Artificial Intelligence Governance Professional Free Sample Questions

While PIPEDA and GDPR (which would also apply) have stringent data protection requirements, the EU AI Act introduces a product safety framework for high-risk AI systems. As a 'provider' placing a high-risk system on the EU market, the company must conduct a conformity assessment to demonstrate compliance with the Act's requirements and affix a CE marking, similar to other regulated products. Appointing an EU representative is necessary, but the conformity assessment is the core procedural requirement for market entry. Data processing agreements and DPIAs are GDPR requirements, which are related but distinct from the AI Act's conformity process.

Data provenance requires a detailed audit trail of the data's entire lifecycle. This includes its origin, any transformations, and its final state. Recording the origin (e.g., sensor IDs), the transformations (including software versions, as different versions can produce different results), and cryptographic hashes to ensure integrity are all critical components. The cost of storage is an operational metric, not a part of data provenance. The model's final accuracy is a performance metric derived from the data but not part of the data's history itself. The names of the engineers are part of project management, not the technical data lineage.

A hub-and-spoke model (also known as a federated model) is designed to solve this exact problem. The central 'hub' (the corporate AI governance office) sets the policies, standards, and provides expertise. The 'spokes' (embedded AI governance leads within business units) execute these policies in a way that is tailored to their specific context. This structure ensures consistency and efficiency (from the hub) while maintaining business unit agility and domain-specific knowledge (at the spokes). It does not completely centralize development nor does it make units fully autonomous.

This scenario describes ethical and bias risk, specifically amplification of historical bias. The AI model learned patterns from past hiring data, which likely contained societal or organizational biases. The model is now perpetuating and potentially amplifying this bias, leading to discriminatory outcomes. Model drift refers to performance degradation over time as data distributions change. Brittleness refers to a model failing on inputs slightly different from its training data. Lack of robustness is a general term for susceptibility to errors or attacks.

Given the mismatch between the vendor's training data and WellCare's patient population, the claimed 98% accuracy is unreliable for their specific use case. The most critical step is to validate the model's actual performance and fairness on their own data. This pre-deployment pilot or testing will quantify the real-world risk of misdiagnosis and bias. While negotiating liability, ensuring data security, and creating a human-in-the-loop process are all vital governance steps, none are as fundamental as first determining if the model is safe and effective for its intended population. Without this validation, the other controls are meaningless.

This statement is false. The 'GOVERN' function is a cross-cutting function that applies throughout the AI lifecycle. It is about cultivating a risk management culture, establishing processes, and providing the overarching structure for risk management. Post-deployment monitoring and measurement are primarily addressed within the 'MANAGE' and 'MEASURE' functions of the NIST AI RMF.

This is an example of post-hoc explainability. The AI model itself is a 'black box' (a complex deep learning system). Techniques like SHAP or LIME are applied after the model makes a prediction to approximate and explain its behavior for a specific instance. Intrinsic explainability, by contrast, comes from using models that are inherently simple and understandable, such as linear regression or decision trees. Global explainability describes the model's overall behavior, while local explainability (which SHAP provides) explains individual predictions.

While all options are considerations, the most significant governance risk is data privacy. Customer service transcripts are rich with PII (names, addresses, account numbers). Fine-tuning on this data creates a high risk that the model will 'memorize' this sensitive information and could potentially reveal it in responses to other users' queries. This is a major privacy breach and liability issue. Increased cost is a business concern, model collapse is a technical risk, and vendor lock-in is a strategic risk, but the PII disclosure risk is the most acute and immediate governance failure.

The risk mitigation hierarchy, a standard concept in safety and risk management, prioritizes controls from most to least effective. The highest priority is always elimination—designing the system so the hazard cannot occur in the first place. If elimination is not possible, the next steps are substitution, engineering controls, administrative controls, and finally, personal protective equipment (or its equivalent). Therefore, the first consideration should be if the risk can be designed out of the system entirely.

According to Annex III of the EU AI Act, AI systems intended to be used as safety components in the management and operation of road traffic are classified as high-risk. Optimizing traffic light timing directly impacts road safety, and therefore falls into this category. It is not prohibited (like social scoring), does not merely have transparency obligations (limited-risk), and is not considered minimal risk due to its direct impact on public safety.