AI Governance Study

Free AIGP practice questions

50 free AIGP practice questions with full explanations, in the scenario style the real exam uses.

The AIGP paper is 100 questions in 3 hours (85 scored, 15 unscored pilots). Multiple-choice and multi-select, heavily scenario-based. Scaled score 100 to 500, pass at 300. These samples are drawn from Domain I of the 492-question bank. Every one is written for this course and comes with an explanation of why the right answer is right and why each distractor fails — which is the part that actually moves your score.

Read the scenario, commit to an answer before you look, then check the explanation.

Understand what AI is and why it needs governance (questions 1–17)

Question 1

A logistics company uses software that assigns delivery routes by applying a fixed set of human-written rules (traffic zones, vehicle capacity, priority tiers). No component learns from data or infers outputs. Under the OECD-style definition adopted by modern AI laws, how should this system be treated?

  1. As an AI system, because it automates decisions that otherwise require human judgment
  2. As an AI system, because its routing outputs influence a physical operating environment
  3. As generally outside the AI definition, because it applies fixed rules without inference
  4. As a high-risk AI system, because delivery routing affects workers' conditions and pay
Answer: As generally outside the AI definition, because it applies fixed rules without inference
The OECD-style definition turns on whether a system infers, from the inputs it receives, how to generate outputs. A deterministic engine applying fixed human-written rules performs no inference, so it generally falls outside the definition (c). Automating complex decisions (a) and affecting a physical environment (b) do not create AI status without inference, and the high-risk tier (d) can attach only to something that first qualifies as an AI system.

Question 2

A bank's loan model produces skewed refusals for applicants from certain neighbourhoods even though race was excluded from the training data. Postcode was retained as a feature. What best explains the outcome?

  1. Automation bias among the loan officers who review and act on the model's outputs
  2. Proxy discrimination operating through the retained postcode feature
  3. Concept drift in the relationship between applicant features and repayment behaviour
  4. Underfitting, because removing the race feature left the model too little signal
Answer: Proxy discrimination operating through the retained postcode feature
Postcode is highly correlated with the excluded protected attribute, so the model reconstructs the discriminatory pattern through that proxy (b). (a) describes human over-reliance on model outputs and does not explain the model's own skew. (c) refers to a relationship changing over time, whereas this pattern was present from training. (d) misapplies underfitting, which is a general failure to capture signal rather than a group-specific disparity.

Question 3

A regulator asks why an insurer's AI claims model needs continuous monitoring when the insurer's traditional rules engine never required it. Which characteristic of AI most directly justifies the requirement?

  1. The model's operating costs are higher than the rules engine's and must be tracked over time
  2. The model's outputs are probabilistic and its performance can degrade as conditions change
  3. The model processes a far larger volume of claims data than the rules engine handled
  4. The model vendor's standard contract terms require periodic performance reporting
Answer: The model's outputs are probabilistic and its performance can degrade as conditions change
Machine-learned models produce probabilistic outputs whose accuracy shifts as claims patterns and input data change, so the insurer must keep verifying performance in production (b). Operating cost (a) and data volume (c) are incidental features that do not by themselves require monitoring, and vendor contract terms (d) reflect the underlying risk rather than create it.

Question 4

A hospital deploys a diagnostic support model. Clinicians can see the model flagged a scan as high risk but cannot obtain any reasons. Patients are told AI is used in their care. Which principle is satisfied and which is failing?

  1. Transparency is failing; explainability is satisfied
  2. Both transparency and explainability are failing
  3. Transparency is satisfied; explainability is failing
  4. Accountability is failing; transparency is satisfied
Answer: Transparency is satisfied; explainability is failing
Disclosing that AI is used is transparency, and it has been done. The inability to interpret why a specific output was produced is an explainability failure (c). (a) reverses the terms. (b) ignores the disclosure. (d) drags in accountability, which concerns answerability for outcomes, not the missing reasons.

Question 5

During evaluation, reviewers consistently accept the model's recommendations even when case files contain contradicting evidence, because 'the system is usually right'. Which risk does this behaviour create for the governance programme?

  1. Data poisoning of the training corpus
  2. Automation bias undermining the human oversight control
  3. Model drift caused by reviewer feedback
  4. Overfitting to reviewer preferences
Answer: Automation bias undermining the human oversight control
Over-trusting automated output is automation bias, and it hollows out human oversight: the control exists on paper but no longer functions (b). No attacker is altering training data (a), no distribution change is described (c), and overfitting (d) is a training phenomenon, not reviewer behaviour.

Question 6

Which statement best captures why 'speed and scale' appears among the characteristics of AI requiring dedicated governance?

  1. AI development cycles now outpace the release cadence of traditional enterprise software
  2. A single flawed decision pattern can repeat across millions of automated decisions before detection
  3. Training large models concentrates demand on specialised data-centre infrastructure
  4. Scaling laws mean larger models tend to deliver higher benchmark accuracy
Answer: A single flawed decision pattern can repeat across millions of automated decisions before detection
The governance concern behind 'speed and scale' is harm amplification: one defective pattern repeats across every automated decision the system makes, reaching millions of people before anyone detects the fault (b). Development pace (a) and data-centre demand (c) describe how AI is built and run, not why its errors need dedicated governance. Scaling-law accuracy gains (d) describe capability rather than risk propagation.

Question 7

A product team says their recommendation engine is 'reliable, so robustness testing is redundant'. What is the best correction?

  1. Agree: months of stable production accuracy already demonstrate performance under varied real inputs
  2. Reliability concerns expected-use performance; robustness concerns perturbed inputs, so both need testing
  3. Robustness testing should be reserved for safety-critical deployments, not recommendation engines
  4. Robustness is a security property, so adversarial testing belongs with the CISO's penetration tests
Answer: Reliability concerns expected-use performance; robustness concerns perturbed inputs, so both need testing
Reliability means consistent intended performance under expected conditions, while robustness means holding up under noisy, shifted or adversarial inputs; a system can be reliable in normal use yet fragile under perturbation, so both properties need testing (b). (a) conflates the two: stable production accuracy says little about behaviour under perturbation. (c) understates robustness, which matters wherever inputs can vary, not only in safety-critical settings. (d) reduces robustness to security, though it also covers non-malicious perturbation such as distribution shift.

Question 8

NovaText Retail runs two customer-service tools. Tool A selects from a fixed library of pre-written response paragraphs by matching keywords in the customer's message. Tool B is trained on millions of past support conversations and generates a novel, context-specific reply word by word for each new query. Under the OECD-style AI definition, how should Tool B be characterized?

  1. As a generative AI system within the OECD-style definition
  2. As the same category as Tool A, since both deliver text replies to customers
  3. As outside the definition, since text generation is not a prediction or decision
  4. As narrow AI only if the tool also handles image and audio inputs
Answer: As a generative AI system within the OECD-style definition
Tool B infers from patterns learned across millions of conversations how to generate novel replies, which satisfies the OECD-style test of inferring from inputs how to generate outputs and marks it as generative AI (a). Tool A merely retrieves fixed templates by keyword, so equating the two (b) ignores the inference step. Generated content is squarely among the output types the definition names alongside predictions, recommendations and decisions (c), and narrow-AI classification does not depend on handling multiple modalities (d).

Question 9

A vendor's technical documentation states that its fraud-detection product 'uses deep learning, a broader category that includes all machine learning techniques.' A governance analyst reviewing the documentation flags this as incorrect. Why?

  1. Deep learning is a subset of machine learning, not a category containing all of it
  2. Deep learning and machine learning developed separately and address different problem classes
  3. Fraud detection is a rules-based domain where deep learning techniques are rarely appropriate
  4. Machine learning is the narrower subset, so the vendor understated deep learning's scope
Answer: Deep learning is a subset of machine learning, not a category containing all of it
Deep learning is a subset of machine learning that uses multi-layer neural networks: all deep learning is machine learning, but not the reverse, so the vendor has the hierarchy backwards (a). (b) wrongly separates two fields that sit in a strict subset relationship. (c) fails because fraud detection is a common and legitimate deep learning application, and (d) inverts the relationship in the same direction as the vendor's error instead of correcting it.

Question 10

A startup markets its customer-support tool as 'powered by artificial general intelligence capable of reasoning across any domain.' Independent testing shows the tool performs well only at classifying support tickets into predefined categories and fails on unrelated tasks such as summarizing contracts or answering general knowledge questions. How should a governance reviewer characterize the system?

  1. As AGI, because the vendor's technical documentation and marketing describe it that way
  2. As narrow AI, because it performs a single defined task and fails outside that domain
  3. As deep learning, because ticket classification of this kind relies on neural networks
  4. As outside the AI definition, because category classification is a rule-like simple task
Answer: As narrow AI, because it performs a single defined task and fails outside that domain
The tool performs one defined task, ticket classification, and lacks the hypothetical cross-domain, human-level breadth associated with AGI, which makes it narrow AI; observed behaviour, not marketing language, controls the characterisation (b), which is why (a) fails. (c) infers an architecture from a use case; classifiers need not be neural networks. (d) confuses task simplicity with falling outside the AI definition; a narrow classifier still infers outputs from inputs.

Question 11

A health analytics firm removes names and other direct identifiers from patient records before using them to train a diagnostic model, then separately publishes de-identified visit-level statistics enriched with zip code, age and visit date. A researcher combines the published statistics with a public voter file and re-identifies specific patients. What does this illustrate?

  1. Proxy discrimination, because zip code stood in for a protected attribute during model training
  2. A privacy harm from re-identification of de-identified data combined with outside datasets
  3. Automation bias, because reviewers over-trusted the anonymization tool's output
  4. A security breach caused by inadequate encryption of the training database
Answer: A privacy harm from re-identification of de-identified data combined with outside datasets
Re-identifying supposedly de-identified individuals by linking published data with an external dataset is the classic privacy and civil-rights harm, and the standard critique of relying on de-identification alone (b). No model decision or discriminatory outcome is described, so proxy discrimination does not fit (a). No human over-reliance on a system output occurs in the scenario (c). The researcher used a linkage technique on published statistics, not a break of encryption (d).

Question 12

Attackers use an AI voice-cloning tool to impersonate a company's CFO on a phone call, instructing an employee to wire funds to a fraudulent account. The employee complies and the funds are lost. Which harm category is most directly and immediately illustrated?

  1. Societal harm through erosion of trust in financial institutions generally
  2. Organizational harm through direct financial loss and exposure enabled by AI-driven impersonation
  3. Group harm through discrimination against a protected class
  4. A harm suffered exclusively by the vendor that built the voice-cloning tool
Answer: Organizational harm through direct financial loss and exposure enabled by AI-driven impersonation
The immediate, concrete effect is the company's financial loss from an AI-enabled fraud, which is organizational harm (b). Voice cloning can contribute to broader societal erosion of trust over time (a), but that is not what this single incident most directly shows. No protected-class discrimination is described (c), and the loss falls on the defrauded company, not the tool vendor (d).

Question 13

A bank's credit model, built on a large ensemble of gradient-boosted trees layered with a neural network, produces accurate scores, but even the data science team that built it cannot fully trace which factors drove a specific decision without specialized interpretability tooling. Which characteristic of AI most directly explains this difficulty?

  1. Autonomy, the capacity to act without human sign-off on each decision
  2. Opacity, the limited inherent explainability of complex architectures
  3. Speed and scale, the rapid replication of decisions across many cases
  4. Data dependency, the coupling of output quality to input data quality
Answer: Opacity, the limited inherent explainability of complex architectures
The inability to trace a specific decision through a complex model, even for its own builders, is the defining feature of opacity (b). Autonomy (a) concerns systems acting without per-decision human approval, not interpretability. Speed and scale (c) concerns how quickly decisions replicate across many cases. Data dependency (d) concerns output quality tracking input data quality, not whether the reasoning can be explained.

Question 14

A retailer's demand-forecasting model was trained on five-year-old sales records that no longer reflect current store locations, product lines or customer behavior, and forecasts are becoming increasingly inaccurate. Which characteristic of AI does this best illustrate?

  1. Autonomy, because the system generates forecasts without human sign-off on each run
  2. Data dependency, because output quality tracks the relevance and currency of the data
  3. Opacity, because the reasoning behind individual forecasts resists interpretation
  4. Probabilistic output, because identical inputs can produce different forecasts
Answer: Data dependency, because output quality tracks the relevance and currency of the data
Degraded forecasts driven by stale, no-longer-representative training data illustrate data dependency: output quality is bound to the quality, relevance and currency of the training data (b). Nothing in the scenario turns on absent human sign-off (a) or on interpretability of the model's logic (c), and probabilistic output (d) concerns inherent variation in results, not data going stale over time.

Question 15

A hospital's triage-support AI recommends a prioritization order for the emergency department, but nurses retain full authority to reorder patients based on clinical judgment, and the system logs overrides without penalizing the nurse for disagreeing with it. Which responsible AI principle is this design most directly advancing?

  1. Fairness, by ensuring equitable prioritisation across patient groups
  2. Human-centricity, keeping meaningful human agency over the decision
  3. Explainability, by making the system's reasoning open to clinical review
  4. Security, by protecting the triage system from unauthorised interference
Answer: Human-centricity, keeping meaningful human agency over the decision
Nurses keep real, unpenalised authority to reorder patients, which preserves meaningful human agency and control over an AI-influenced decision — the core of human-centricity (b). (a) concerns unjust bias across groups, which the scenario does not describe. (c) concerns understanding why an output was produced, not who holds final authority. (d) concerns protecting the system and its data, not decision-making control.

Question 16

A security researcher repeatedly queries a company's publicly accessible fraud-detection API with carefully crafted inputs and reconstructs a close approximation of the underlying model's decision logic, which could then be used to craft inputs that evade detection. Which responsible AI principle and control area most directly addresses this risk?

  1. Fairness, through bias testing and representative data
  2. Privacy and security, through protecting the model itself from adversarial extraction and evasion attacks
  3. Explainability, through publishing detailed reason codes for every decision
  4. Human-centricity, through ensuring meaningful human override of the API
Answer: Privacy and security, through protecting the model itself from adversarial extraction and evasion attacks
Model extraction through crafted queries is an AI-specific security threat targeting the model itself, addressed by privacy and security controls such as rate limiting, query monitoring and adversarial testing (b). Fairness (a) and explainability (c) address different failure modes (bias, interpretability) unrelated to extraction attacks. Human-centricity (d) is about human control over decisions, not protecting the model from probing.

Question 17

A content-moderation model is trained on labels applied by contractors given inconsistent, vaguely worded instructions, so similar posts are labeled 'violating' or 'acceptable' almost at random depending on which contractor reviewed them. Once trained, the model's decisions show the same inconsistency. What is the most likely source of this problem?

  1. Proxy discrimination through a variable correlated with a protected attribute
  2. Label bias introduced by inconsistent human annotation criteria
  3. Automation bias among contractors over-trusting the model's suggested labels
  4. A model extraction attack by an external party probing the classifier
Answer: Label bias introduced by inconsistent human annotation criteria
Vague, inconsistent annotation instructions cause the contractors to apply labels near-randomly, and that label bias flows directly into the training data and then into the trained model (b). No correlated stand-in for a protected attribute is described (a). Automation bias (c) is over-reliance on an existing automated output, not the creation of inconsistent labels in the first place, and nothing in the scenario involves an external party probing the model (d).

Establish and communicate organizational expectations for AI governance (questions 18–35)

Question 18

A bank's internal audit team drafted the AI governance policy and now plans to audit business units against it. The chief risk officer objects. Why?

  1. Internal audit lacks the specialist AI expertise needed to draft a technically sound policy
  2. The board should draft the policy itself rather than delegating it to a control function
  3. Internal audit would be assuring controls it designed itself; policy drafting belongs with the second line
  4. Policy drafting is a first-line responsibility that belongs with the business units being audited
Answer: Internal audit would be assuring controls it designed itself; policy drafting belongs with the second line
Under the three-lines model, internal audit provides independent assurance and must not audit a policy it designed; drafting the AI governance policy belongs with second-line risk and compliance functions (c). Expertise gaps (a) can be remedied and are not the structural objection. Boards approve policy rather than draft it (b), and first-line business units execute controls rather than own enterprise policy design (d).

Question 19

A retailer licenses a third-party demand-forecasting system, fine-tunes it on its own sales data, and sells access to other retailers under its own brand. From a governance and regulatory perspective, what has the retailer most likely become?

  1. A deployer, because it merely operates a system built by another company
  2. A provider, because it substantially modified the system and rebranded it
  3. A distributor, because it makes a third party's system available on the market
  4. A processor, because it handles sales data on the original vendor's behalf
Answer: A provider, because it substantially modified the system and rebranded it
Substantially modifying a system and marketing it under one's own name are the classic triggers that convert a purchaser into a provider carrying full provider obligations (b). A deployer merely uses a system under its own authority, whereas the retailer modified and resold it (a). A distributor supplies a system to the market without modification or rebranding (c). Processor is a data-protection role for entities acting on a controller's instructions, and the retailer determines its own purposes (d).

Question 20

A 12,000-employee insurer and a 30-person startup both ask how to structure AI governance. Which advice best reflects the BoK's approach?

  1. Give both the same standard structure: an AI governance committee, a full policy suite and a dedicated second-line risk function, for consistency
  2. Scale the design to each organisation: formal committees and model risk structures for the insurer, AI review embedded in existing product and risk processes for the startup
  3. Have the startup run informal governance for now, deferring named accountability for AI decisions until it can hire a dedicated risk officer
  4. Have the insurer push AI oversight down to individual business units so decisions stay close to the teams building and deploying the models
Answer: Scale the design to each organisation: formal committees and model risk structures for the insurer, AI review embedded in existing product and risk processes for the startup
Governance should be proportionate to size, maturity, sector and risk profile: the regulated insurer needs formal committees and model risk structures, while the startup embeds AI review into existing processes with named ownership (b). (a) imposes a one-size-fits-all apparatus a 30-person firm cannot sustain. (c) leaves AI decisions without an accountable owner, which even small firms need from day one. (d) strips out the central policy and high-risk oversight a regulated insurer must retain.

Question 21

An AI ethics review nearly shipped a hiring tool that legal later found violated local automated-decision rules. Engineers say legal 'was not on the invite'. What is the primary governance failure?

  1. Insufficient technical documentation of the model's design and test results
  2. Absence of a cross-functional review gate bringing in legal, privacy and HR
  3. Lack of a dedicated AI ethicist role with authority over hiring deployments
  4. Selection of a fairness metric poorly suited to the hiring context
Answer: Absence of a cross-functional review gate bringing in legal, privacy and HR
The tool's legal defect was invisible to engineers and is exactly what a structured review gate convening legal, privacy and HR exists to catch before launch (b). Better documentation (a) records design decisions but does not surface a legal prohibition. Hiring an ethicist (c) adds a title without guaranteeing the right functions reach the decision, and a different fairness metric (d) would not have revealed a rule against automated decision-making.

Question 22

Who is ultimately accountable for the risks of an organisation's AI portfolio?

  1. The chief data scientist who approves models
  2. The AI governance committee
  3. The board and executive leadership
  4. Each system's vendor under contract
Answer: The board and executive leadership
Accountability concentrates at the top and cannot be delegated to committees (b), technical leaders (a) or vendors (d). Committees and owners manage risk on the board's behalf; contracts allocate money, not accountability.

Question 23

A firm rolls out a generative AI assistant to all staff with a single onboarding email describing the tool. Six months later, misuse incidents are climbing. Which programme element was most clearly inadequate?

  1. Model selection, since a different foundation model would have reduced misuse
  2. A role-based, recurring training and awareness programme for staff
  3. The procurement process used to source and contract for the assistant
  4. The network security controls governing access to the assistant
Answer: A role-based, recurring training and awareness programme for staff
A single onboarding email is not a training programme: acceptable use must be taught through role-based, recurring instruction whose effectiveness is measured, and climbing misuse shows that never happened (b). Nothing indicates the model itself caused the misuse (a), that the tool was badly sourced (c), or that unauthorised access occurred (d) — the incidents stem from how staff use the tool.

Question 24

A multinational adopts a model where a central team sets AI policy and reviews high-risk cases, while business units approve routine, low-risk uses locally. What is this operating model called?

  1. Centralised
  2. Federated
  3. Hybrid
  4. Distributed autonomy
Answer: Hybrid
Central policy plus central high-risk review combined with local routine approval is the hybrid model (c), the common choice for large organisations. Fully centralised (a) would route everything centrally; federated (b) would devolve decisions broadly under central policy; (d) is not a standard term.

Question 25

A research lab trains a large language model, publishes technical documentation describing its capabilities and limitations, and licenses it to other companies to build their own products. The lab does not itself place the model into any specific product or service under its own name. Under the BoK's value-chain roles, what is the lab's role, and what has it not yet taken on?

  1. A developer that has not yet taken on provider obligations for downstream products
  2. A provider for each downstream product, because licensing places the model on the market
  3. A deployer, because it trained and evaluated the model on real-world operational data
  4. A distributor, since it supplies the model to companies rather than to end users
Answer: A developer that has not yet taken on provider obligations for downstream products
Training and documenting a model is the developer role; provider obligations attach when an actor places a system on the market or into service under its own name, which the lab has not done (a). (b) overreaches: each licensee that productises the model becomes the provider of its own system, though under the EU AI Act commercially licensing a general-purpose model can separately trigger GPAI model-provider duties. (c) confuses training a model with operating a system under one's own authority, and (d) fails because a distributor supplies others' systems rather than developing its own.

Question 26

A staffing agency's AI resume-screening tool rejects a qualified candidate without offering any explanation, and the agency has no channel through which the candidate can question or contest the outcome. Whose governance interest is most directly unmet here?

  1. The developer's, because model performance metrics were not released for outside review
  2. The affected candidate's, who received neither transparency nor a route to explanation or redress
  3. The provider's, because the agency may be exceeding the licence terms for volume screening
  4. Internal audit's, because the function was not consulted on the tool before it went live
Answer: The affected candidate's, who received neither transparency nor a route to explanation or redress
The rejected candidate is the affected individual, and governance frameworks treat that role as entitled to transparency about the outcome and a channel for explanation and redress, none of which the agency provided (b). Publication of performance metrics is not the interest the facts put in issue (a). No licensing breach is described (c), and audit consultation, while good practice, is not the interest most directly unmet by an unexplained, uncontestable rejection (d).

Question 27

A company rolls out a generative AI tool enterprise-wide. Finance and marketing staff receive the same two-hour technical workshop originally built for engineers, covering model architecture and fine-tuning. Frontline staff report the session did not answer their day-to-day questions about what data they may safely input. What is the best correction?

  1. Treat the completed workshop as sufficient and close out the training requirement
  2. Provide role-based training: acceptable-use guidance for general staff, technical depth for builders
  3. Circulate an all-staff email summarising the acceptable-use policy in place of further sessions
  4. Concentrate the training budget on the engineering team, since they configure the systems
Answer: Provide role-based training: acceptable-use guidance for general staff, technical depth for builders
Training must match the audience: general staff need AI literacy and acceptable-use guidance for daily inputs, while technical depth belongs with builders and reviewers (b). Closing out the requirement (a) leaves the reported gap unaddressed. An email (c) is not training and would not answer staff questions, and limiting investment to engineers (d) ignores that business staff handle the risky inputs day to day.

Question 28

A 25-person health-tech startup builds an AI tool that assists in diagnosing skin conditions from patient photos. A board member argues the company is too small to need formal AI governance structures. What is the best response?

  1. Agree; governance formality should scale with headcount, and 25 staff is below the bar
  2. Disagree; the healthcare use case demands risk-proportionate controls, implemented leanly
  3. Agree; formal structures are an investor and listing requirement rather than a startup concern
  4. Disagree; the startup should adopt an enterprise-grade committee structure before launch
Answer: Disagree; the healthcare use case demands risk-proportionate controls, implemented leanly
Proportionality turns on risk and sector, not just size: a diagnostic tool in healthcare is high-stakes, so the startup needs meaningful controls even if implemented leanly with named ownership rather than heavy committees (b). Headcount is the wrong proxy for governance need (a), and formal governance is a risk-management necessity, not merely an investor or listing artefact (c). An enterprise-grade committee structure would be disproportionate for 25 people; lean does not mean absent (d).

Question 29

A model owner in the marketing department wants to launch a new personalization AI system quickly and self-certifies that it meets fairness and privacy requirements, without any independent review by another function. What governance principle does this bypass?

  1. The three lines of defence, requiring independent second-line challenge of first-line self-assessments
  2. The third line of defence, under which internal audit must sign off each system launch
  3. Board oversight, which requires director-level review of each individual AI deployment
  4. Regulatory pre-approval, under which supervisors must clear AI systems before launch
Answer: The three lines of defence, requiring independent second-line challenge of first-line self-assessments
First-line owners manage risk, but second-line functions such as risk, compliance, privacy and legal must independently challenge their self-assessments before launch; unreviewed self-certification collapses that separation (a). Internal audit, the third line, provides periodic assurance rather than launch sign-off (b). Boards set risk appetite and hold accountability but do not review individual deployments (c), and regulatory pre-approval is not the general mechanism for internal launches (d).

Question 30

An AI governance committee approves adoption of a third-party generative AI writing tool after review by legal (contract terms) and privacy (data flows), but without input from the security function. Weeks later, the tool is found to have a prompt-injection vulnerability that leaks confidential prompts to other tenants. What was the gap?

  1. Legal review should have extended to identifying technical vulnerabilities in the tool
  2. The review omitted the security function's expertise on AI-specific technical threats
  3. Privacy's data-flow review should have been treated as covering multi-tenant security
  4. Contract review added delay without addressing the risks that later materialised
Answer: The review omitted the security function's expertise on AI-specific technical threats
Prompt injection is an AI-specific technical security threat squarely within the security function's remit, and that function was absent from the review (b). Legal (a) reviews contract terms and is not positioned to find code-level vulnerabilities. Privacy's data-flow review (c) covers a related but distinct risk set and does not substitute for security review, and (d) blames legal review, which addressed real risks and did not cause the gap.

Question 31

Two similarly sized companies adopt the same generative AI drafting tool. Company A is a defense contractor with low risk tolerance and strict compliance obligations; Company B is a consumer entertainment app with high risk tolerance. Which statement about their governance approaches is most defensible?

  1. Both should adopt the same controls, since the risk comes from the tool itself
  2. Company A will likely apply stricter controls, given its lower risk tolerance and compliance obligations
  3. Company B can rely on the vendor's controls, given its higher risk tolerance
  4. Company B should match Company A's controls to maintain an industry-standard posture
Answer: Company A will likely apply stricter controls, given its lower risk tolerance and compliance obligations
The NIST AI RMF frames risk as a function of deployment context and organizational risk tolerance, not the tool alone, so the defense contractor should expect more review gates and restricted use cases for the same product (b). (a) locates all risk in the tool and ignores context. (c) confuses high risk tolerance with outsourcing governance; the deploying company still owns its risk decisions. (d) treats another company's posture as a standard, when controls should be calibrated to each company's own tolerance and obligations.

Question 32

A data scientist is tasked with implementing bias mitigation on a hiring model. The model is later found to produce discriminatory outcomes after deployment. Who answers for the outcome under the accountability principle, even though the data scientist did the technical work?

  1. The data scientist, as the person who carried out the mitigation work
  2. The system's designated accountable owner or leadership, regardless of who performed the work
  3. The compliance team, since discrimination monitoring falls within its remit
  4. The vendor that supplied the underlying model and its training data
Answer: The system's designated accountable owner or leadership, regardless of who performed the work
Responsibility means performing the task; accountability means answering for the outcome, and frameworks such as the NIST AI RMF place it with the designated system owner or leadership, who cannot shed it by assigning work (b). (a) names the responsible party, not the accountable one. (c) confuses a monitoring function with ownership of the outcome. (d) shifts blame into the supply chain, but the company deploying the hiring model remains accountable for the outcomes it produces.

Question 33

After delivering mandatory AI acceptable-use training to all staff, a company records 100% completion but never tests comprehension or tracks whether policy violations decline. Six months later, confidential data leaks into a public AI tool. What element of a defensible training programme was missing?

  1. More frequent refresher sessions delivered to all staff
  2. Measurement of whether the training changed comprehension and behavior
  3. Role-specific content tailored to each department's AI use
  4. Disciplinary consequences written into the acceptable-use policy
Answer: Measurement of whether the training changed comprehension and behavior
The company tracked attendance but never checked whether the message landed; comprehension checks and monitoring of violation trends are what turn completion figures into evidence of effectiveness, and their absence is the gap these facts demonstrate (b). (a) repeating an unmeasured course more often repeats the same blind spot. (c) tailoring can improve relevance, but nothing in the facts shows the content failed for a particular role. (d) sanctions address violations after the fact, not whether staff understood the policy.

Question 34

A global conglomerate with highly autonomous, differently regulated business units (banking, retail, logistics) lets each unit make its own AI governance decisions, provided they operate within minimum standards set centrally, such as a shared risk taxonomy and a prohibited-use list. No central team pre-approves individual use cases. Which operating model is this?

  1. Centralised
  2. Federated
  3. Hybrid
  4. Decentralised
Answer: Federated
Central minimum standards, such as a shared risk taxonomy and prohibited-use list, combined with unit-level decision-making and no case-by-case central approval, define the federated operating model (b). (a) a centralised model routes decisions through one central function. (c) a hybrid model typically keeps central pre-approval for high-risk cases while devolving routine ones, which is not described here. (d) a decentralised model leaves units fully independent, without the central minimum standards present in this scenario.

Question 35

New employees complete AI literacy training covering definitions and acceptable use, but it never explains how to report a suspected AI harm or malfunction. An employee later notices a customer-facing chatbot giving dangerous medical advice but does not know who to tell, and the issue persists for weeks. What gap does this reveal in the training and awareness programme?

  1. Missing coverage of escalation paths for reporting AI-related concerns
  2. Missing coverage of the company's data retention and deletion schedules
  3. Missing coverage of intellectual property ownership in AI-generated output
  4. Missing coverage of the vendor contract terms governing the chatbot
Answer: Missing coverage of escalation paths for reporting AI-related concerns
Training must tell staff how to escalate a suspected AI harm; because it did not, an alert employee had no route to report dangerous chatbot output and the problem persisted for weeks (a). Retention schedules (b), IP ownership (c) and vendor contract terms (d) are all legitimate training topics, but none of them explains the demonstrated failure, which is about knowing who to tell.

Establish policies and procedures to apply throughout the AI life cycle (questions 36–50)

Question 36

An AI team plans to add bias testing 'as a final check before launch'. Under an ethics-by-design approach, what is the correct critique?

  1. Bias testing should be handed to an accredited external certifier instead of the internal team
  2. Fairness controls must begin at the design and data-acquisition stages rather than at a final gate
  3. Testing just before launch is adequate provided the test set is large and demographically diverse
  4. Bias should be treated as a legal-compliance question and assessed during post-deployment review
Answer: Fairness controls must begin at the design and data-acquisition stages rather than at a final gate
Ethics-by-design requires fairness requirements and controls to enter at the design and data-acquisition stages, because a test at the end can detect but not repair a structurally biased dataset (b). Outsourcing to a certifier (a) does not discharge the organisation's own duty, a large test set (c) cannot cure upstream skew, and deferring bias to post-deployment legal review (d) waits until harm has occurred.

Question 37

Employees are pasting client contract text into a public generative AI tool to summarise it. Which policy instrument most directly governs this behaviour?

  1. The model development policy governing how in-house systems are built and validated
  2. The AI acceptable use policy, reinforced by confidentiality and security policies
  3. The provider's post-market monitoring plan for its deployed AI systems
  4. The records retention schedule covering client contract documentation
Answer: The AI acceptable use policy, reinforced by confidentiality and security policies
Employee use of external AI tools is acceptable-use territory: the AI acceptable use policy, with confidentiality and security policies reinforcing it, most directly governs pasting client material into public services (b). The model development policy (a) governs how the organisation builds its own systems, not how staff use third-party tools. A post-market monitoring plan (c) is a provider artefact for deployed systems, and the retention schedule (d) governs how long records are kept, not disclosure to outside services.

Question 38

A procurement lead argues that a vendor's ISO 42001 certificate makes further assessment of its hiring tool unnecessary. What is the best response?

  1. Agree: accredited third-party certification is designed to substitute for buyer due diligence
  2. Disagree: the certificate attests the vendor's management system, so the buyer must still assess the tool in its own context
  3. Agree, provided the certificate is current and its scope statement covers the hiring tool's product line
  4. Disagree: ISO/IEC 42001 covers information security controls, so a separate AI-specific assessment is needed
Answer: Disagree: the certificate attests the vendor's management system, so the buyer must still assess the tool in its own context
ISO/IEC 42001 certifies an organisation's AI management system, not the safety or legality of a specific tool in the buyer's deployment context, and accountability does not transfer with procurement (b). (a) misstates the purpose of certification, which supplements rather than replaces diligence. (c) fixes the wrong variable: even a current, in-scope certificate does not attest the tool's fit in the buyer's context. (d) confuses ISO/IEC 42001 with ISO/IEC 27001; the real issue is certification's scope, not its subject matter.

Question 39

During a live incident in which an AI system produced harmful outputs to customers, an engineer proposes quietly retraining the model overnight. What is the primary governance objection?

  1. Retraining takes too long to serve as an effective containment measure during a live incident
  2. A quiet fix bypasses the incident response process the harmful outputs should have triggered
  3. Model retraining decisions of this kind require prior sign-off from the board risk committee
  4. The engineer should instead deploy an output filter as a faster technical mitigation measure
Answer: A quiet fix bypasses the incident response process the harmful outputs should have triggered
Incident response requires containment, escalation, documentation and, where duties apply, notification; retraining quietly bypasses every one of those steps (b). Speed (a) is not the governance concern, and no general rule routes retraining decisions through the board risk committee (c). An output filter (d) is merely an alternative technical fix and raises the same objection if applied silently.

Question 40

A company's privacy, security and IP policies predate its AI adoption. The governance lead proposes a gap analysis of each against AI use rather than writing one grand AI policy from scratch. Why is this defensible?

  1. Amending existing policies avoids the change-management burden of training staff on a new document, the main risk in any policy rollout
  2. The policies already govern the behaviours involved, so AI-aware amendments keep rules where staff already look, with new instruments only for gaps
  3. A standalone AI policy would overlap the documentation regulators already review, exposing the company to conflicting audit findings
  4. AI mainly changes technical tooling rather than the underlying obligations, so the existing policy text can stand with light review
Answer: The policies already govern the behaviours involved, so AI-aware amendments keep rules where staff already look, with new instruments only for gaps
Good practice is to gap-assess existing policy families — privacy, security, data governance, IP — against AI use and update them, adding AI-specific instruments only where genuine gaps remain, because that keeps rules where people already look for them (b). (a) reduces a coverage question to rollout burden. (c) invents a duplication problem; internal policies are not regulator filings that conflict. (d) understates the change: AI alters how each obligation must be met, which is exactly why the gap analysis is needed.

Question 41

Which set of contract terms most directly addresses the risk that an AI vendor suffers a security breach affecting your data and never tells you?

  1. Exit and data portability terms enabling migration to another vendor
  2. Incident and breach notification obligations with defined timelines
  3. IP indemnification covering third-party infringement claims
  4. Service level agreements with credits for availability shortfalls
Answer: Incident and breach notification obligations with defined timelines
Notification obligations create both the vendor's duty to tell the customer about a breach and a deadline for doing so, directly addressing silent breaches (b). Exit and portability terms (a) govern leaving the vendor, IP indemnification (c) covers infringement claims, and service level credits (d) compensate downtime without compelling any disclosure.

Question 42

At which life cycle stage should a use case first be screened against prohibited and high-risk categories?

  1. At deployment, when the system's final form is known
  2. At use case assessment, before design or data work begins
  3. During conformity assessment
  4. During post-market monitoring
Answer: At use case assessment, before design or data work begins
Classification screening belongs at intake: a prohibited use should never consume design effort, and a high-risk classification reshapes everything downstream (b). Deployment (a) and conformity (c) are far too late to discover a banned use, and post-market (d) is after the fact.

Question 43

An AI system processing personal data will be retired. The project manager proposes deleting all associated documentation and logs along with the data 'for privacy'. What is wrong?

  1. Nothing; the storage limitation principle requires erasing all records once processing ends
  2. Accountability requires retaining documentation and logs under the retention policy after decommissioning
  3. The personal data should be anonymised for research use rather than deleted
  4. Deletion decisions rest with the data protection officer, not the project manager
Answer: Accountability requires retaining documentation and logs under the retention policy after decommissioning
Retiring a system triggers two separate duties: dispose of personal data on its retention schedule, and keep the documentation, decisions and logs that evidence compliance for audit and liability periods, as the GDPR accountability principle (Article 5(2)) requires (b). (a) misapplies storage limitation, which governs personal data, not the compliance record. (c) invents an anonymisation duty the facts do not raise; deleting the data on schedule is proper. (d) misstates the DPO role, which under GDPR Article 39 is to advise and monitor, not to take disposition decisions.

Question 44

A governance lead drafts a document stating: 'Before deployment, the model owner must complete Steps 1 through 6, in order, including running the bias-testing script and obtaining sign-off from the review committee.' A separate, higher-level document states that all models must pass fairness review before deployment. What is the six-step document, and how does it relate to the higher-level one?

  1. A procedure implementing the higher-level document, which is a policy
  2. A policy operating at a finer level of detail than the higher-level policy
  3. A procedure duplicating another procedure that covers the same control
  4. A policy that is operationalised by the higher-level procedure
Answer: A procedure implementing the higher-level document, which is a policy
The six-step document tells the model owner exactly how to comply, step by step, which makes it a procedure, while the higher-level requirement that all models pass fairness review states what must happen, which is a policy (a). Calling the steps a policy (b) confuses detailed instructions with a statement of rules, (c) wrongly treats the higher-level rule as a second procedure, and (d) reverses the two instruments.

Question 45

A marketing team uses a generative AI tool to draft ad copy, and some outputs closely resemble licensed stock imagery referenced in the tool's training discussions. Legal is asked whether the company owns the output and whether it had the right to use the underlying training data. Which existing policy family most directly needs AI-aware updates to address this?

  1. Data retention policy
  2. Intellectual property policy
  3. Acceptable use policy
  4. Vendor management policy
Answer: Intellectual property policy
Who owns AI-generated output and whether there were rights to train on the underlying data are copyright and licensing questions, so the intellectual property policy needs AI-aware updates covering training-data rights, output ownership and confidential material entering prompts (b). (a) governs how long records are kept, not who owns them. (c) governs how employees may use the tool, not the ownership and rights questions Legal was asked. (d) governs supplier selection and monitoring, not rights in outputs or training data.

Question 46

A company's customer-facing chatbot is tricked by a crafted user message into ignoring its system instructions and revealing internal pricing rules it was told to keep confidential. Which policy family most directly needs an AI-specific update to address this class of threat?

  1. Data governance policy, to strengthen lineage and provenance records
  2. Security policy, extended to cover adversarial attacks on model behaviour
  3. Intellectual property policy, to clarify ownership of generated outputs
  4. HR policy, to mandate workforce training on approved chatbot use
Answer: Security policy, extended to cover adversarial attacks on model behaviour
An instruction-override attack of this kind is prompt injection, an AI-specific security threat, so the security policy family needs updating to name and control it alongside traditional threats (b). Data governance policy (a) addresses lineage and quality, not adversarial manipulation. IP policy (c) concerns ownership of outputs, and HR policy (d) concerns workforce conduct and training; none of these governs this attack class.

Question 47

A model's outputs are found to be less accurate for one product line, and no one can determine which data sources, transformations or versions contributed to the training set for that model. What element of AI-aware data governance was missing?

  1. Data lineage and provenance records tracing sources, transformations and versions of training data
  2. A signed data processing agreement with the cloud provider hosting the training pipeline
  3. A model card documenting the finished model's intended use, limitations and evaluations
  4. A red-teaming exercise probing the deployed model for adversarial weaknesses and misuse
Answer: Data lineage and provenance records tracing sources, transformations and versions of training data
Being unable to determine which sources, transformations or versions fed a training set is a failure of data lineage and provenance record-keeping (a). A data processing agreement governs contractual processing terms, not traceability of the pipeline (b). A model card documents the finished model, not the origin of its training data (c). Red-teaming surfaces adversarial weaknesses, not the ancestry of training data (d).

Question 48

Procurement is evaluating three AI tools: a marketing copy generator, a warehouse routing optimizer, and a resume-screening tool for hiring. Which should receive the most rigorous nondiscrimination-focused due diligence, and why?

  1. The routing optimizer, because its schedules affect the largest number of workers
  2. The resume-screening tool, because hiring decisions carry direct exposure under employment law
  3. The copy generator, because generative models most readily reproduce biased language
  4. All three equally, because nondiscrimination principles apply to every AI system
Answer: The resume-screening tool, because hiring decisions carry direct exposure under employment law
Resume screening shapes individuals' access to employment, where nondiscrimination law applies most directly: employment discrimination statutes reach hiring tools, and the EU AI Act (Annex III) classifies employment-related AI as high risk (b). (a) points to operational scale, not discriminatory effect on protected groups. (c) describes an output-quality concern without legal effect on individuals. (d) ignores proportionality; nondiscrimination principles apply broadly, but the depth of due diligence should follow the exposure each use case creates.

Question 49

A company completes a thorough pre-contract questionnaire on a vendor's AI tool covering data sources, testing and security posture, signs the contract, and treats third-party risk management as complete. Eight months later, the vendor silently changes the underlying model without notice, degrading accuracy. What governance step was missing?

  1. A more detailed pre-contract questionnaire covering model architecture and update practices
  2. Ongoing vendor monitoring for the life of the contract, beyond pre-signature due diligence
  3. A stronger non-disclosure agreement protecting the information the vendor shared in diligence
  4. An internal audit of the procurement function's adherence to the company's sourcing policy
Answer: Ongoing vendor monitoring for the life of the contract, beyond pre-signature due diligence
Third-party risk management continues for the life of the relationship; ongoing monitoring would have surfaced the silent model change (b). A more detailed questionnaire (a) still captures the position at signing and nothing after. An NDA (c) protects shared information rather than model stability, and auditing procurement (d) checks the sourcing process, not vendor behaviour after signature.

Question 50

A company suspects its AI vendor's fraud-detection model has degraded, but the vendor refuses to share performance data or allow any independent review, citing trade secrets. Which contract term, if negotiated up front, would most directly have prevented this impasse?

  1. An exit and portability clause covering data and model handover
  2. Audit and information rights over the vendor's model performance
  3. A service-level agreement tied to system availability and uptime
  4. A limitation-of-liability clause capping damages for model failure
Answer: Audit and information rights over the vendor's model performance
Audit and information rights are the clause that entitles the customer to performance data or independent review notwithstanding trade-secret objections (b). Exit and portability terms govern leaving the relationship, not visibility during it (a). An availability SLA measures uptime, not model accuracy or degradation (c). A liability cap allocates damages after a failure rather than granting any right to inspect performance (d).

Keep going

That is 50 of 492. All 100 Domain I questions are free in the app — no card details — with progress tracking and per-question explanations. A pass adds the rest of the bank across all four domains, plus timed mock exams that mix domains the way the real paper does and per-domain scoring that shows where to spend your next session.

Start studying free

Also useful: the Domain I study guide, the glossary, and the exam format guide. To slot practice into a schedule, see how to study for the AIGP; weighing up paid options first, see the best AIGP prep compared.

AI Governance Study is an independent study aid. It does not represent a government entity: it is not affiliated with, endorsed by or authorised by any government, government agency or regulatory authority, and it does not provide government services or legal advice. Laws and frameworks are described in our own words — the official texts are listed at official sources. It is also not affiliated with, endorsed by, or sponsored by the IAPP. The AIGP name is used only to identify the exam this material helps you prepare for.