Under the EU AI Act, an importer is the entity that first places an AI system from a third country onto the EU market. Their primary role is to act as a gatekeeper by verifying compliance. Article 26 of the Act obligates the importer to ensure that the provider has carried out the necessary conformity assessment procedure and has drawn up the required technical documentation and the EU Declaration of Conformity. This verification is a crucial step before the product can be marketed in the EU, ensuring that non-EU systems meet the same high standards.

A. Provide technical documentation.

This is an obligation of the provider of the AI system, who develops the system and must create this documentation. The importer only verifies its existence.

B. Affix the CE marking.

This is the responsibility of the provider after successfully completing the conformity assessment. The importer's duty is to check that this marking is present.

D. Conduct a data protection impact assessment.

This is an obligation under the GDPR for the deployer (user) of the AI system if it processes personal data in a way that poses a high risk.

1. European Commission

Proposal for a Regulation on a European approach for Artificial Intelligence (consolidated text

Jan. 2024).

Correct Answer (C): Article 26(1) outlines the obligations of importers

stating they shall ensure "the appropriate conformity assessment procedure referred to in Article 43 has been carried out by the provider" and that the provider "has drawn up the EU declaration of conformity in accordance with Article 48."

Incorrect Option (A): Article 16(1)(g) specifies that providers shall "draw up the technical documentation referred to in Article 11."

Incorrect Option (B): Article 16(1)(j) and Article 49 mandate that the provider is responsible for drawing up the EU declaration of conformity and affixing the CE marking.

2. General Data Protection Regulation (GDPR) (EU) 2016/679.

Incorrect Option (D): Article 35 requires the controller (often the deployer/user of an AI system) to carry out a data protection impact assessment prior to processing that is likely to result in a high risk. This is not an importer's obligation under the AI Act.

Supervised learning is a fundamental paradigm in machine learning where an algorithm learns from a dataset containing input-output pairs, known as "labeled data." The goal is for the model to learn a mapping function that can predict the output variable (label) for new, unseen input data. The "supervision" comes from the labeled training data, which acts as a teacher, guiding the algorithm to produce correct outcomes. Common supervised learning tasks include classification (predicting a category) and regression (predicting a continuous value).

A. Segmentation is a task, often associated with clustering in unsupervised learning, that involves dividing a dataset into groups of similar items. It is not a learning paradigm defined by labeled data.

B. Generative AI is a category of AI focused on creating new content. While it can be trained using supervised methods, its defining characteristic is generation, not the specific training methodology.

C. Expert systems are a form of AI that relies on a pre-programmed knowledge base and a set of rules to solve problems, rather than learning from labeled data like machine learning models.

1. Russell

S. J.

& Norvig

P. (2020). Artificial Intelligence: A Modern Approach (4th ed.). Pearson. In Chapter 19

"Learning from Examples

" the text defines supervised learning: "In supervised learning

the agent observes some example input–output pairs and learns a function that maps from input to output." (p. 694).

2. Stanford University. (2018). CS229 Machine Learning Course Notes. "In supervised learning

we are given a data set and already know what our correct output should look like

having the idea that there is a relationship between the input and the output. Supervised learning problems are categorized into 'regression' and 'classification' problems." (p. 2).

3. Ayodele

T. O. (2010). Types of machine learning algorithms. In New Advances in Machine Learning. IntechOpen. This chapter distinguishes the major types

stating

"Supervised learning is the machine learning task of inferring a function from labeled training data." (Section 2.1

para. 1). DOI: https://doi.org/10.5772/9385

Testing an AI tool both before deployment and continuously after deployment is a cornerstone of responsible AI governance and risk management. Pre-deployment testing allows XYZ to assess the tool for fairness, accuracy, and potential biases using historical or synthetic data before it impacts real job applicants. Post-deployment monitoring is crucial for detecting model drift, performance degradation, or emergent biases that can arise when the tool interacts with new, real-world data. This comprehensive "Test, Evaluation, Validation, and Verification" (TEVV) approach is the most direct and effective method to ensure the tool functions as intended and to prevent discriminatory or unfair outcomes that would lead to severe reputational harm.

B. This is a risk transference strategy for financial liability, but it does not prevent the initial incident or the resulting reputational damage to XYZ Corp.

C. Prioritizing the most economical tool over one with robust safety, fairness, and transparency features is likely to increase, not mitigate, the risk of reputational harm.

D. This avoids using the AI tool rather than mitigating the risks of its use, thereby failing to achieve the organization's stated goals of improving efficiency and cost-effectiveness.

---

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Page 19

Section 3.3.3

MEASURE Function: The framework states

"Pre-deployment TEVV is necessary but not sufficient. Post-deployment monitoring of AI systems in operation is a critical part of a risk management process." This directly supports the need for both pre- and post-deployment testing to manage risks.

2. European Commission's High-Level Expert Group on AI. (2019). Ethics Guidelines for Trustworthy AI.

Page 17

Chapter II

Requirement 4: Technical Robustness and safety: The guidelines emphasize that for an AI system to be trustworthy

it must be tested and validated throughout its life cycle. It states

"This requires that AI systems are verified and validated in their development process and

where applicable

in the system’s deployment context."

3. Organisation for Economic Co-operation and Development (OECD). (2019). Recommendation of the Council on Artificial Intelligence (OECD AI Principles).

Section 1

Principle 1.3: Robustness

Security and Safety: This principle states that "AI systems should be robust

secure and safe throughout their entire lifecycle... so that they function appropriately and do not pose unreasonable safety risks." The term "entire lifecycle" explicitly includes both the development/pre-deployment phase and the operational/post-deployment phase

necessitating continuous assessment.

According to the Organization for Economic Cooperation and Development (OECD) framework for AI governance, tools are categorized based on their nature and function. Codes of conduct and collective agreements are classified as procedural tools. This is because they establish processes, rules, and organizational guidelines that govern the behavior of individuals and the operations of an organization in the development and deployment of AI systems. They are not technical implementations but rather frameworks that guide decision-making and ensure accountability through established procedures.

A. Educational: Educational tools are designed to increase knowledge and awareness, such as training programs or certification courses, not to establish binding operational rules.

C. Technical: Technical tools refer to software, hardware, or algorithmic solutions used to assess or control AI systems, such as bias detection algorithms or explainability libraries.

D. Analytic: While analysis is part of governance, "analytic tools" is not a primary OECD classification for governance instruments like codes of conduct. These tools are about establishing processes, not just analysis.

1. OECD. (2023). Tools for Trustworthy AI: A framework to compare tools for trustworthy AI systems. OECD Publishing

Paris.

Reference: In Section 2.2

"A typology of tools for trustworthy AI

" the report outlines three main categories: "Technical tools

" "Process-based tools

" and "Educational tools." Codes of conduct and similar governance frameworks fall under "Process-based tools

" which are synonymous with procedural tools as they "help organisations manage the development and use of AI systems" (p. 13).

2. Stanford University Human-Centered Artificial Intelligence (HAI). (2023). Artificial Intelligence Index Report 2023.

Reference: Chapter 6

"Policy and Governance

" discusses the landscape of AI policy instruments. It implicitly supports the classification of codes of conduct as procedural mechanisms by grouping them with other governance frameworks and regulations that guide organizational processes

distinct from technical standards or public education initiatives (pp. 226-228).

3. OECD. (2021). State of Implementation of the OECD AI Principles: Insights from National AI Policies. OECD Publishing

Paris.

Reference: This report discusses various "Policy instruments and governance mechanisms" (p. 41). It describes codes of conduct and ethical guidelines as key instruments that countries are using to operationalize AI principles

treating them as procedural and governance-level interventions rather than technical or purely educational ones.

AI governance frameworks are designed to address the tangible characteristics and risks of current and near-term AI systems. Autonomy (acting without direct human control), automation (of cognitive tasks), adaptability (learning from new data), and the ability to operate at immense speed and scale are all fundamental, existing characteristics of AI. These attributes create unique challenges for accountability, safety, and fairness, necessitating comprehensive governance. Superintelligence, a hypothetical future state where AI surpasses human intelligence across all domains, is a speculative concept. While it is a topic of long-term ethical and safety research, it is not a characteristic of present-day AI that practical, contemporary governance structures are built to manage.

A. Autonomy: AI's capacity to operate independently is a core reason for governance, as it raises critical questions about control, liability, and decision-making accountability.

B. Automation: The automation of complex tasks by AI systems introduces risks like algorithmic bias and workforce displacement, which are central concerns for AI governance.

C. Adaptability: The ability of AI models to change over time (e.g., model drift) requires continuous monitoring and management, a key function of a robust governance program.

D. Speed and scale: AI operates at a velocity and scale that can amplify errors and biases rapidly, making human oversight difficult and robust governance frameworks essential.

1. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. In Section 3.1

"AI systems have a unique set of characteristics

" the framework highlights that AI systems are "dynamic" (Adaptability) and can "operate at a speed and scale that makes human oversight challenging" (Speed and scale)

which are core drivers for the RMF's governance guidance.

2. OECD. (2019). Recommendation of the Council on Artificial Intelligence. OECD/LEGAL/0449. The commentary accompanying the principles

particularly for "Robustness

Security and Safety

" notes that AI systems can "act with a certain degree of autonomy

" which necessitates specific safeguards and governance mechanisms.

3. Floridi

L.

& Cowls

J. (2019). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review

1(1). https://doi.org/10.1162/99608f92.8cd550d1. The article identifies AI's autonomy and its learning capacity (Adaptability) as key features that distinguish it and require a specific ethical and governance approach.

4. Bostrom

N. (2014). Superintelligence: Paths

Dangers

Strategies. Oxford University Press. This foundational text defines and analyzes superintelligence as a potential

future development

distinguishing it from the capabilities of contemporary AI systems that are the subject of current governance frameworks.

The selection and implementation of a significant third-party AI tool requires a multi-stakeholder approach addressing both financial and legal risks. The Finance department is a crucial stakeholder for budget approval, assessing the return on investment (ROI), and managing the financial implications of a major technology procurement, working alongside the cost-focused procurement team. The Legal department is indispensable for ensuring the AI tool and the vendor's practices comply with a complex and evolving landscape of employment, anti-discrimination, and AI-specific laws across various jurisdictions, as highlighted in the case. They are also essential for contract negotiation to mitigate liability and ensure data protection.

B. Marketing and Compliance: Marketing is not a core stakeholder for selecting an internal HR tool. While Compliance is relevant, Legal is the more primary and encompassing function for this scenario.

C. Supply Chain and Marketing: Supply Chain is irrelevant for a software-as-a-service procurement, and Marketing's role is peripheral to the selection and implementation process.

D. Litigation and Product Development: Involving only the Litigation team is reactive; the broader Legal department is needed for proactive counsel. The Product Development team is a beneficiary, not a selector, of the HR tool.

1. NIST. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). U.S. Department of Commerce

National Institute of Standards and Technology. In the "GOVERN" function

the framework emphasizes that AI risk management is a "whole-of-organization endeavor" requiring "a diverse set of expertise from across the organization

including... business process owners

legal

procurement

and IT..." (p. 20

Section 3.2

GOVERN). This directly supports the critical involvement of the Legal department in procurement and governance.

2. Stanford University Human-Centered Artificial Intelligence (HAI). (2021). From Principles to Practice: An Interdisciplinary Framework for Operationalizing AI Ethics. This paper discusses the necessity of "multistakeholder deliberation" in AI governance

which includes legal and business units to ensure that AI systems align with legal requirements and organizational financial objectives (p. 5-6). This reinforces the need for both Legal and Finance involvement.

3. World Economic Forum. (2023). AI Governance Alliance: Briefing Paper Series - A Guide to Generative AI in Organizations. This guide emphasizes creating cross-functional teams for AI adoption

stating

"Key functions to involve include legal

compliance

cybersecurity

IT

HR

finance and communications" (p. 11). This explicitly lists both Finance and Legal as key stakeholders in organizational AI governance.

The IEEE 7000-2021 standard provides a specific process model for integrating ethical considerations and human values directly into the system design and development lifecycle. This approach is known as value-based engineering or Values-in-Design. The standard guides organizations in identifying and prioritizing ethical values (e.g., well-being, accountability, transparency), translating them into tangible system requirements, and verifying that the final system upholds these values. It is fundamentally a methodology for engineering systems based on explicit ethical values, making it the correct choice.

A. ISO/IEC Guide 51 (Safety).

This guide focuses specifically on incorporating safety aspects into standards. While safety is a value, this framework is too narrow and does not encompass the broader range of ethical considerations addressed by value-based engineering.

B. ISO 31000 Guidelines (Risk Management).

This is a generic, high-level framework for managing risk in any organization. It is not specific to AI or system design and does not prescribe a methodology for embedding ethical values into engineering processes.

D. Council of Europe Human Rights, Democracy, and the Rule of Law Assurance Framework (HUDERIA) for Al Systems.

This is an assurance and assessment framework used to evaluate an AI system's compliance with human rights and democratic principles, rather than a methodology for the initial design and engineering of the system.

---

1. IEEE Std 7000™-2021. IEEE Standard Model Process for Addressing Ethical Concerns During System Design. IEEE Xplore Digital Library. The standard's abstract explicitly states

"This standard provides a process model by which engineers and other technologists can address ethical considerations throughout the various stages of system initiation

analysis

and design." This directly aligns with the concept of value-based engineering. (DOI: 10.1109/IEEESTD.2021.9597522)

2. Spiekermann

S. (2015). Ethical IT Innovation: A Value-Based System Design Approach. CRC Press. Chapter 4

"Value-based System Design

" details the methodology that underpins standards like IEEE 7000

focusing on translating human values into technical specifications.

3. International Organization for Standardization. (2018). ISO 31000:2018 - Risk management — Guidelines. ISO.org. The scope section clarifies that it provides generic guidelines for managing any type of risk and is not specific to a particular industry or design methodology.

4. International Organization for Standardization. (2014). ISO/IEC Guide 51:2014 - Safety aspects — Guidelines for their inclusion in standards. ISO.org. The introduction specifies its purpose is to assist standard-writers in addressing safety

a much narrower focus than the holistic value-based approach.

The planning phase of the AI lifecycle focuses on establishing the strategic foundation for the project. This includes defining the business problem, understanding the operational context, identifying stakeholders, defining underlying assumptions about data and outcomes, and establishing the governance framework. The specific choice of a technical model architecture is a detailed design and development decision that occurs after the initial planning phase is complete. Planning sets the requirements and constraints that will later guide the selection of an appropriate architecture.

A. Definition of underlying assumptions: This is a core planning activity to clarify the project's basis, scope, and limitations before development begins.

B. Approach to governance: Establishing governance principles and oversight structures early in the planning phase is crucial for responsible AI development.

D. Context in which the model will operate: Understanding the operational context is fundamental to planning, as it defines the system's purpose, requirements, and potential impacts.

1. NIST AI Risk Management Framework (AI RMF 1.0): The "MAP" function of the framework

which is analogous to the planning phase

emphasizes "establishing the context to frame risks." This includes tasks like categorizing the AI system

defining its purpose and intended use

and identifying potential impacts

which align with defining context

assumptions

and governance. The choice of architecture is a downstream technical implementation detail. (See Section 3.1

"MAP

" pages 14-16).

2. University Courseware - Carnegie Mellon University

Software Engineering Institute: In established AI engineering lifecycle models

the initial phases are "Requirements Engineering and System Design

" which precede "AI Model Development." The planning activities (A

B

D) fall into the former

while the choice of architecture (C) is a key part of the latter. (See "The AI Engineering Lifecycle

" SEI Blog

Carnegie Mellon University

which distinguishes high-level system design from detailed model development).

3. Academic Publication - HBR Guide to Data Analytics Basics for Managers: While not a peer-reviewed paper

this HBS publication reflects established academic and industry best practices. It outlines project phases starting with "Framing the Problem" and "Acquiring the Data

" which encompass defining context and assumptions. "Choosing the Right Model" is presented as a subsequent

more technical step. (See Chapter 2: "The Five Stages of a Data Analytics Project").

An AI Impact Assessment (AIA) is a structured process designed to proactively identify, analyze, and evaluate the potential effects of an AI system on individuals, groups, and society. Its primary purpose is foresight and mitigation. By systematically examining a system before and during its deployment, organizations can anticipate a wide range of potential risks—including ethical, social, fundamental rights, and legal harms—and implement measures to manage or prevent them. This aligns with core principles of responsible AI and trustworthiness, ensuring that systems are developed and used in a manner that minimizes negative consequences.

A. This is too narrow. An AIA's scope extends beyond legal risks to include ethical, social, and fundamental rights harms, which may not be codified in law.

C. Defining roles is a component of an overall AI governance framework, not the primary purpose of the impact assessment tool itself.

D. While benefits may be considered for context (e.g., in a proportionality test), the primary focus of an AIA is on identifying and mitigating potential harms and risks.

---

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Reference: Page 4

Section 2.1

"Framing risk." The document states the AI RMF's goal is to "better manage risks to individuals

organizations

and society associated with artificial intelligence (AI)." The entire framework

which operationalizes the principles behind an AIA

is centered on identifying

assessing

and managing negative impacts.

2. Government of Canada

Treasury Board of Canada Secretariat. (2022). Algorithmic Impact Assessment (AIA).

Reference: "About the Algorithmic Impact Assessment" section. The official documentation states

"The AIA is a questionnaire designed to help institutions better understand and mitigate the risks associated with automated decision-systems." This directly supports the purpose of anticipating and managing risks.

3. Reisman

D.

Schultz

J.

Crawford

K.

& Whittaker

M. (2018). Algorithmic Impact Assessments: A Case Study in Public Agency Accountability. AI Now Institute

New York University.

Reference: Page 6

"What is an Algorithmic Impact Assessment?" The report defines an AIA as a "tool for assessing the potential harms of an algorithmic system before it is deployed

" emphasizing its role in providing "a repeatable

evidence-based process to assess the potential for discriminatory impact or other harms."

DOI: https://ainowinstitute.org/aiareport2018.pdf

The Singapore Model AI Governance Framework is a principles-based guide, not a prescriptive regulation. It recommends that organizations determine the appropriate level of human involvement in AI decision-making based on factors like the severity of harm and the risk of irreversible decisions. While this may lead an organization to implement a human-over-the-loop system for high-risk scenarios, the framework itself does not mandate this specific protocol. Instead, it provides a methodology for making that determination. The other options are all explicit recommendations within the framework for establishing internal governance, adapting existing structures, and ensuring stakeholder communication.

A. This is incorrect. The framework has a dedicated section (3.2) on "Determining the Level of Human Involvement in AI-augmented Decision-making."

B. This is incorrect. The framework explicitly states in Section 3.1 that "Organisations can adapt their existing governance structures and measures for AI."

D. This is incorrect. Section 3.4, "Stakeholder Communication and Management," details the importance of establishing clear policies for internal and external communication.

1. Infocomm Media Development Authority (IMDA) and Personal Data Protection Commission (PDPC) Singapore. (2020). Model Artificial Intelligence Governance Framework

Second Edition.

For Correct Answer (C): Section 3.2

"Determining the Level of Human Involvement in AI-augmented Decision-making" (pages 21-24)

describes the process for deciding on human involvement but does not prescribe a specific protocol like "human-over-the-loop" for all high-risk systems. It leaves the implementation decision to the organization based on its risk assessment.

For Incorrect Option (A): The title and content of Section 3.2 (pages 21-24) directly support this as a recommended measure.

For Incorrect Option (B): Section 3.1

"Internal Governance Structures and Measures" (page 19)

explicitly recommends adapting existing governance structures.

For Incorrect Option (D): Section 3.4

"Stakeholder Communication and Management" (pages 29-31)

outlines the need for communication and collaboration.