Free IAPP AIGP Practice Exam with Questions & Answers

Developing an AI model internally creates a direct need for technical expertise covering model development, infrastructure, deployment, monitoring, retraining, security, testing, and maintenance. This makes A the strongest distinguishing issue. Third-party AI services can reduce this operational burden because the external provider supplies much of the model and underlying infrastructure; IAPP guidance specifically notes that third-party APIs can accelerate deployment and reduce the burden of managing complex infrastructure. B is incorrect because an internally developed model generally provides more , not less, technical control. C is not necessarily true because total costs depend on scale, licensing, infrastructure, and usage. D is also too absolute: although developing a system can create substantial provider obligations, responsibility under AI laws and governance frameworks may still be distributed among providers, deployers, vendors, processors, and other actors depending on the circumstances.

================

The correct answers are A, C, and E because they reflect the shared but distinct responsibilities between AI developers and deployers in governance frameworks. Developers are responsible for designing systems that minimize bias and ensuring fairness during development. They are also required to provide clear documentation, including instructions for use, system capabilities, and limitations, to support transparency and proper operation. Deployers, on the other hand, are responsible for overseeing the system once it is in use, including continuous monitoring, auditing, and ensuring it performs as intended in real-world conditions. Option B is incorrect because liability is typically shared and depends on roles and context, not solely on developers. Option D is incorrect because independent bias assessments are not always strictly required of deployers before release.

The EU AI Act explicitly prohibits the use of AI systems for social scoring by public authorities, as it can lead to discrimination and unfair treatment of individuals based on their social behavior or perceived trustworthiness. While AI can be used to promote equitable distribution of welfare benefits, manage border control, and even detect an individual ' s intent for law enforcement purposes (within strict regulatory and ethical boundaries), implementing social scoring systems is not permissible under the Act due to the significant risks to fundamental rights and freedoms.

The correct answer is A because the first step in any AI project lifecycle is to clearly define the business objective and justify the use of AI. AI governance frameworks emphasize that planning begins with understanding the purpose, value, and necessity of the system before moving into design or risk assessment stages. Establishing a business case ensures alignment with organizational goals, identifies expected benefits, and evaluates whether AI is the appropriate solution. This step corresponds to the planning phase of the AI lifecycle, where objectives and intended outcomes are documented. In contrast, TEVV processes occur during development and testing, while impact assessments and redress consid erations arise later as part of risk management and governance. Starting with a clear “why AI” foundation ensures responsible, efficient, and goal-oriented system development.

Risk impact estimation occurs in the design phase of the AI life cycle. This step involves evaluatingpotential risks associated with the AI system and estimating their impacts to ensure that appropriate mitigation strategies are in place. It helps in identifying and addressing potential issues early in the design process, ensuring the development of a robust and reliable AI system. Reference: AIGP Body of Knowledge on AI Design and Risk Management.

During the first month of monitoring the model for bias, it is most important to continue disparity testing. Disparity testing involves regularly evaluating the model ' s decisions to identify and address any biases, ensuring that the model operates fairly across different demographic groups.

The greatest risk from AI systems generatingrealistic synthetic mediaisdownstream harm, such asdeepfakes, misinformation, reputational damage, and erosion of trust.

From theAI Governance in Practice Report 2025:

“With generative AI, downstream harms such as deception, reputational damage, misinformation, and manipulation can emerge even if original use was lawful.” (p. 55–56)

The failures in semi-autonomous vehicles due to sensors misinterpreting environmental surroundings, such as sunlight, are examples of brittleness. Brittleness in AI systems refers to their inability to handle variations in input data or unexpected conditions, leading to failures when the system encounters situations that were not adequately covered during training. These systems perform well under specific conditions but fail when those conditions change. Reference: AIGP Body of Knowledge on AI System Robustness and Failures.

D is the exception because the EU AI Act distinguishes obligations imposed on providers from those imposed on deployers. Under Article 16, providers of high-risk AI systems must maintain required documentation and automatically generated logs under their control. Article 17 requires providers to establish a documented quality management system, which includes setting up, implementing, and maintaining a post-market monitoring system. These provisions support A, B, and C. By contrast, Article 26 requires deployers to take appropriate organizational and technical measures to use high-risk systems according to the provider ' s instructions and to assign human oversight to suitably competent, trained, and authorized natural persons. Providers must design high-risk systems so effective human oversight is possible, but actually ensuring oversight during operational use in accordance with instructions is principally a deployer obligation.

================

Data minimization requires organizations to collect and process only personal information that is adequate, relevant, and necessary for the specified purpose. A basic to-do application may reasonably require limited account or contact information, but political opinions and trade-union affiliations have no apparent necessity for compiling, researching, or prioritizing tasks. Those attributes are also treated as particularly sensitive under European data-protection law. Privacy by design requires privacy safeguards and data-protection principles to be incorporated into the product from the design stage and reflected in default settings. Therefore, unnecessary collection at installation directly implicates both minimization and privacy by design. Purpose limitation may also become relevant, but explicit consent does not by itself cure unjustified overcollection. Transparency, portability, and access rights address different privacy obligations and do not best characterize the defect described here.

================