Certified Responsible AI Governance & Ethics Professional (C|RAGE) Free Sample Questions

The critical governance gate in an MLOps pipeline for compliance is after the model has been trained, validated, and registered, but BEFORE it is deployed to production. This ensures that only models with a signed-off Model Card (documenting intended use, limitations, and performance) and a Validation Report (proving it meets bias and accuracy thresholds) are released. Placing the gate here prevents non-compliant artifacts from impacting users.

Generative AI models (like LLMs) are designed to create new content based on learned patterns and are statistically probabilistic in a way that can lead to 'hallucinations' (plausible but factually incorrect outputs). For fraud detection, where factual accuracy and precise explainability of a binary decision (Fraud/Not Fraud) are required, Generative AI introduces significantly higher governance risks compared to Discriminative AI, which classifies data based on decision boundaries.

In a RAG architecture, the 'Retrieval' component fetches context (chunks of text) based on semantic similarity. If the vector database contains outdated medical protocols or retrieves irrelevant information that semantically matches the query, the LLM (the 'Generation' component) will use this bad context to generate an answer. Governance must ensure the knowledge base is curated and version-controlled to prevent the 'garbage in, garbage out' effect at the retrieval stage.

Governance does not end at deployment. When a model is retired, the organization should archive the model artifacts (weights, code, version), the training data snapshot or its lineage, and the decision logs for the defined retention/liability period, so it can answer later regulatory inquiries, litigation or consumer disputes about decisions the model made (NIST AI RMF GOVERN 1.7 covers decommissioning; SR 11-7 expects the model inventory to include retired models). Retention must follow a documented schedule: where personal data is kept, GDPR's storage-limitation principle requires deletion once the retention purpose ends. Deleting everything immediately destroys the audit trail.

This is a classic example of Proxy Bias, where a seemingly neutral feature (Softball Team) acts as a proxy for a protected attribute (Gender). To detect this disparity in outcomes (i.e., the rate at which different groups are selected), Demographic Parity (also known as Disparate Impact) is the appropriate metric. It compares the selection rate of the privileged group vs. the unprivileged group. Equal Opportunity focuses on True Positive Rates, which is different from the overall selection rate disparity described.

C2PA is the open technical standard that allows publishers to embed tamper-evident metadata (provenance) into media files. This allows consumers to verify the origin of the content (e.g., that it was AI-generated by a specific tool). This is the current industry standard for content authenticity. SSL/TLS secures transport, not content provenance. JWT is for authorization. OAuth is for access delegation.