AIGP Practice Questions

The EU AI Act employs a risk-based approach, categorizing AI systems into different tiers. The use of AI for social scoring by public authorities is explicitly placed in the "unacceptable risk" category and is therefore prohibited under Article 5 of the Act. This prohibition is based on the potential for such systems to lead to detrimental, unjustified, or disproportionate treatment, which conflicts with fundamental EU rights and values. In contrast, the other applications listed—law enforcement, welfare distribution, and border control—are classified as "high-risk." High-risk systems are permissible but are subject to strict legal obligations regarding risk management, data governance, transparency, and human oversight before they can be placed on the market.

A. AI systems for certain law enforcement purposes are classified as high-risk under Annex III of the EU AI Act, making them permissible if they meet strict compliance requirements.

B. AI used to evaluate eligibility for public assistance benefits is explicitly defined as a high-risk application in Annex III, meaning its use is permitted under stringent regulation.

D. AI systems for migration, asylum, and border control management are also designated as high-risk applications in Annex III and are therefore permissible, not prohibited.

1. European Parliament. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008

(EU) No 167/2013

(EU) No 168/2013

(EU) 2018/858

(EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU

(EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union

L series

2024/1689.

Article 5(1)(c): Explicitly prohibits "AI systems for the evaluation or classification of natural persons or groups of natural persons over a certain period of time based on their social behaviour or known

inferred or predicted personal or personality characteristics

with the social score leading to... detrimental or unfavourable treatment".

Annex III

Point 5(b): Lists AI systems for evaluating eligibility for public assistance benefits as high-risk.

Annex III

Point 6: Lists various AI systems for law enforcement purposes as high-risk.

Annex III

Point 7: Lists AI systems used in migration

asylum

and border control management as high-risk.

2. Stanford Institute for Human-Centered Artificial Intelligence (HAI). (2023). The EU AI Act: A Primer. Stanford University.

Section: "The EU AI Act’s Risk-Based Approach

" Subsection: "Unacceptable Risk." This section explains that the Act bans a small number of AI systems deemed to pose an "unacceptable risk

" with social scoring by public authorities being a primary example of a prohibited practice.

The Canadian Artificial Intelligence and Data Act (AIDA), as proposed in Bill C-27, establishes a specific trigger for notifying the Minister of Innovation, Science and Industry. According to Section 15(1) of the Act, a person responsible for a high-impact system has a legal obligation to notify the Minister "as soon as feasible" if they have reasonable grounds to believe that the use of the system has resulted in, or is likely to result in, "material harm." This is a reactive, incident-based reporting requirement focused on significant negative outcomes, rather than a procedural notification tied to the system's lifecycle stages like deployment or assessment completion.

B. When the algorithmic impact assessment has been completed.

An assessment is a required internal due diligence process, but the Act does not mandate notifying the Minister upon its completion, though records must be kept.

C. Upon release of a new version of the system.

The Act does not specify a notification requirement for every new version; obligations regarding risk management and transparency apply continuously to the system in operation.

D. Upon initial deployment of the system.

The Act requires publishing a public description of the system (Section 10), not directly notifying the Minister upon initial deployment. The explicit notification trigger is harm.

1. Government of Canada

Bill C-27 (2022). An Act to enact the Consumer Privacy Protection Act

the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts. Part 3

Section 15(1). "A person who is responsible for a high-impact system must

as soon as feasible

notify the Minister if the use of the system results in or is likely to result in material harm." (https://www.parl.ca/DocumentViewer/en/44-1/bill/C-27/first-reading)

2. Innovation

Science and Economic Development Canada (ISED). The Artificial Intelligence and Data Act (AIDA) - Companion document. Section: "Accountability - Reporting on harms." "AIDA would require those responsible for a high-impact system to notify the Minister when they have reasonable grounds to believe that the use of the system has resulted in or is likely to result in material harm (clause 15)." (https://ised-isde.canada.ca/site/digital-charter-implementation-act/en/artificial-intelligence-and-data-act-aida-companion-document)

3. Scassa

T. (2022). Canada’s Proposed Artificial Intelligence and Data Act: A Reading. University of Ottawa

AI + Society Initiative. Page 10. "Section 15 contains a requirement to notify the Minister 'as soon as feasible' if the use of a high-impact system 'results in or is likely to result in material harm'." (https://www.aiss-siaa.ca/wp-content/uploads/2022/06/AIDA-Commentary-Scassa-June-20-2022.pdf)

AI bias refers to systematic errors that result in unfair or prejudicial outcomes, often against individuals or groups based on protected characteristics like gender or race. Options B, C, and D are clear examples of such bias. They involve underrepresentation of a minority group (B), harmful gender stereotyping through objectification (C), and gender stereotyping by focusing on aesthetics over function (D). In contrast, option A describes a marketing strategy choice: targeting businesses (B2B) rather than individual consumers (B2C). This decision is based on a business model, not on discriminatory attributes of a protected group, and therefore does not constitute a biased output in the context of AI fairness.

B. The content generated for minority construction workers is insufficient: This is a form of representational harm, where a system fails to adequately represent or serve a particular demographic group, which is a recognized type of AI bias.

C. The images of female workers are hyper-sexualized: This is a clear example of harmful gender stereotyping and objectification, where the AI system perpetuates and amplifies societal biases present in its training data.

D. The advertising text generated for female audiences focuses on color and style: This is a form of gender stereotyping, unfairly assuming different priorities for a product based on gender rather than its primary safety function.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Reference: Page 28

Appendix B

"Bias in AI." The document explains that bias can manifest as "underrepresentation or overrepresentation of particular groups" and the perpetuation of "unjust

inaccurate

or inappropriate" associations

which directly relates to the stereotyping and representational harms described in options B

C

and D. Option A

a strategic choice

does not fall into these categories of harmful bias.

2. Mehrabi

N.

Morstatter

F.

Saxena

N.

Lerman

K.

& Galstyan

A. (2021). A Survey on Bias and Fairness in Machine Learning. ACM Computing Surveys

54(6)

1-35.

Reference: Section 3

"Types of Bias." The paper categorizes various biases

including "Stereotype" and "Underrepresentation

" which are exemplified by options C

D

and B. The survey distinguishes these harmful biases from non-discriminatory system differentiations

such as the B2B marketing strategy in option A. (https://doi.org/10.1145/3457607)

3. Stanford University. (2023). CS224N: NLP with Deep Learning

Lecture on Fairness

Bias

and Ethics.

Reference: Course materials frequently discuss how language models can generate stereotypical associations (e.g.

associating women with appearance-related terms) and underrepresent certain groups. This academic context confirms that options B

C

and D are well-established examples of bias in AI

whereas option A is a strategic decision outside the scope of fairness evaluation.

Conformity requirements are a formal part of AI governance and regulation, designed to ensure an AI system complies with established legal, technical, and ethical standards before it is deployed. This process, often called a conformity assessment, is a critical step in risk management. Its primary purpose is to verify that the system meets mandatory obligations concerning safety, security, transparency, and the protection of fundamental rights. By satisfying these requirements, organizations demonstrate due diligence and ensure the system is trustworthy and safe for public use, thereby mitigating legal liability and potential harm.

A. Visual design is a user experience (UX) element, which is separate from the core legal and safety compliance addressed by conformity requirements.

B. Ease of use is a usability goal; while important, it is not the primary driver behind formal conformity assessments, which focus on safety and legal adherence.

C. Interoperability is a specific technical standard, but conformity requirements encompass a much broader set of legal, safety, and ethical mandates.

1. European Parliament. (2021). Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). COM(2021) 206 final.

Reference: Article 43 ("Conformity assessment") explicitly states that high-risk AI systems must undergo a conformity assessment procedure to ensure they meet the legal requirements set out in Title III

Chapter 2

which cover risk management

data quality

transparency

human oversight

and cybersecurity. This directly links conformity to legal compliance and safety.

2. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1.

Reference: Page 4

Section 2.1

"GOVERN." This function of the framework emphasizes that "Legal and regulatory requirements are understood and managed." The entire framework is designed to cultivate a culture of risk management to produce trustworthy and safe AI

which is verified through processes analogous to conformity assessments.

3. Floridi

L.

& Cowls

J. (2019). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review

1(1).

Reference: Section "From Principles to a Governance Framework." The authors discuss the need for "hard governance mechanisms

" including "standards and certification

" to ensure AI systems are beneficial and non-maleficent (safe). This academic perspective frames certification and conformity as essential for translating ethical principles into trustworthy

legally compliant systems. DOI: https://doi.org/10.1162/99608f92.8cd550d1

4. Stanford University Human-Centered Artificial Intelligence (HAI). (2021). AI Index Report 2021.

Reference: Chapter 5

"AI Ethics

Policy

and Governance." The report discusses the global rise in AI-related regulations and the importance of accountability mechanisms. It highlights the shift towards requiring demonstrable compliance with standards for safety and ethics before deployment

reinforcing the core purpose of conformity assessments.

The most likely reason for inquiring about dataset diversity is to assess the fairness of the AI system. In high-stakes applications like law enforcement, a lack of diversity in training data can lead to significant biases. If a dataset underrepresents certain demographic groups, the resulting model may perform less accurately and unfairly for those groups. Given that the AI system uses sensitive attributes like race and gender, evaluating the diversity of the training data is a critical step in due diligence to identify and mitigate the risk of discriminatory outcomes and ensure the system is fair and equitable across different populations.

A. To comply with applicable law.

While anti-discrimination laws exist, the primary technical reason for assessing data diversity is to ensure fairness, which is a prerequisite for legal compliance, not just a compliance check itself.

C. To evaluate the reliability of the Al system.

Reliability refers to consistent performance. A system can be consistently and reliably biased. Fairness is the more specific and appropriate concern addressed by examining dataset diversity.

D. To determine the explainability of the Al system.

Explainability concerns the ability to understand how a model reaches its conclusions. While data is an input, diversity specifically relates to fairness, not the transparency of the model's internal logic.

1. High-Level Expert Group on Artificial Intelligence. (2019). Ethics Guidelines for Trustworthy AI. European Commission.

Page 14

Section "Diversity

non-discrimination and fairness": The guidelines state

"To achieve this

it is crucial to ensure that the data sets used for training and testing AI systems... be as inclusive as possible

representing different subpopulations. Biases in data... should be addressed." This directly links dataset diversity to the principle of fairness.

2. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST Special Publication 1270).

Page 31

Section 4.4.2

MAP 2: This section discusses identifying risks related to "System and data quality." It notes that "unrepresentative or incomplete datasets" can be a source of risk

and that "Human biases are often mirrored in data and systems and can be amplified by AI systems

leading to harms." This highlights the connection between data representativeness (diversity) and mitigating harmful bias

a core component of fairness.

3. Maslej

N.

et al. (2023). The AI Index Report 2023: Measuring Trends in Artificial Intelligence. Stanford University Institute for Human-Centered Artificial Intelligence (HAI).

Chapter 4

Page 148: The report discusses the ongoing challenge of bias in AI systems

stating

"Since AI systems are trained on vast amounts of data

they often reflect the biases present in that data." This reinforces that examining the data's composition is fundamental to addressing bias and

by extension

fairness.

An impact assessment is the most effective proactive measure to mitigate discrimination prior to model training and testing. This process systematically identifies and analyzes potential risks, including fairness and bias, associated with the AI system's intended use, data sources, and operational context. By conducting this assessment early, the healthcare network can foresee how the system might disproportionately affect certain demographic groups, evaluate the representativeness of its training data, and design mitigation strategies before significant resources are invested in development. This aligns with the core principles of responsible AI development, which emphasize foresight and risk management from the project's inception.

A. Procure more data from clinical research partners: Simply acquiring more data does not inherently mitigate bias; if the new data shares the same demographic imbalances as the original data, it could amplify discrimination.

B. Engage a third party to perform an audit: Audits are typically performed on a system that has already been built or deployed to validate its performance and compliance, making it a reactive, not a proactive, measure.

D. Create a bias bounty program: This is a post-development activity where a model is exposed to testers to find biases. It is a useful tool for identifying issues in a trained model, not for prevention beforehand.

1. NIST. (2023). AI Risk Management Framework (AI RMF 1.0). National Institute of Standards and Technology.

Reference: The "MAP" function of the framework (Section 3.3

Page 18) emphasizes understanding the context and mapping risks before an AI system is designed or deployed. It states

"MAP is intended to be applied at the outset of the AI lifecycle... to frame risks in relation to an AI system’s context." This includes identifying risks of harmful bias and discrimination

which is the core purpose of an impact assessment in this scenario.

2. Reisman

D.

Schultz

J.

Crawford

K.

& Whittaker

M. (2018). Algorithmic Impact Assessments: A Practical Framework for Public Agency Accountability. AI Now Institute.

Reference: Page 6 of this foundational report states

"An AIA is a tool for assessing the potential impacts of an algorithmic system before it is deployed... It provides a repeatable

structured process to assess the potential societal impacts of an automated system and to determine whether mitigation strategies are required." This directly supports performing an assessment prior to development to mitigate harm.

3. Selbst

A. D.

boyd

d.

Crawford

K.

& Whittaker

M. (2019). Fairness and Abstraction in Sociotechnical Systems. Proceedings of the 2019 ACM Conference on Fairness

Accountability

and Transparency

59–68.

Reference: Section 3

"Problem Formulation

" argues that critical decisions impacting fairness are made at the very beginning of a project. The paper notes

"The act of problem formulation itself—the translation of a real-world problem into the formal

constrained language of a technical system—is a locus of normative decision-making." An impact assessment forces the team to confront these decisions and their potential discriminatory consequences at the earliest stage.

DOI: https://doi.org/10.1145/3287560.3287598

Training data is the foundational dataset used in supervised and semi-supervised machine learning. Its primary purpose is to be fed into a learning algorithm, which iteratively adjusts the model's internal parameters (e.g., weights and biases) to minimize error. Through this process, the model "learns" the underlying patterns, features, and relationships within the data, enabling it to make predictions or classifications on new, unseen data. This learning process is the core function of the training phase.

B. Fine-tune a model to improve accuracy and prevent overfitting.

This describes the function of a validation dataset, which is used to tune hyperparameters and assess model performance during training to avoid overfitting the training data.

C. Detect the initial sources of biases to mitigate prior to deployment.

While analyzing training data is a critical step for bias detection, the data's primary purpose is to train the model, not to serve as a bias detection tool itself.

D. Resemble the structure and statistical properties of production data.

This describes a crucial quality or characteristic of effective training data, known as representativeness. It is not the definition of the data's function or purpose.

1. Google Developers. Machine Learning Crash Course: Data Splitting. "The training set—a subset to train a model. You use the training set to train your model; that is

to adjust the model's parameters." This source directly confirms that the purpose of the training set is to enable the model's learning process.

2. National Institute of Standards and Technology (NIST). AI Risk Management Framework (AI RMF 1.0)

January 2023. In Appendix B: Glossary

"Training data" is defined as "The data used to train an AI model." The framework's core text elaborates that this process involves the model learning patterns and correlations from this data (e.g.

Section 4.3.2 on Data).

3. Ng

A. CS229 Machine Learning Course Notes

Stanford University. Part I: Supervised Learning. The notes define the training set as the data (x(i)

y(i)) used by a learning algorithm to find the parameters θ that best fit the data

which is the mathematical formalization of learning patterns.

4. Massachusetts Institute of Technology (MIT) OpenCourseWare. 6.036 Introduction to Machine Learning

Fall 2020. Lecture 1: Introduction. The lecture materials introduce the concept of a training set as the collection of examples from which the learning machine (model) extracts a general rule or pattern.

The AI system processes keystroke dynamics (speed, rhythm, pressure), which constitutes personal and likely sensitive biometric data. According to foundational data protection and AI governance principles, the first and most critical step before implementing any new data processing activity is to establish its legal and ethical basis. This involves defining a specific, explicit, and legitimate purpose for the processing and identifying a lawful basis for it. This "purpose limitation" and "lawfulness" principle is the cornerstone of the organization's governance and compliance obligations, and all other policy updates, such as security controls or data sharing rules, are subsequent to and dependent on this initial determination.

A. The case study does not mention sharing data with third parties, so while important, it is not the primary or initial policy concern based on the scenario.

B. Updating security controls is a critical implementation step, but it follows the foundational policy decision of why and how the data can be lawfully processed in the first place.

D. While policy clarity is a best practice for transparency, the substantive legal and ethical foundation (the purpose) must be established before focusing on the document's readability.

1. NIST AI Risk Management Framework (AI RMF 1.0)

January 2023. The GOVERN function (p. 16) emphasizes that governance is foundational and includes "processes to guide and monitor an organization's approach to mapping

measuring

and managing AI risk and ensuring compliance with legal and regulatory requirements." Establishing the purpose is a core part of this governance.

2. OECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)

2019. Principle 1.2

"Human-centred values and fairness

" states that AI actors should respect "the rule of law

human rights and democratic values." This begins with ensuring any data processing

especially of personal data

is lawful and serves a legitimate purpose.

3. General Data Protection Regulation (GDPR)

Regulation (EU) 2016/679. Article 5(1)(a) and (b) establish the core principles of "lawfulness

fairness and transparency" and "purpose limitation

" requiring that personal data be "collected for specified

explicit and legitimate purposes." These principles are globally influential in data governance.

4. Stanford University Human-Centered Artificial Intelligence (HAI)

"AI Governance: A Research & Development Agenda

" 2023. Section 3

"Technical and Social Systems for AI Governance

" discusses the necessity of building legally compliant systems

which fundamentally relies on pre-defined and lawful purposes for data processing as the basis for system design and policy. (Available at: https://hai.stanford.edu/research/ai-governance-research-development-agenda)

The Acceptable Use Policy (AUP) is the most important policy for assessing the operational implications of a third-party AI model. The AUP explicitly outlines the vendor's rules regarding the intended and prohibited uses of their service. For a governance team, this document is paramount as it defines the contractual and ethical boundaries within which the AI model can be operated. It directly addresses questions of how the model can be integrated into workflows, what tasks it can perform, and what constitutes misuse, which are central to evaluating operational and ethical risks before deployment.

B. The privacy policy focuses on how the provider handles personal data, not the functional or operational rules for using the AI model.

C. The security policy describes measures to protect the system from threats, which is a technical risk assessment, not a guide to its proper operational use.

D. The code of conduct policy governs the behavior of the vendor's employees, not the operational use of the AI product by a customer.

1. NIST. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). U.S. Department of Commerce

National Institute of Standards and Technology. In the Govern function

subcategory GOVERN.P5 (p. 20) states that for procurement

organizations should understand the "AI system’s intended uses and capabilities." The AUP is the primary policy document that formally defines these intended uses and restrictions for a third-party product.

2. Floridi

L.

& Cowls

J. (2019). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review

1(1). https://doi.org/10.1162/99608f92.8cd550d1. The principle of "Beneficence" (promoting well-being) and "Non-maleficence" (preventing harm) requires a clear understanding of an AI system's intended application domain and limitations. An AUP is the operational tool that codifies these principles by defining acceptable and unacceptable uses.

3. Stanford University. (2023). CS 182: Ethics

Public Policy

and Technological Change Course Syllabus. Course materials frequently discuss how Terms of Service and Acceptable Use Policies serve as the primary governance instruments that define the scope of permissible actions for users of a technology platform

thereby setting the operational rules.

The 1956 Dartmouth Summer Research Project on Artificial Intelligence is universally recognized as the seminal event that established AI as a formal academic discipline. Organized by John McCarthy, Marvin Minsky, Nathaniel Rochester, and Claude Shannon, the workshop brought together the founding figures of the field. It was during the proposal for this event that McCarthy coined the term "artificial intelligence." The workshop's primary purpose and its most significant legacy was to define the scope, vision, and core problems of this new field of research, effectively marking its official birth.

A. The workshop's focus was on the theoretical possibility of creating intelligent machines, not the impact of existing computers.

B. This is too broad; the project had a specific goal of simulating intelligence, not studying the general societal impact of technology.

C. The concept of a test for machine intelligence (the "Turing Test") was proposed by Alan Turing in 1950, predating this project.

1. Moor

J. (2006). The Dartmouth College Artificial Intelligence Conference: The Next Fifty Years. AI Magazine

27(4)

87-91. In the introduction

Moor states

"The 1956 Dartmouth AI Conference was the founding event for Artificial Intelligence as a field." (p. 87).

2. McCarthy

J.

Minsky

M. L.

Rochester

N.

& Shannon

C. E. (1955

August 31). A Proposal for the Dartmouth Summer Research Project on Artificial Intelligence. This primary source document laid out the foundational conjecture for the field: "that every aspect of learning or any other feature of intelligence can in principle be so precisely described that a machine can be made to simulate it." This proposal effectively served as the founding charter for the field of AI.

3. Russell

S. J.

& Norvig

P. (2021). Artificial Intelligence: A Modern Approach (4th ed.). Pearson. In Chapter 1

Section 1.3

"The History of Artificial Intelligence

" the authors explicitly refer to the Dartmouth workshop as "the birth of artificial intelligence

" where the name was coined and the field's key figures gathered to define its agenda.