Free IAPP AIGP Practice Exam with Questions & Answers | Set: 5

Under theEU AI Act, serious incidents involvinghigh-risk AI systemsmust be reported. The deployer is required topromptly inform the provider and relevant authoritiesabout the issue.

From theAI Governance in Practice Report 2025:

“Serious incidents involving high-risk systems… must be reported to the provider and relevant market surveillance authority.” (p. 35)

“Timely reporting is required when AI systems result in or may result in violations of fundamental rights.” (p. 35)

A, B, and E are the intended privacy-preserving choices. Data minimization limits processing to information that is adequate, relevant, and necessary for the defined purpose, reducing privacy exposure during AI development. Anonymization protects individuals by transforming information so that people are no longer identifiable under the applicable standard. Federated learning is a recognized privacy-enhancing technology that enables models to be trained across distributed datasets without centrally sharing the underlying raw training data. The ICO specifically identifies federated learning and related privacy-preserving methods as useful during AI training and explains the relationship between anonymization and data minimization. Data mapping is primarily a governance and inventory activity used to understand data flows, while data cleansing principally improves data quality by correcting or removing inaccurate, incomplete, or unsuitable records; neither is inherently a PET.

Random forest algorithms are classified as discriminative models. Discriminative models are used to classify data by learning the boundaries between classes, which is the core functionality of random forest algorithms. They are used for classification and regression tasks by aggregating the results of multiple decision trees to make accurate predictions.

The best reason for GVC to offer students the choice to utilize generative AI in limited, defined circumstances is to enable students to learn how to use AI as a supportive educational tool. By integrating AI in a controlled manner, students can learn the practical applications of AI and develop skills to use AI responsibly and effectively in their educational pursuits.

The EU AI Act categorizes certain applications of AI as high-risk due to their potential impact on fundamental rights and safety. High-risk applications include those used in critical areas such as employment, education, and essential public services. A government-run social scoring tool, which assesses individuals based on their social behavior or perceived trustworthiness, falls under this category because of its profound implications for privacy, fairness, and individual rights. This contrasts with other AI applications like resume scanning tools or customer service chatbots, which are generally not classified as high-risk under the EU AI Act.

Providing the loan applicants with information about the model capabilities and limitations would not directly support fairness testing by the compliance team. Fairness testing focuses on evaluating the model ' s decisions for biases and ensuring equitable treatment across different demographic groups, rather than informing applicants about the model.

The deployer is primarily responsible for operational oversight once an AI system has been placed into use within its organization. This includes monitoring performance, identifying drift or unexpected behavior, following the provider ' s instructions, escalating incidents, and ensuring that the system continues to operate within approved risk tolerances. Under Article 26 of the EU AI Act, deployers of high-risk AI systems are specifically required to monitor system operation based on the instructions for use and to inform the provider and relevant authorities when serious risks or incidents arise. Developers and providers remain responsible for important lifecycle activities such as design, documentation, updates, and technical support, but ongoing monitoring in the actual deployment environment rests principally with the deployer. A regulator provides external oversight, while an ordinary user does not carry organizational lifecycle responsibility.

================

The EU AI Act outlines what must be included intechnical documentationfor high-risk systems. These requirements are designed to supportconformity assessment, transparency, and traceability.

From theAI Governance in Practice Report 2025:

“It mandates drawing up technical documentation… must include a general description of the AI system, the intended purpose, and a detailed description of the elements and development process.” (p. 34)

“Documentation… includes training, testing, evaluation procedures, andappropriateness of performance metrics.” (p. 34–35)

Therisk management systemis addressed separately through arisk management plan, not within the technical documentation itself.

Thus:

A, C, and Dare explicitly required in thetechnical documentation.

B, while important, is part of therisk management process, not a required section oftechnical documentation.

Retraining the model with data that reflects demographic parity is the best strategy to mitigate the bias uncovered in the loan applications. This approach addresses the root cause of the bias by ensuring that the training data is representative and balanced, leading to more equitable decision-making by the AI model.

The correct answer isD. GPS location data isnot biometric data—it is consideredgeolocation data, which is personal data butnot biometricunder most U.S. laws.

From the AIGP ILT Guide (Data Privacy Module):

“Biometric data includes measurable biological or behavioral characteristics such as iris scans, facial recognition, voice prints, and keystroke patterns when used for identification.”

AI Governance in Practice Report 2025 (Privacy and Data Protection section):

“Location data, while sensitive, is not considered biometric unless it’s tied to a uniquely identifyingbiological trait.”

Thus,GPS location data, while potentially sensitive, is not classified as biometric.