AIGP Exam Dumps - IAPP Artificial Intelligence Governance Questions and Answers

A, B, and E are the intended privacy-preserving choices. Data minimization limits processing to information that is adequate, relevant, and necessary for the defined purpose, reducing privacy exposure during AI development. Anonymization protects individuals by transforming information so that people are no longer identifiable under the applicable standard. Federated learning is a recognized privacy-enhancing technology that enables models to be trained across distributed datasets without centrally sharing the underlying raw training data. The ICO specifically identifies federated learning and related privacy-preserving methods as useful during AI training and explains the relationship between anonymization and data minimization. Data mapping is primarily a governance and inventory activity used to understand data flows, while data cleansing principally improves data quality by correcting or removing inaccurate, incomplete, or unsuitable records; neither is inherently a PET.

The potential negative consequences of using an AI tool in hiring include reputational harm (A), civil rights violations (B), and discriminatory treatment (C). These issues stem from biases in the AI system or its misuse, which can lead to unfair hiring practices and legal liabilities. Intellectual property infringement (D) is not a typical consequence of using AI in hiring, as it relates to the unauthorized use of protected intellectual property, which is not directly relevant to the hiring process or the potential biases within AI tools​​​​.

Third-party AI governance introduces issues that arise specifically because an organization depends on an external model provider. These include limited visibility into model architecture, training sources, capabilities and limitations; cybersecurity and information-security risks created through external integrations; and determining contractual responsibility and liability between the organization and vendor. These considerations make A, C, and D directly relevant to third-party governance. Back testing, by contrast, is primarily a model testing or validation methodology rather than a compliance consideration specific to the third-party relationship. Testing third-party AI systems remains an important governance practice, but the term " back testing " itself describes performance evaluation rather than vendor governance. NIST guidance emphasizes third-party transparency, due diligence, security, procurement controls, contractual expectations, and continuing risk management when organizations acquire or integrate external AI systems.

================

The IEEE Ethical System Design Risk Management Framework (IEEE 7000-21) would be most appropriate for XYZ Corp ' s governance needs in addition to the NIST AI Risk Management Framework. The IEEE framework specifically addresses ethical concerns during system design, which is crucial for ensuring the responsible use of AI in hiring. It complements the NIST framework by focusing on ethical risk management, aligning well with XYZ Corp ' s goals of deploying AI responsibly and mitigating associated risks​​​​.

Biasis a common risk acrossboth proprietary and open-source models, andnot uniqueto proprietary deployments. All AI systems — regardless of origin — require evaluation for fairness, accuracy, and representativeness.

From theAI Governance in Practice Report 2025:

“Bias, discrimination and fairness challenges are present in both open and closed models, regardless of how the model is sourced.” (p. 41)

The correct answer isD. GPS location data isnot biometric data—it is consideredgeolocation data, which is personal data butnot biometricunder most U.S. laws.

From the AIGP ILT Guide (Data Privacy Module):

“Biometric data includes measurable biological or behavioral characteristics such as iris scans, facial recognition, voice prints, and keystroke patterns when used for identification.”

AI Governance in Practice Report 2025 (Privacy and Data Protection section):

“Location data, while sensitive, is not considered biometric unless it’s tied to a uniquely identifyingbiological trait.”

Thus,GPS location data, while potentially sensitive, is not classified as biometric.

To evaluate the effectiveness of an AI-based ad recommendation tool, the most relevant metric is the output data, specifically assessing the delta between the prediction and actual ad clicks. This metric directly measures the tool ' s accuracy and effectiveness in making accurate recommendations that lead to user engagement. While monitoring algorithmic patterns and input data can provide insights into the model ' s behavior and targeting accuracy, and GPU performance can indicate the robustness and efficiency of the tool, the primary indicator of effectiveness for an ad recommendation tool is how well it predicts actual ad clicks.

A, D, and E introduce processing materially different from the practices described in the existing privacy policy. Storing chatbot inputs for RAG creates an additional retention and reuse purpose that should be addressed through appropriate privacy disclosures and retention controls. Using customer-session information to retrain the underlying model creates a distinct secondary purpose beyond processing an order, even when the data is subsequently deleted. Scanning a customer ' s appearance to infer frustration or confusion introduces an entirely new category of observation and inference, requiring additional transparency, legal-basis analysis, proportionality assessment, and safeguards. By contrast, B involves transferring customer information to a service provider so the requested service can operate, which the existing policy already permits. C involves ordinary contact and delivery information retained through completion of the transaction, which also fits the stated policy.

The correct answer is A because evaluating the effectiveness of an AI system requires measuring how well its outputs align with real-world outcomes. In this case, comparing predicted ad engagement with actual user clicks provides a direct measure of model performance and business impact. AI governance frameworks emphasize outcome-based monitoring to ensure systems meet their intended objectives and deliver value. Tracking output performance also supports continuous improvement by identifying gaps between predictions and reality. Options B and C focus on indirect indicators, such as internal model behavior or input targeting, which do not fully capture effectiveness. Option D relates to infrastructure performance rather than model outcomes. Monitoring output accuracy and real-world results is essential for validating AI system effectiveness and ensuring accountability.

The GDPR privacy principles that this scenario violates are Purpose Limitation and Data Minimization. Purpose Limitation requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Data Minimization mandates that personal data collected should be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. In this case, collecting extensive personal information (e.g., IP address, location, gender) and potentially using it beyond the necessary scope for the app ' s functionality could violate these principles by collecting more data than needed and possibly using it for purposes not originally intended.