Free Practice Questions for IAPP AIGP Exam

Theprimary considerationin selecting any AI system, especially aproprietary model, is itsfit for business purpose. Whether it serves the intended goals is foundational before evaluating technical or governance features.

From theAI Governance in Practice Report 2025:

“AI governance starts with defining the corporate strategy for AI… and aligning systems with business purpose and operational context.” (p. 11)

B, C, Dare relevant for evaluation, but onlyafterconfirming business applicability.

The correct answer isC. ISO/IEC 22989 and 42001 focus onterminology, risk, and management systems, butdo not specifically address procurement-related concerns with third-party vendors.

From the AIGP Body of Knowledge – Standards Section:

“ISO/IEC 22989 defines terminology and foundational concepts. ISO/IEC 42001 provides a management system standard for AI. They are not procurement-focused documents.”

Also confirmed in the AI Governance in Practice Report 2025:

“These standards help establish common language and risk governance procedures. Procurement governance typically falls under separate frameworks or sector-specific guidance.”

Thus,procurement governance (Option C)is not a central use case for these standards.

===========

The most significant risk from combining the healthcare network’s existing data with the clinical research partner data is privacy risk. Combining data sets, especially in healthcare, often involves handling sensitive information that could lead to privacy breaches if not managed properly. De-identified data can still pose re-identification risks when combined with other data sets. Ensuring privacy involves implementing robust data protection measures, maintaining compliance with privacy regulations such as HIPAA, and conducting thorough privacy impact assessments. Reference: AIGP Body of Knowledge on Data Privacy and Security.

Under the EU regulations, particularly the GDPR, banks using AI for decision-making must inform users about the use of AI and provide mechanisms for users to contest decisions. This is part of ensuring transparency and accountability in automated processing. Explicit consent under the privacy directive (A) and disclosing under the Digital Services Act (B) are not specifically required in this context. An adequacy decision is related to data transfers outside the EU (C).

The primary purpose of conducting ethical red-teaming on an AI system is to simulate model risk scenarios. Ethical red-teaming involves rigorously testing the AI system to identify potential weaknesses, biases, and vulnerabilities by simulating real-world attack or failure scenarios. This helps in proactively addressing issues that could compromise the system ' s reliability, fairness, and security. Reference: AIGP Body of Knowledge on AI Risk Management and Ethical AI Practices.

The correct answer isC. Thechoice of architecture(e.g., neural networks vs. decision trees) is typically part of thedesign and developmentphase, not the initial planning.

From the AIGP Body of Knowledge – AI Lifecycle Module:

“Planning involves scoping, context definition, stakeholder identification, governance planning, and assumptions—not yet model selection.”

Confirmed in the ILT Participant Guide:

“Design decisions such as architecture or algorithm type come after planning—usually during development based on technical feasibility and data availability.”

To maintain fairness in a deployed system, it is crucial to monitor for data drift that may affect performance and accuracy. Data drift occurs when the statistical properties of the input data change over time, which can lead to a decline in model performance. Continuous monitoring and updating of the model with new data ensure that it remains fair and accurate, adapting to any changes in the data distribution. Reference: AIGP Body of Knowledge on Post-Deployment Monitoring and Model Maintenance.

A, B, and E are the intended privacy-preserving choices. Data minimization limits processing to information that is adequate, relevant, and necessary for the defined purpose, reducing privacy exposure during AI development. Anonymization protects individuals by transforming information so that people are no longer identifiable under the applicable standard. Federated learning is a recognized privacy-enhancing technology that enables models to be trained across distributed datasets without centrally sharing the underlying raw training data. The ICO specifically identifies federated learning and related privacy-preserving methods as useful during AI training and explains the relationship between anonymization and data minimization. Data mapping is primarily a governance and inventory activity used to understand data flows, while data cleansing principally improves data quality by correcting or removing inaccurate, incomplete, or unsuitable records; neither is inherently a PET.

Ethical impact assessment should begin early and remain iterative throughout the AI lifecycle, making D correct. Waiting until production, a user threshold, or an actual ethical incident would make the assessment reactive rather than preventive. UNESCO describes ethical impact assessment as an " ethics by design " mechanism covering research, design, development, deployment, use, maintenance, monitoring, and eventual termination, while emphasizing its particular value during early research and design. OECD-listed assessment guidance similarly states that the first assessment should occur during design, with reassessments at development, deployment, and other significant lifecycle stages. NIST ' s AI RMF Playbook also recommends impact assessment at key stages because risks, operating conditions, stakeholders, data, and system capabilities can change over time. Continuous reassessment therefore supports proactive identification and mitigation of emerging harms.

================

The correct answer is Explainable Ai because it specifically refers to the ability of a system to describe the logic behind its decisions or output in a way that is understandable to humans. This is a key part of regulatory and ethical frameworks and is directly related to addressing the black-box problem in AI.

From the AIGP ILT Participant Guide (Module on Transparency and Explainability):

“Explainability refers to the understanding of how a black-box model works. The black-box problem exists because some models are too complex for human interpretation. Explainability methods aim to provide meaningful insight into the logic and decision-making of AI systems.”

Also, according to the AI Governance in Practice Report 2025:

“Explainability refers to the representation of the underlying mechanisms of the AI system’s operation... a key tenet of AI governance due to the desire to understand how AI systems are built, managed and maintained.”

Thus, while Trustworthy and Responsible AI are broader concepts,explainabilityspecifically targets the regulatory concern about understanding outputs.

===========