AIGP Exam Dumps - IAPP Artificial Intelligence Governance Questions and Answers

When the accuracy of a model deteriorates, the best first step is to conduct champion/challenger testing. This involves deploying a new model (challenger) alongside the current model (champion) to compare their performance. This method helps identify if the new model can perform better under current conditions without immediately discarding the existing model. It provides a controlled environment to test improvements and understand the reasons behind the deterioration. This approach is preferable to directly replacing the model, performing audits, or running red-teaming exercises, which may be subsequent steps based on the findings from the champion/challenger testing.

In the selection and implementation of the AI hiring tool, involving Finance and Legal is crucial. The Finance team is essential for assessing cost implications, budget considerations, and financial risks. The Legal team is necessary to ensure compliance with applicable laws and regulations, including those related to data privacy, employment, and anti-discrimination. Involving these stakeholders ensures a comprehensive evaluation of both the financial viability and legal compliance of the AI tool, mitigating potential risks and aligning with organizational objectives and regulatory requirements.

In the machine learning context, feature engineering is the process of extracting attributes and variables from raw data to make it suitable for training an AI model. This step is crucial as it transforms raw data into meaningful features that can improve the model ' s accuracy and performance. Feature engineering involves selecting, modifying, and creating new features that help the model learn more effectively. Reference: AIGP Body of Knowledge on AI Model Development and Feature Engineering.

The EU AI Act outlines what must be included intechnical documentationfor high-risk systems. These requirements are designed to supportconformity assessment, transparency, and traceability.

From theAI Governance in Practice Report 2025:

“It mandates drawing up technical documentation… must include a general description of the AI system, the intended purpose, and a detailed description of the elements and development process.” (p. 34)

“Documentation… includes training, testing, evaluation procedures, andappropriateness of performance metrics.” (p. 34–35)

Therisk management systemis addressed separately through arisk management plan, not within the technical documentation itself.

Thus:

A, C, and Dare explicitly required in thetechnical documentation.

B, while important, is part of therisk management process, not a required section oftechnical documentation.

Biometric data in the U.S. refers to data that relates to measurable biological and behavioral characteristics that can be used to identify an individual. Examples include fingerprints, facial recognition, iris scans, and behavior-based data like gait or keystrokes.

According to definitions and discussions from theAI Governance in Practice Report 2025and U.S. privacy frameworks:

“Biometric data includes physical and behavioral human characteristics that can be used to digitally identify a person to grant access to systems, devices, or data. Examples include facial images, iris patterns, gait analysis, and voice recognition.” (Report context based on common frameworks in U.S. AI law and the use of biometrics in AI governance.)

Here’s how the options relate:

A. Iris scans– These are physical biometric identifiers.

B. Walking gait– Behavioral biometric used increasingly in surveillance and identification.

C. Keystroke dynamics– Behavioral biometric based on typing patterns.

D. GPS location of a user ' s fitness watch– This isnotbiometric data. It islocation data, which may be sensitive or personal, but not biometric.

The White House Executive Order of November 2023 designates the National Institute of Standards and Technology (NIST) as the responsible body for creating guidelines to conduct red-teaming tests of AI systems. NIST is tasked with developing and providing standards and frameworks to ensure the security, reliability, and ethical deployment of AI systems, including conducting rigorous red-teaming exercises to identify vulnerabilities and assess risks in AI systems.

Paid public generative AI services can be attractive because organizations can adopt them rapidly without developing and maintaining foundational models themselves. Commercial offerings may also provide organizational privacy, security, access-management, and administrative controls beyond those available through basic public access, while centrally managed services can receive frequent provider-driven feature enhancements. These characteristics support A, B, and C. However, payment does not guarantee transparency into proprietary model architecture, training data, weights, or decision processes, so D is incorrect. Nor does a paid service eliminate concerns regarding training-data provenance, intellectual property, personal information, confidential prompts, data retention, or generated outputs; consequently, E is incorrect. AI governance still requires vendor due diligence, contractual safeguards, acceptable-use controls, security assessment, and continuing monitoring when organizations depend on third-party generative AI services.

================

The EU AI Act explicitly prohibits the use of AI systems for social scoring by public authorities, as it can lead to discrimination and unfair treatment of individuals based on their social behavior or perceived trustworthiness. While AI can be used to promote equitable distribution of welfare benefits, manage border control, and even detect an individual ' s intent for law enforcement purposes (within strict regulatory and ethical boundaries), implementing social scoring systems is not permissible under the Act due to the significant risks to fundamental rights and freedoms.

Developing an AI model internally creates a direct need for technical expertise covering model development, infrastructure, deployment, monitoring, retraining, security, testing, and maintenance. This makes A the strongest distinguishing issue. Third-party AI services can reduce this operational burden because the external provider supplies much of the model and underlying infrastructure; IAPP guidance specifically notes that third-party APIs can accelerate deployment and reduce the burden of managing complex infrastructure. B is incorrect because an internally developed model generally provides more , not less, technical control. C is not necessarily true because total costs depend on scale, licensing, infrastructure, and usage. D is also too absolute: although developing a system can create substantial provider obligations, responsibility under AI laws and governance frameworks may still be distributed among providers, deployers, vendors, processors, and other actors depending on the circumstances.

================

The correct answer is A because deploying a proprietary agentic AI model places direct responsibility on the organization for the actions and outcomes of that system. AI governance frameworks emphasize accountability as a core principle, meaning organizations must take responsibility for harms caused by their AI systems, including misleading, biased, or unsafe outputs. Agentic AI systems, which can act autonomously and make decisions, introduce heightened liability risks because their behavior may directly impact users or third parties. Regulatory approaches increasingly focus on ensuring that deployers cannot shift responsibility, especially when the system is proprietary and under their control. The other options relate to operational or technical considerations, not primary legal liability. Ensuring accountability for AI behavior is central to compliance, risk management, and maintaining trust.