Free Access to IAPP.AIGP.v2026-11-12.q219 with Valid Practice Test (Page 22)

Question 101

Business A sells software that provides users with writing and grammar assistance. Business B is a cloud services provider that trains its own AI models.
* Business A has decided to add generative AI features to their software.
* Rather than create their own generative AI model, Business A has chosen to license a model from Business B.
* Business A will then integrate the model into their writing assistance software to provide generative AI capabilities.
* Business A is most concerned that its writing assistance software could recommend toxic or obscene text to its users.
Which of the following governance processes should Business A take to best protect its users against potentially inappropriate text?

A.Business A should fine-tune the AI model on user-generated text that has been verified to be appropriate.
B.Business A should test that the AI model performs as expected and meets their minimum requirements for filtering toxic or obscene text.
C.Business A should establish a user reporting feature that allows users to flag toxic or obscene text, and report any incidents to Business B.
D.Business A should ask Business B for detailed documentation on the generative AI model's training data and whether it contained toxic or obscene sources.

Correct Answer: B

Business A is integrating a generative AI model licensed from a third party (Business B) and is primarily concerned with the risk of toxic or obscene outputs being delivered to users. In this scenario,testing and validationof the AI model for such content risks is the most direct and effective governance strategy.
According to theAI Governance in Practice Report 2025, organizations thatdeployAI must engage inperformance monitoring protocolsand ensure systems perform adequately for theirintended purposes, including filtering harmful content:
"Operational governance... development of: →Performance monitoring protocols to ensure systems perform adequately for their intended purposes." (p. 12)
"Product governance... includes: →System impact assessments to identify and address risk prior to product development or deployment." (p. 11) Furthermore, under theEU AI Act, which sets the global standard many organizations aim to align with, there is a clear obligation to test and monitor systems for potential harmful behavior:
"The act imposes regulatory obligations... such as establishing appropriate accountability structures,assessing system impact, providing technical documentation,establishing risk management protocols and monitoring performance..." (p. 7) Option B directly reflects this best practice ofpre-deployment testing and validationto ensure that the model aligns with Business A's minimum content safety requirements.
Let's now evaluate the incorrect options:
A . Fine-tuning on verified user-generated textmay improve model alignment but does not guarantee that the model will generalize correctly, especially if Business A lacks access to model internals (common in third-party licensing scenarios). Fine-tuning also introduces its own risks and may be contractually restricted.
C . A user reporting featureisreactive, not preventive. While helpful for long-term monitoring and mitigation, it does not prevent the initial harm of toxic outputs, which isBusiness A's primary concern.
D . Requesting documentation from Business Bis useful for transparency and risk management, but it does not replaceindependent verificationthat the model meets Business A's content safety standards.
Thus,testing the model's behavior for unacceptable outputs before deploymentis the most aligned approach with AI governance best practices and obligations.

Question 102

A company is working to develop a self-driving car that can independently decide the appropriate route to take the driver after the driver provides an address.
If they want to make this self-driving car "strong" Al, as opposed to "weak," the engineers would also need to ensure?

A.Thatthe Al has full human cognitive abilities that can independently decide where to take the driver.
B.That they have obtained appropriate intellectual property (IP) licenses to use data for training the Al.
C.That the Al has strong cybersecurity to prevent malicious actors from taking control of the car.
D.That the Al can differentiate among ethnic backgrounds of pedestrians.

Question 103

CASE STUDY
Please use the following to answer the next question:
A leading insurance provider that offers a range of coverage options to individuals has decided to utilize AI to streamline and improve its customer acquisition and underwriting process, including the accuracy and efficiency of pricing policies. The company has engaged a cloud provider to utilize and fine-tune its pre-trained, general purpose large language model ("LLM").
The company intends to use its historical customer data - including applications, policies and claims - and proprietary pricing and risk strategies to provide an initial qualification assessment of potential customers, which would then be routed to a human underwriter for final review.
The company and the cloud provider have completed training and testing the LLM, performed a readiness assessment, and made the decision to deploy the LLM into production. They have designated an internal compliance team to monitor the model during the first month, specifically to evaluate the accuracy, fairness and reliability of its output.
After the first month in production, the company realizes that the LLM declines a higher percentage of women's applications.
Each of the following steps would support fairness testing by the compliance team during the first month in production EXCEPT:

A.Validating a similar level of decision-making across different demographic groups.
B.Providing the applicants with information about the model capabilities and limitations.
C.Identifying if additional training data should be collected for specific demographic groups.
D.Using tools to help understand factors that may account for differences in decision-making.

Question 104

You are a privacy program manager at a large e-commerce company that uses an Al tool to deliver personalized product recommendations based on visitors' personal information that has been collected from the company website, the chatbot and public data the company has scraped from social media.
A user submits a data access request under an applicable U.S. state privacy law, specifically seeking a copy of their personal data, including information used to create their profile for product recommendations.
What is the most challenging aspect of managing this request?

A.Some of the visitor's data is synthetic data that the company does not have to provide to the data subject.
B.The data subject's data is structured data that can be searched, compiled and reviewed only by an automated tool.
C.The data subject is not entitled to receive a copy of their data because some of it was scraped from public sources.
D.Some of the data subject's data is unstructured data and you cannot untangle it from the other data, including information about other individuals.

Question 105

What is most likely the first action that a developer takes to map, plan and scope an AI project?

A.Define the business case and perform a cost/benefit analysis answering the question of "why AI?"
B.Use a test, evaluation, verification, validation (TEVV) process.
C.Perform an algorithmic impact assessment leveraging PIAs.
D.Determine feasibility and optionality of redress.

Question 101

Question 102

Question 103

Question 104

Question 105

Download PDF File