IAPP AIGP Exam Prep
Artificial Intelligence Governance Professional (Page 3 )

Updated On: 7-Sep-2026

What type of organizational risk is associated with AI’s resource-intensive computing demands?

  1. People risk.
  2. Security risk.
  3. Third-party risk.
  4. Environmental risk.

Answer(s): D

Explanation:

The correct answer is D. Environmental risk because AI's demanding computational needs translate directly into significant energy consumption. Training complex AI models often requires powerful hardware like GPUs running for extended periods. This high energy demand increases the carbon footprint of the organization. Data centers housing this infrastructure consume massive amounts of electricity, typically sourced from power grids that may rely on fossil fuels. Consequently, increased AI usage can lead to a rise in greenhouse gas emissions and contribute to climate change. This impact can negatively affect an organization's environmental reputation, sustainability goals, and compliance with environmental regulations. The environmental risk encompasses concerns regarding energy usage, carbon emissions, and the broader impact on the planet stemming from AI’s computational demands.
While other risks might be indirectly related, the direct and substantial consequence of high compute is its environmental impact.
For example, large language models like GPT-3 require vast resources for training and inference. These models necessitate specialized hardware and consume substantial power, directly contributing to increased energy consumption and potentially higher carbon emissions. Cloud providers are increasingly focusing on sustainable computing solutions, but the fundamental problem of high energy demand remains a significant environmental challenge.
Further reading on this topic can be found at:
1. Nature - Computing's climate consequences: https://www.nature.com/articles/d41586-023-03053-x 2. Green Software Foundation: https://greensoftware.foundation/ 3. Berkeley Lab - Estimating the carbon footprint of artificial intelligence: https://eta.lbl.gov/news/estimating-carbon-footprint



A hospital implements an AI system to assist doctors in diagnosing diseases based on historical patient data.
Which one of the following model types best describes this system?

  1. Inference.
  2. Statistical.
  3. Probabilistic.
  4. Deterministic.

Answer(s): C

Explanation:

The correct answer is C (Probabilistic), although A (Inference) also has some merit. Let's break down why probabilistic is stronger in this context.
A probabilistic model in AI deals with uncertainties and predicts outcomes based on probabilities. In the hospital example, the AI system uses historical patient data (symptoms, test results, etc.) to estimate the probability of a patient having a particular disease. The system doesn't provide a definitive "yes/no" answer but instead gives a likelihood score for each possible diagnosis. This is because medical diagnosis is inherently uncertain; similar symptoms can indicate different diseases, and no AI model can perfectly eliminate that uncertainty.
Inference (A) is a general concept referring to the process of drawing conclusions based on evidence and reasoning.
While the AI system certainly performs inference to reach a diagnosis, the model type itself is more precisely described as probabilistic because it quantifies the uncertainty inherent in that inference. The AI system infers the diagnosis by calculating probabilities.
Statistical models (B) are related to probabilistic models and use statistical methods to analyze data and make predictions. The AI system uses statistical methods to estimate the probabilities it uses. However, "probabilistic" better describes the fundamental output of the system, which is a probability distribution over possible diagnoses.
Deterministic models (D) produce the same output for a given input. They are not suitable for diagnostic systems because the same symptoms can have different causes due to individual variations. A deterministic model would not capture the inherent uncertainty.
The system's reliance on historical data to derive probabilities strongly suggests a probabilistic model. It learns patterns from data to predict the likelihood of different diagnoses given a patient's symptoms. Therefore, probabilistic (C) is a more accurate description of the model type used in this scenario than inference (A), which is a broader, more general process.
Why Probabilistic over Inference?
While inference is happening, the core characteristic is how that inference occurs. The AI is not just inferring; it is assigning probabilities to different inferences (diagnoses). A system could infer using deterministic rules (e.g., "if X then Y with 100% certainty"), but this system does not. It infers with probabilities.
Authoritative Links for further research:
Probabilistic Modeling: https://probml.github.io/pml-book/book1.html Bayesian Networks (a common form of Probabilistic Model): https://www.cs.princeton.edu/courses/archive/fall06/cos402/lectures/05_bayesnets.pdf



Which of the following AI uses is best described as human-centric?

  1. Pattern recognition algorithms are used to improve the accuracy of weather predictions, which benefits many industries and everyday life.
  2. Autonomous robots are used to move products within a warehouse, allowing human workers to reduce physical strain and alleviate monotony.
  3. Machine learning is used for demand forecasting and inventory management, ensuring that consumers can find products they want when they want them.
  4. Virtual assistants are used to adapt educational content and teaching methods to individuals, offering personalized recommendations based on ability and needs.

Answer(s): D

Explanation:

The correct answer, D, is most human-centric because it directly focuses on improving the individual's learning experience. Human-centric AI prioritizes human well-being, empowerment, and agency in its design and application. Option D specifically tailors education to individual abilities and needs, indicating a deliberate effort to personalize and optimize learning outcomes for each user. This direct impact on individual cognitive development and improved learning aligns strongly with human-centric principles.
Options A, B, and C, while potentially beneficial to humans, are primarily focused on efficiency gains in broader systems. Weather prediction (A) benefits many, but it's not targeted at individuals. Warehouse robots (B) alleviate physical strain, but the primary aim is likely increased operational efficiency rather than a deliberate focus on worker empowerment or well-being. Demand forecasting (C) focuses on consumer satisfaction through product availability, which is driven by market demand analysis, not necessarily individual user personalization or cognitive enhancement.
Therefore, D showcases AI being used to directly enhance the human learning process, making it the most appropriate example of human-centric AI among the options. The other options involve AI assisting human endeavors at a larger scale or focusing on efficiency. This emphasizes the crucial distinction: human-centric AI places the individual and their well-being at the center of the AI's purpose and design, going beyond simply providing a general benefit.
Human-centric AI is gaining recognition, and the European Commission's approach to AI explicitly emphasizes its importance. This approach involves promoting trustworthy AI that respects fundamental rights, promotes fairness, and benefits society as a whole. Options A, B, and C indirectly benefit society, but D directly aligns with human-centric goals by providing tailored educational resources, empowering individuals.
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-aihttps://www.ibm.com/blogs/research/human-centered-ai/



Which of the following is a foundational characteristic of effective AI governance?

  1. Engagement of a cross-functional team.
  2. Reliance on tested vendor management processes.
  3. Thorough reviews of a company’s public filings with experts.
  4. Uniform policies and procedures across developer, deployer and user roles.

Answer(s): A

Explanation:

Here's a detailed justification for why option A, "Engagement of a cross-functional team," is a foundational characteristic of effective AI governance:
Effective AI governance isn't a siloed activity. It requires input and oversight from various departments within an organization. AI systems impact and are impacted by legal, ethical, technical, business, and operational considerations. A cross-functional team ensures that all these perspectives are considered during the development, deployment, and monitoring of AI systems.
A legal team helps navigate regulatory compliance (e.g., GDPR, CCPA) regarding data privacy and fairness. The IT department handles technical infrastructure, data security, and model monitoring. Business stakeholders define the AI's purpose and evaluate its business impact. Ethics officers ensure alignment with ethical principles and societal values.
Without this diversity of viewpoints, risks can be overlooked, leading to legal violations, reputational damage, and biased outcomes. A robust governance framework mandates diverse representation.
While vendor management (B) and reviewing public filings (C) are important, they aren't foundational. Vendor management is a component but not the core of governing all AI, including internally developed systems. Public filings are retrospective analyses, not proactive governance. Uniform policies (D) are not always applicable; different roles necessitate different levels of access and responsibilities. Flexibility and role-specific guidelines are crucial for effective AI implementation and governance.
Therefore, only a cross-functional approach fosters a holistic and well-rounded AI governance framework, capable of addressing the complex challenges inherent in AI development and deployment. This collaborative approach ensures transparency, accountability, and responsible AI development, minimizing potential risks and maximizing benefits.
Supporting Link:
NIST AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework



CASE STUDY
Please use the following to answer the next question: A company is considering the procurement of an AI system designed to enhance the security of IT infrastructure. The AI system analyzes how users type on their laptops, including typing speed, rhythm and pressure, to create a unique user profile. This data is then used to authenticate users and ensure that only authorized personnel can access sensitive resources. All of the following are obligations of the company as a data controller when implementing its AI system EXCEPT?

  1. Ensuring that third-party processors are based in the same country as the company.
  2. Allowing data subject access requests (DSARs).
  3. Implementing technical and organizational measures.
  4. Conducting a Data Protection Impact Assessment (DPIA) / Privacy Impact Assessment (PIA).

Answer(s): A

Explanation:

The correct answer is A. Ensuring that third-party processors are based in the same country as the company. Here's why, along with why the other options are obligations:
Data protection laws, such as GDPR (though not explicitly mentioned in the scenario, GDPR-like principles apply generally to responsible AI governance), emphasize the data controller's (the company's) responsibility for the security and privacy of personal data processed by AI systems. These systems often collect and process significant amounts of personal data, making compliance essential.
Options B, C, and D are fundamental obligations under data protection regulations:
B: Allowing data subject access requests (DSARs): Individuals have the right to access their personal data held by an organization. The company is obligated to facilitate DSARs, enabling users to understand what data the AI system collects and how it is used. Reference: GDPR Article 15 - Right of Access
C: Implementing technical and organizational measures: Data controllers must implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. This involves securing the AI system and the data it processes and implementing policies and procedures to ensure data privacy compliance. Common examples include encryption, access controls, and data minimization techniques. Reference: GDPR Article 32 - Security of Processing
D: Conducting a Data Protection Impact Assessment (DPIA) / Privacy Impact Assessment (PIA): When processing personal data is likely to result in a high risk to individuals' rights and freedoms, a DPIA/PIA is required. Given the biometric nature of the typing data and its use for authentication (a potentially privacy-invasive application), a DPIA/PIA is highly likely to be necessary to evaluate and mitigate potential risks. Reference: GDPR Article 35 - Data Protection Impact Assessment
Option A, however, is not a strict requirement.
While data localization can be a factor in data protection compliance, particularly when dealing with sensitive data and specific national laws, it is not an absolute obligation for all processors. The key is ensuring that regardless of the processor's location, adequate safeguards are in place to protect the data, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), particularly for transfers outside of jurisdictions with equivalent data protection laws. The geographical location, in and of itself, does not automatically guarantee compliance or non-compliance. Compliance hinges on legally sound transfer mechanisms and demonstrable data protection measures, irrespective of where the processor is situated.



Viewing page 3 of 46
Viewing questions 11 - 15 out of 222 questions


Post your Comments and Discuss IAPP AIGP exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!