficient. Post-deployment monitoring of AI systems in operation is a critical part of a risk management process." This directly supports the need for both pre- and post-deployment testing to manage risks.

2. European Commission's High-Level Expert Group on AI. (2019). Ethics Guidelines for Trustworthy AI.

Page 17

Chapter II

Requirement 4: Technical Robustness and safety: The guidelines emphasize that for an AI system to be trustworthy

it must be tested and validated throughout its life cycle. It states

"This requires that AI systems are verified and validated in their development process and

where applicable

in the system’s deployment context."

3. Organisation for Economic Co-operation and Development (OECD). (2019). Recommendation of the Council on Artificial Intelligence (OECD AI Principles).

Section 1

Principle 1.3: Robustness

Security and Safety: This principle states that "AI systems should be robust

secure and safe throughout their entire lifecycle... so that they function appropriately and do not pose unreasonable safety risks." The term "entire lifecycle" explicitly includes both the development/pre-deployment phase and the operational/post-deployment phase

necessitating continuous assessment.

According to the Organization for Economic Cooperation and Development (OECD) framework for AI governance, tools are categorized based on their nature and function. Codes of conduct and collective agreements are classified as procedural tools. This is because they establish processes, rules, and organizational guidelines that govern the behavior of individuals and the operations of an organization in the development and deployment of AI systems. They are not technical implementations but rather frameworks that guide decision-making and ensure accountability through established procedures.

A. Educational: Educational tools are designed to increase knowledge and awareness, such as training programs or certification courses, not to establish binding operational rules.

C. Technical: Technical tools refer to software, hardware, or algorithmic solutions used to assess or control AI systems, such as bias detection algorithms or explainability libraries.

D. Analytic: While analysis is part of governance, "analytic tools" is not a primary OECD classification for governance instruments like codes of conduct. These tools are about establishing processes, not just analysis.

1. OECD. (2023). Tools for Trustworthy AI: A framework to compare tools for trustworthy AI systems. OECD Publishing

Paris.

Reference: In Section 2.2

"A typology of tools for trustworthy AI

" the report outlines three main categories: "Technical tools

" "Process-based tools

" and "Educational tools." Codes of conduct and similar governance frameworks fall under "Process-based tools

" which are synonymous with procedural tools as they "help organisations manage the development and use of AI systems" (p. 13).

2. Stanford University Human-Centered Artificial Intelligence (HAI). (2023). Artificial Intelligence Index Report 2023.

Reference: Chapter 6

"Policy and Governance

" discusses the landscape of AI policy instruments. It implicitly supports the classification of codes of conduct as procedural mechanisms by grouping them with other governance frameworks and regulations that guide organizational processes

distinct from technical standards or public education initiatives (pp. 226-228).

3. OECD. (2021). State of Implementation of the OECD AI Principles: Insights from National AI Policies. OECD Publishing

Paris.

Reference: This report discusses various "Policy instruments and governance mechanisms" (p. 41). It describes codes of conduct and ethical guidelines as key instruments that countries are using to operationalize AI principles

treating them as procedural and governance-level interventions rather than technical or purely educational ones.

AI governance frameworks are designed to address the tangible characteristics and risks of current and near-term AI systems. Autonomy (acting without direct human control), automation (of cognitive tasks), adaptability (learning from new data), and the ability to operate at immense speed and scale are all fundamental, existing characteristics of AI. These attributes create unique challenges for accountability, safety, and fairness, necessitating comprehensive governance. Superintelligence, a hypothetical future state where AI surpasses human intelligence across all domains, is a speculative concept. While it is a topic of long-term ethical and safety research, it is not a characteristic of present-day AI that practical, contemporary governance structures are built to manage.

A. Autonomy: AI's capacity to operate independently is a core reason for governance, as it raises critical questions about control, liability, and decision-making accountability.

B. Automation: The automation of complex tasks by AI systems introduces risks like algorithmic bias and workforce displacement, which are central concerns for AI governance.

C. Adaptability: The ability of AI models to change over time (e.g., model drift) requires continuous monitoring and management, a key function of a robust governance program.

D. Speed and scale: AI operates at a velocity and scale that can amplify errors and biases rapidly, making human oversight difficult and robust governance frameworks essential.

1. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. In Section 3.1

"AI systems have a unique set of characteristics

" the framework highlights that AI systems are "dynamic" (Adaptability) and can "operate at a speed and scale that makes human oversight challenging" (Speed and scale)

which are core drivers for the RMF's governance guidance.

2. OECD. (2019). Recommendation of the Council on Artificial Intelligence. OECD/LEGAL/0449. The commentary accompanying the principles

particularly for "Robustness

Security and Safety

" notes that AI systems can "act with a certain degree of autonomy

" which necessitates specific safeguards and governance mechanisms.

3. Floridi

L.

& Cowls

J. (2019). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review

1(1). https://doi.org/10.1162/99608f92.8cd550d1. The article identifies AI's autonomy and its learning capacity (Adaptability) as key features that distinguish it and require a specific ethical and governance approach.

4. Bostrom

N. (2014). Superintelligence: Paths

Dangers

Strategies. Oxford University Press. This foundational text defines and analyzes superintelligence as a potential

future development

distinguishing it from the capabilities of contemporary AI systems that are the subject of current governance frameworks.

The selection and implementation of a significant third-party AI tool requires a multi-stakeholder approach addressing both financial and legal risks. The Finance department is a crucial stakeholder for budget approval, assessing the return on investment (ROI), and managing the financial implications of a major technology procurement, working alongside the cost-focused procurement team. The Legal department is indispensable for ensuring the AI tool and the vendor's practices comply with a complex and evolving landscape of employment, anti-discrimination, and AI-specific laws across various jurisdictions, as highlighted in the case. They are also essential for contract negotiation to mitigate liability and ensure data protection.

B. Marketing and Compliance: Marketing is not a core stakeholder for selecting an internal HR tool. While Compliance is relevant, Legal is the more primary and encompassing function for this scenario.

C. Supply Chain and Marketing: Supply Chain is irrelevant for a software-as-a-service procurement, and Marketing's role is peripheral to the selection and implementation process.

D. Litigation and Product Development: Involving only the Litigation team is reactive; the broader Legal department is needed for proactive counsel. The Product Development team is a beneficiary, not a selector, of the HR tool.

1. NIST. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). U.S. Department of Commerce

National Institute of Standards and Technology. In the "GOVERN" function

the framework emphasizes that AI risk management is a "whole-of-organization endeavor" requiring "a diverse set of expertise from across the organization

including... business process owners

legal

procurement

and IT..." (p. 20

Section 3.2

GOVERN). This directly supports the critical involvement of the Legal department in procurement and governance.

2. Stanford University Human-Centered Artificial Intelligence (HAI). (2021). From Principles to Practice: An Interdisciplinary Framework for Operationalizing AI Ethics. This paper discusses the necessity of "multistakeholder deliberation" in AI governance

which includes legal and business units to ensure that AI systems align with legal requirements and organizational financial objectives (p. 5-6). This reinforces the need for both Legal and Finance involvement.

3. World Economic Forum. (2023). AI Governance Alliance: Briefing Paper Series - A Guide to Generative AI in Organizations. This guide emphasizes creating cross-functional teams for AI adoption

stating

"Key functions to involve include legal

compliance

cybersecurity

IT

HR

finance and communications" (p. 11). This explicitly lists both Finance and Legal as key stakeholders in organizational AI governance.

The IEEE 7000-2021 standard provides a specific process model for integrating ethical considerations and human values directly into the system design and development lifecycle. This approach is known as value-based engineering or Values-in-Design. The standard guides organizations in identifying and prioritizing ethical values (e.g., well-being, accountability, transparency), translating them into tangible system requirements, and verifying that the final system upholds these values. It is fundamentally a methodology for engineering systems based on explicit ethical values, making it the correct choice.

A. ISO/IEC Guide 51 (Safety).

This guide focuses specifically on incorporating safety aspects into standards. While safety is a value, this framework is too narrow and does not encompass the broader range of ethical considerations addressed by value-based engineering.

B. ISO 31000 Guidelines (Risk Management).

This is a generic, high-level framework for managing risk in any organization. It is not specific to AI or system design and does not prescribe a methodology for embedding ethical values into engineering processes.

D. Council of Europe Human Rights, Democracy, and the Rule of Law Assurance Framework (HUDERIA) for Al Systems.

This is an assurance and assessment framework used to evaluate an AI system's compliance with human rights and democratic principles, rather than a methodology for the initial design and engineering of the system.

---

1. IEEE Std 7000™-2021. IEEE Standard Model Process for Addressing Ethical Concerns During System Design. IEEE Xplore Digital Library. The standard's abstract explicitly states

"This standard provides a process model by which engineers and other technologists can address ethical considerations throughout the various stages of system initiation

analysis

and design." This directly aligns with the concept of value-based engineering. (DOI: 10.1109/IEEESTD.2021.9597522)

2. Spiekermann

S. (2015). Ethical IT Innovation: A Value-Based System Design Approach. CRC Press. Chapter 4

"Value-based System Design

" details the methodology that underpins standards like IEEE 7000

focusing on translating human values into technical specifications.

3. International Organization for Standardization. (2018). ISO 31000:2018 - Risk management — Guidelines. ISO.org. The scope section clarifies that it provides generic guidelines for managing any type of risk and is not specific to a particular industry or design methodology.

4. International Organization for Standardization. (2014). ISO/IEC Guide 51:2014 - Safety aspects — Guidelines for their inclusion in standards. ISO.org. The introduction specifies its purpose is to assist standard-writers in addressing safety

a much narrower focus than the holistic value-based approach.

The planning phase of the AI lifecycle focuses on establishing the strategic foundation for the project. This includes defining the business problem, understanding the operational context, identifying stakeholders, defining underlying assumptions about data and outcomes, and establishing the governance framework. The specific choice of a technical model architecture is a detailed design and development decision that occurs after the initial planning phase is complete. Planning sets the requirements and constraints that will later guide the selection of an appropriate architecture.

A. Definition of underlying assumptions: This is a core planning activity to clarify the project's basis, scope, and limitations before development begins.

B. Approach to governance: Establishing governance principles and oversight structures early in the planning phase is crucial for responsible AI development.

D. Context in which the model will operate: Understanding the operational context is fundamental to planning, as it defines the system's purpose, requirements, and potential impacts.

1. NIST AI Risk Management Framework (AI RMF 1.0): The "MAP" function of the framework

which is analogous to the planning phase

emphasizes "establishing the context to frame risks." This includes tasks like categorizing the AI system

defining its purpose and intended use

and identifying potential impacts

which align with defining context

assumptions

and governance. The choice of architecture is a downstream technical implementation detail. (See Section 3.1

"MAP

" pages 14-16).

2. University Courseware - Carnegie Mellon University

Software Engineering Institute: In established AI engineering lifecycle models

the initial phases are "Requirements Engineering and System Design

" which precede "AI Model Development." The planning activities (A

B

D) fall into the former

while the choice of architecture (C) is a key part of the latter. (See "The AI Engineering Lifecycle

" SEI Blog

Carnegie Mellon University

which distinguishes high-level system design from detailed model development).

3. Academic Publication - HBR Guide to Data Analytics Basics for Managers: While not a peer-reviewed paper

this HBS publication reflects established academic and industry best practices. It outlines project phases starting with "Framing the Problem" and "Acquiring the Data

" which encompass defining context and assumptions. "Choosing the Right Model" is presented as a subsequent

more technical step. (See Chapter 2: "The Five Stages of a Data Analytics Project").

An AI Impact Assessment (AIA) is a structured process designed to proactively identify, analyze, and evaluate the potential effects of an AI system on individuals, groups, and society. Its primary purpose is foresight and mitigation. By systematically examining a system before and during its deployment, organizations can anticipate a wide range of potential risks—including ethical, social, fundamental rights, and legal harms—and implement measures to manage or prevent them. This aligns with core principles of responsible AI and trustworthiness, ensuring that systems are developed and used in a manner that minimizes negative consequences.

A. This is too narrow. An AIA's scope extends beyond legal risks to include ethical, social, and fundamental rights harms, which may not be codified in law.

C. Defining roles is a component of an overall AI governance framework, not the primary purpose of the impact assessment tool itself.

D. While benefits may be considered for context (e.g., in a proportionality test), the primary focus of an AIA is on identifying and mitigating potential harms and risks.

---

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Reference: Page 4

Section 2.1

"Framing risk." The document states the AI RMF's goal is to "better manage risks to individuals

organizations

and society associated with artificial intelligence (AI)." The entire framework

which operationalizes the principles behind an AIA

is centered on identifying

assessing

and managing negative impacts.

2. Government of Canada

Treasury Board of Canada Secretariat. (2022). Algorithmic Impact Assessment (AIA).

Reference: "About the Algorithmic Impact Assessment" section. The official documentation states

"The AIA is a questionnaire designed to help institutions better understand and mitigate the risks associated with automated decision-systems." This directly supports the purpose of anticipating and managing risks.

3. Reisman

D.

Schultz

J.

Crawford

K.

& Whittaker

M. (2018). Algorithmic Impact Assessments: A Case Study in Public Agency Accountability. AI Now Institute

New York University.

Reference: Page 6

"What is an Algorithmic Impact Assessment?" The report defines an AIA as a "tool for assessing the potential harms of an algorithmic system before it is deployed

" emphasizing its role in providing "a repeatable

evidence-based process to assess the potential for discriminatory impact or other harms."

DOI: https://ainowinstitute.org/aiareport2018.pdf

The Singapore Model AI Governance Framework is a principles-based guide, not a prescriptive regulation. It recommends that organizations determine the appropriate level of human involvement in AI decision-making based on factors like the severity of harm and the risk of irreversible decisions. While this may lead an organization to implement a human-over-the-loop system for high-risk scenarios, the framework itself does not mandate this specific protocol. Instead, it provides a methodology for making that determination. The other options are all explicit recommendations within the framework for establishing internal governance, adapting existing structures, and ensuring stakeholder communication.

A. This is incorrect. The framework has a dedicated section (3.2) on "Determining the Level of Human Involvement in AI-augmented Decision-making."

B. This is incorrect. The framework explicitly states in Section 3.1 that "Organisations can adapt their existing governance structures and measures for AI."

D. This is incorrect. Section 3.4, "Stakeholder Communication and Management," details the importance of establishing clear policies for internal and external communication.

1. Infocomm Media Development Authority (IMDA) and Personal Data Protection Commission (PDPC) Singapore. (2020). Model Artificial Intelligence Governance Framework

Second Edition.

For Correct Answer (C): Section 3.2

"Determining the Level of Human Involvement in AI-augmented Decision-making" (pages 21-24)

describes the process for deciding on human involvement but does not prescribe a specific protocol like "human-over-the-loop" for all high-risk systems. It leaves the implementation decision to the organization based on its risk assessment.

For Incorrect Option (A): The title and content of Section 3.2 (pages 21-24) directly support this as a recommended measure.

For Incorrect Option (B): Section 3.1

"Internal Governance Structures and Measures" (page 19)

explicitly recommends adapting existing governance structures.

For Incorrect Option (D): Section 3.4

"Stakeholder Communication and Management" (pages 29-31)

outlines the need for communication and collaboration.

Effective AI governance requires transparency, but this does not extend to the mandatory disclosure of proprietary methods or trade secrets. While the marketing company should be transparent about the AI's purpose, its limitations, and its adherence to legal standards, revealing the underlying proprietary algorithms of the third-party LLM is not a standard or required practice. Disclosing such information would compromise the technology company's intellectual property and competitive advantage. The principle of explainability focuses on making the outcomes and general logic of an AI system understandable, not on revealing its source code or specific architectural details.

A. Intended purpose: Disclosing the purpose of the AI system is a fundamental aspect of transparency, ensuring stakeholders understand why and how the technology is being used.

C. Compliance with law: A disclosure of legal compliance is a standard component of corporate governance and risk management, providing assurance to clients, users, and regulators.

D. Acknowledgement of limitations: Acknowledging potential inaccuracies, biases, or other limitations is a key principle of responsible and trustworthy AI, managing user expectations and preventing over-reliance.

1. NIST AI Risk Management Framework (AI RMF 1.0)

January 2023.

Section 4.2.2

Page 23: The framework states that the level of transparency can be "constrained by law

policy

or confidentiality considerations (e.g.

intellectual property

trade secrets

or privacy)." This directly supports that proprietary methods are an exception to full disclosure.

2. OECD

"Recommendation of the Council on Artificial Intelligence

" OECD/LEGAL/0449

2019 (updated 2024).

Principle 1.4

"Transparency and explainability": This principle calls for providing "meaningful information

appropriate to the context." This contextual approach allows organizations to balance the need for transparency with the legitimate need to protect intellectual property and trade secrets.

3. European Commission's High-Level Expert Group on AI

"Ethics Guidelines for Trustworthy AI

" April 8

2019.

Chapter II

Page 15 (under "The requirement of Transparency"): The guidelines state

"The transparency requirement must also be balanced against the need to protect intellectual property rights and trade secrets... a trade-off may be needed between transparency and security." This explicitly acknowledges that proprietary information should be protected.

The described AI system, "CrimeBuster 9619," is designed to predict the likelihood of an individual re-offending, which is then used by parole boards. Under the EU AI Act, this constitutes a form of social scoring by a public authority. Article 5(1)(c) of the Act explicitly prohibits AI systems that evaluate or classify individuals based on their behavior or personal characteristics, leading to a "social score" that results in detrimental treatment. A parole decision based on such a score is a clear example of detrimental treatment. Therefore, this application of AI is considered to pose an unacceptable risk to fundamental rights and is banned from being placed on the EU market.

A. Require the company to register the tool with the EU database.

This is a requirement for high-risk AI systems, not for systems that are prohibited and cannot legally enter the market.

B. Be subject approval by the relevant EU authority.

Prohibited systems are not eligible for an approval process; they are banned outright. This process applies to high-risk systems.

C. Require a detailed conformity assessment.

This is the core compliance procedure for high-risk AI systems. Since this system is in the prohibited category, it cannot undergo this assessment.

1. Regulation of the European Parliament and of the Council on laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)

Final Adopted Text (13 March 2024)

P9TA(2024)0138.

Article 5(1)(c) states that the following AI practice shall be prohibited: "an AI system that evaluates or classifies natural persons or groups of natural persons over a certain period of time based on their social behaviour or known

inferred or predicted personal or personality characteristics

with the social score leading to ... detrimental or unfavourable treatment of certain natural persons or whole groups thereof that is unjustified or disproportionate to their social behaviour." The system described fits this definition of a prohibited social scoring system.

2. European Parliament

"EU AI Act: first regulation on artificial intelligence

" Briefing

Page 2

March 2024.

This official briefing document summarizes the regulation and lists "unacceptable risk" AI systems that are banned. It explicitly includes "social scoring systems by public and private actors

" confirming that such systems are prohibited

not just regulated as high-risk.

3. Veale

M.

& Zuiderveen Borgesius

F. (2021). "Demystifying the Draft EU Artificial Intelligence Act." Computer Law Review International

22(4)

Section 3.1.

This academic analysis of the Act's draft (the principles of which were carried into the final text) explains the rationale behind prohibiting social scoring

noting that it "creates a serious risk of discrimination and exclusion" and can "violate the right to human dignity

" which is the foundational logic for banning systems like the one in the question. (DOI: https://doi.org/10.9785/cri-2021-220402)

The Acceptable Use Policy (AUP) is the most important policy for assessing the operational implications of a third-party AI model. The AUP explicitly outlines the vendor's rules regarding the intended and prohibited uses of their service. For a governance team, this document is paramount as it defines the contractual and ethical boundaries within which the AI model can be operated. It directly addresses questions of how the model can be integrated into workflows, what tasks it can perform, and what constitutes misuse, which are central to evaluating operational and ethical risks before deployment.

B. The privacy policy focuses on how the provider handles personal data, not the functional or operational rules for using the AI model.

C. The security policy describes measures to protect the system from threats, which is a technical risk assessment, not a guide to its proper operational use.

D. The code of conduct policy governs the behavior of the vendor's employees, not the operational use of the AI product by a customer.

1. NIST. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). U.S. Department of Commerce

National Institute of Standards and Technology. In the Govern function

subcategory GOVERN.P5 (p. 20) states that for procurement

organizations should understand the "AI system’s intended uses and capabilities." The AUP is the primary policy document that formally defines these intended uses and restrictions for a third-party product.

2. Floridi

L.

& Cowls

J. (2019). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review

1(1). https://doi.org/10.1162/99608f92.8cd550d1. The principle of "Beneficence" (promoting well-being) and "Non-maleficence" (preventing harm) requires a clear understanding of an AI system's intended application domain and limitations. An AUP is the operational tool that codifies these principles by defining acceptable and unacceptable uses.

3. Stanford University. (2023). CS 182: Ethics

Public Policy

and Technological Change Course Syllabus. Course materials frequently discuss how Terms of Service and Acceptable Use Policies serve as the primary governance instruments that define the scope of permissible actions for users of a technology platform

thereby setting the operational rules.

The AI technology described is a multi-modal model because it is designed to process and integrate information from multiple distinct data types, or "modalities." In this case, the modalities are text, video, images, and sound. Multi-modal AI systems leverage the combination of these different data sources to achieve a more comprehensive and contextually rich understanding of the input, which is essential for tasks like accurately tagging diverse content. This approach mimics the human ability to synthesize information from various senses to interpret the world.

A. Deductive inference: This is a form of logical reasoning that derives specific conclusions from general premises, not a classification of an AI model based on its input data types.

C. Transformative AI: This is a broad, strategic term describing AI with a significant societal or business impact, not a specific technical category for a model's architecture.

D. Expert system: This is a type of AI that emulates the decision-making of a human expert in a narrow domain, typically using a predefined knowledge base and rules, rather than processing multiple raw data types.

1. Baltrušaitis

T.

Ahuja

C.

& Morency

L. P. (2018). "Multimodal Machine Learning: A Survey and Taxonomy." IEEE Transactions on Pattern Analysis and Machine Intelligence

41(2)

423-443. Section I (Introduction) defines multimodality as building models that can "process and relate information from multiple modalities

" listing examples such as video

audio

and text. (DOI: https://doi.org/10.1109/TPAMI.2018.2798607)

2. Stanford University. (2021). CS224N: NLP with Deep Learning

Winter 2021

Lecture 15: Multimodality and Language. Slide 4

"What is multimodality?"

defines the concept as connecting language to other modalities like vision (images

video) and audio

which directly aligns with the scenario described in the question. (Available at: http://web.stanford.edu/class/cs224n/slides/cs224n-2021-lecture-15-multimodality.pdf)

3. Russell

S. J.

& Norvig

P. (2020). Artificial Intelligence: A Modern Approach (4th ed.). Pearson. Chapter 8

"First-Order Logic

" discusses inference methods like deduction. Chapter 9

"Inference in First-Order Logic

" details the mechanisms. This source distinguishes logical reasoning from model architectures.

Effective AI governance is fundamentally a multidisciplinary and cross-cutting function. AI systems impact virtually every part of an organization, including legal, ethics, data science, IT, security, and business operations. Therefore, a foundational characteristic of a successful governance program is the engagement of a cross-functional team. This team brings together diverse expertise and perspectives to ensure that policies are comprehensive, risks are identified from all angles (e.g., technical, legal, reputational), and the governance framework is integrated throughout the organization's structure and culture. Without this collaborative approach, governance efforts would be siloed and incomplete.

B. Reliance on tested vendor management processes: This is a specific component of a broader AI governance program, not its foundational characteristic.

C. Thorough reviews of a company’s public filings with experts: This is an external-facing due diligence or compliance activity, not a core, internal principle of how AI governance operates.

D. Uniform policies and procedures across developer, deployer and user roles: Policies must be tailored to the distinct responsibilities and contexts of different roles; a uniform approach would be ineffective.

---

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Reference: Page 12

Section 3.1

"GOVERN." The document states

"Governance is a cross-cutting function... Effective governance requires accountability structures to implement AI risk management processes. This includes assigning roles

responsibilities

and lines of communication for different teams..." This highlights the need for coordination across various teams

which is the essence of a cross-functional approach.

2. World Economic Forum. (2021). AI Governance: A Holistic Approach to Implement Responsible AI.

Reference: Page 10

"Set up the governance structure." The report explicitly recommends establishing a "cross-functional steering committee" as a key step. It suggests this committee should include "representatives from legal

compliance

data

technology

business

and other relevant functions" to ensure a holistic view.

3. Ransbotham

S.

Kharlamov

A.

& Mazumdar

S. (2023). The New Rules of AI Governance. MIT Sloan Management Review.

Reference: In the section "Establish a Cross-Functional Governance Team

" the article states

"Effective governance requires a cross-functional team that includes business

analytics

and IT leaders... This team should be responsible for setting AI policies

overseeing AI projects

and ensuring that AI is used ethically and responsibly." This directly identifies the cross-functional team as a requirement for effective governance.

The scenario describes the collection of several data points (full name, date of birth, gender, IP address, and location) for an app whose stated purpose is to analyze user-uploaded images and videos for lifestyle recommendations. This collection practice directly implicates two core GDPR principles.

1. Data Minimization (Article 5(1)(c)): This principle requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." It is questionable whether a user's full name, specific date of birth, gender, and continuous location data are all strictly necessary to analyze images and provide lifestyle advice.

2. Purpose Limitation (Article 5(1)(b)): This principle mandates that data be "collected for specified, explicit and legitimate purposes." Collecting excessive data suggests it might be used for other, unstated purposes, thereby violating this principle.

B. Accountability is the controller's responsibility to demonstrate compliance, not the violation itself. Lawfulness cannot be determined as the legal basis (e.g., consent) is not mentioned.

C. Transparency relates to informing users about data processing, which is not detailed in the scenario. Accuracy is about ensuring data is correct, which is not the issue here.

D. Integrity and Confidentiality relate to securing data against unauthorized access or breaches, not the principles governing the scope of initial data collection.

1. General Data Protection Regulation (GDPR)

Regulation (EU) 2016/679.

Article 5(1)(b): "Personal data shall be... collected for specified

explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes..."

Article 5(1)(c): "Personal data shall be... adequate

relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)..."

2. Stanford University

"GDPR: Key Requirements." Stanford University IT. Accessed 2023.

In its summary of GDPR principles

the resource explains that Data Minimization requires organizations to "ensure the personal data you are processing is... limited to what is necessary for the purposes." It also defines Purpose Limitation as requiring data to be "collected for specified

explicit

and legitimate purposes." The scenario presents a clear conflict with these requirements.

3. Voigt

P.

& Von dem Bussche

A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer.

In Chapter 4

"Principles relating to processing of personal data

" the authors explain that data minimization (p. 81) is a key obligation to limit collection to what is necessary for the purpose. They further clarify that purpose limitation (p. 78) restricts processing to the specific purposes for which the data was originally collected

preventing function creep. The app's broad data collection for a narrow purpose violates both concepts.

The case study specifies that the company's primary goal for implementing the AI tool is to "identify and retain the best talent." Therefore, improving candidate quality is the intended positive outcome, not a negative consequence. The other options represent well-documented risks associated with using AI in hiring. Automation bias occurs when human reviewers excessively trust the AI's output. Privacy violations can arise from mishandling candidate data. Disparate impacts refer to discriminatory outcomes where the AI systematically disadvantages individuals from protected groups, even if unintentionally.

A. Automation bias: This is a known negative consequence where human decision-makers over-rely on an AI system's recommendations, reducing critical oversight and potentially leading to poor decisions.

C. Privacy violations: The AI tool processes resumes containing sensitive personal data, creating a significant risk of data breaches or misuse, which constitutes a negative consequence.

D. Disparate impacts: AI hiring tools trained on historical data can learn and amplify existing biases, leading to discriminatory outcomes against protected classes, a severe negative consequence.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Page 13

Section 2.2: Discusses how "AI systems can reflect

amplify

or result in harmful bias

" which directly relates to disparate impacts (D).

Page 14

Section 2.2: Notes that "Human-AI system configurations can also lead to errors

" which encompasses the risk of automation bias (A).

2. The White House. (2022). Blueprint for an AI Bill of Rights.

Principle: "Algorithmic Discrimination Protections": This principle explicitly states that people "should not face discrimination by algorithms and systems should be used and designed in an equitable way." This directly addresses the risk of disparate impacts (D).

Principle: "Data Privacy": This principle emphasizes that individuals should have agency over their data and not be subjected to abusive data practices

highlighting the risk of privacy violations (C).

3. Stanford Institute for Human-Centered Artificial Intelligence (HAI). (2023). Artificial Intelligence Index Report 2023.

Chapter 5

Page 188: Discusses the ongoing challenge of bias in large language models

noting that "models can internalize biases and stereotypes... which can lead to downstream harms." This supports the risk of disparate impacts (D) in AI screening tools.

Product liability laws hold the manufacturers, distributors, or sellers of a product responsible for injuries caused by defects. In this scenario, XYZ Corp. is the deployer or user of the third-party AI tool, not its creator. While litigation can be complex, the primary liability for a defective product would fall on the vendor who developed it. XYZ's direct and most probable legal risks stem from its application and use of the tool in the hiring process. Irresponsible use directly implicates laws governing employment practices, such as those concerning discrimination, accessibility for individuals with disabilities, and the privacy of applicant data.

A. Anti-discrimination laws: An improperly designed or used AI hiring tool can perpetuate or create biases, leading to discriminatory outcomes and direct liability under laws like Title VII of the Civil Rights Act.

C. Accessibility laws: If the AI-powered application platform is not accessible to applicants with disabilities, XYZ would face liability under the Americans with Disabilities Act (ADA).

D. Privacy laws: The AI tool processes a significant amount of personal and sensitive data from resumes, creating direct obligations and liability for XYZ under various state and federal privacy regulations.

1. U.S. Equal Employment Opportunity Commission (EEOC). (2023

May 18). Select Issues: Assessing Adverse Impact in Software

Algorithms

and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964. This guidance explicitly states that employers can be held responsible for using AI tools that result in discrimination

regardless of whether the tool was developed by a third party. (Supports why A is a direct liability).

2. U.S. Equal Employment Opportunity Commission (EEOC). (2022

May 12). The Americans with Disabilities Act and the Use of Software

Algorithms

and Artificial Intelligence to Assess Job Applicants and Employees. This document clarifies that an employer's use of AI tools must comply with the ADA's requirements for reasonable accommodation and non-discrimination

making accessibility a direct liability concern. (Supports why C is a direct liability).

3. National Institute of Standards and Technology (NIST). (2023

January). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST SP 1270. The framework distinguishes between different actors in the AI lifecycle. As an "AI deployer

" XYZ is responsible for the risks emerging from the operation of the AI system in its specific context

which includes privacy harms and fairness/bias issues (see Core sections GOVERN 1.1

MAP 2.4

and MEASURE 2.4). Product liability is more directly associated with the "AI developer." (Supports the distinction between user liability and product liability).

4. The White House. (2022

October). Blueprint for an AI Bill of Rights. This document outlines principles for the responsible use of automated systems

including "Safe and Effective Systems" and "Algorithmic Discrimination Protections." It places the onus on organizations deploying these systems to ensure they do not produce discriminatory or unsafe outcomes

reinforcing the user's direct responsibility in areas other than product liability. (Supports why A

C

and D are direct liabilities for the user).

During the initial production monitoring phase, the most critical activity is to actively and continuously test the model's outputs for fairness. Disparity testing is the method used to measure and quantify differences in outcomes across protected groups (e.g., gender). This testing provides the empirical evidence needed to identify whether the model is performing in a biased manner, as was discovered by ABC Corp. It is the foundational step in the monitoring process; without it, the bias would not be detected, and no corrective action, such as analyzing the training data, could be initiated. This ongoing measurement is central to responsible AI governance and operationalizing fairness.

B. Analyze the quality of the training and testing data.

This is a critical diagnostic step to understand the root cause of bias, but it typically occurs after disparity testing has first identified that a problem exists.

C. Compare the results to human decisions prior to deployment.

This is a useful benchmarking exercise but not the primary monitoring task. The previous human process could also have been biased, making it an unreliable benchmark for fairness.

D. Seek approval from management for any changes to the model.

This is a governance step that happens much later in the process, after a bias has been identified, its cause analyzed, and a remediation plan has been developed.

1. NIST AI Risk Management Framework (AI RMF 1.0)

January 2023. The "Measure" function of the framework emphasizes the need for ongoing evaluation post-deployment. It states

"TEVV [testing

evaluation

validation

and verification] occurs pre-deployment

as well as on an ongoing basis post-deployment... to assess whether the system is functioning as intended" (p. 22

Section 4.3). This continuous testing is precisely what disparity testing entails in a fairness context.

2. European Commission

"Ethics guidelines for trustworthy AI"

April 2019. The guidelines list "Diversity

non-discrimination and fairness" as a key requirement. To ensure this

it recommends that AI systems be tested throughout their lifecycle. For post-deployment

it implies a need for "monitoring processes" to "scrutinise the AI system’s outcomes" (p. 15)

which directly corresponds to disparity testing.

3. Inioluwa

D. A.

& T. M. H. Kehtarnavaz

N. (2020). "A Survey on Bias and Fairness in Machine Learning". ACM Computing Surveys

53(3)

1-35. https://doi.org/10.1145/3457607. This paper details various fairness metrics (e.g.

demographic parity

equal opportunity). The calculation and tracking of these metrics

which is the essence of disparity testing

is presented as the fundamental method for assessing algorithmic fairness. Section 3

"Fairness Metrics

" outlines the quantitative tests used to detect bias.

Explainable AI (XAI) refers to the set of processes, methods, and techniques that ensure the outputs and decisions made by an AI system can be understood by humans. The core purpose of XAI is to open the "black box" of complex models, providing clear explanations for their behavior. This directly addresses the regulatory concern for transparency and accountability by allowing users, developers, and regulators to understand why an AI system reached a particular conclusion, which is fundamental for building trust and verifying compliance with legal and ethical standards.

A. Interpretable AI: This is a narrower concept, often referring to the intrinsic property of a model (e.g., a simple decision tree) being understandable due to its simple structure, whereas XAI includes methods applied to complex, non-interpretable models.

B. Trustworthy AI: This is a broad, overarching goal or framework. Explainability is a component required to achieve trustworthy AI, but it is not the specific term for the methods of understanding outputs.

D. Responsible AI: Similar to Trustworthy AI, this is a comprehensive governance framework that encompasses many principles, including fairness, privacy, and security, with XAI being just one of its essential pillars.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Page 4

Section 2

Definitions: "Explainability: A representation of the mechanisms underlying AI system operation

provided in a form that is understandable to a human." This definition directly aligns with the question's description of processes allowing users to understand AI outputs.

2. Gunning

D.

& Aha

D. (2019). DARPA’s Explainable Artificial Intelligence (XAI) Program. AI Magazine

40(2)

44-58.

Page 44

Abstract: The XAI program's goal is to create AI systems where "human users to understand

appropriately trust

and effectively manage the emerging generation of artificially intelligent partners." This foundational source links understanding with trust

matching the question's phrasing.

DOI: https://doi.org/10.1609/aimag.v40i2.2850

3. Stanford University Human-Centered Artificial Intelligence (HAI). (2023). What Are Foundation Models? Report from the Center for Research on Foundation Models (CRFM).

Page 108

Section 6.2

Transparency: The report discusses transparency as a key societal impact

stating

"Transparency is a prerequisite for accountability... At the model level

transparency can mean explainability (i.e.

being able to understand why a model makes the decisions it does)." This highlights explainability as the mechanism for understanding decisions.