The Artificial Intelligence Governance Professional (AIGP)

Training underwriters on the model prior to deployment is crucial so they can apply their own judgment to the initial assessment. While AI models can streamline the process, human judgment is still essential to catch nuances that the model might miss or to account for any biases or errors in the model ' s decision-making process.

A, B, and E are the intended privacy-preserving choices. Data minimization limits processing to information that is adequate, relevant, and necessary for the defined purpose, reducing privacy exposure during AI development. Anonymization protects individuals by transforming information so that people are no longer identifiable under the applicable standard. Federated learning is a recognized privacy-enhancing technology that enables models to be trained across distributed datasets without centrally sharing the underlying raw training data. The ICO specifically identifies federated learning and related privacy-preserving methods as useful during AI training and explains the relationship between anonymization and data minimization. Data mapping is primarily a governance and inventory activity used to understand data flows, while data cleansing principally improves data quality by correcting or removing inaccurate, incomplete, or unsuitable records; neither is inherently a PET.

The common types of machine learning include supervised learning, unsupervised learning, reinforcement learning, and deep learning. Cognitive learning is not a type of machine learning; rather, it is a term often associated with the broader field of cognitive science and psychology. Reference: AIGP BODY OF KNOWLEDGE and standard AI/ML literature.

While transparency is encouraged,publicly disclosing forecasts of secondary harmsisnot a required or standard practicefor internal performance evaluation. Risk assessments and reporting typically remaininternal or shared with regulators.

From theAI Governance in Practice Report 2025:

“Organizations must assess secondary risks… but disclosure is subject to context, regulatory requirements, and risk management discretion.” (p. 30)

The correct answer is C because simply publishing a general AI policy or code of conduct does not satisfy specific transparency obligations required by AI regulations. Transparency requirements focus on providing clear, context-specific disclosures to affected individuals about how AI is being used, particularly when it directly impacts them. For example, notifying users when they are interacting with an AI system or labeling AI-generated content are explicit transparency measures aligned with regulatory expectations. The AI Governance in Practice Report highlights that transparency includes informing users when they interact with AI systems and providing meaningful information about outputs and system behavior . Model cards and labels support system-level and output-level transparency, while real-time notices ensure user awareness. In contrast, a general policy link lacks immediacy, specificity, and user relevance, making it insufficient for mandatory transparency compliance.

Respecting intellectual property rights means adhering to licensing terms and ensuring that generated content complies with these terms. A system that categorizes and applies filters based on licensing terms ensures that content is used legally and ethically, respecting the rights of content creators. While providing attribution is important, categorization and application of filters based on licensing terms are more directly tied to compliance with intellectual property laws. This principle is elaborated in the IAPP AIGP Body of Knowledge sections on intellectual property and compliance.

Before offering an AI solution in the EU market, a Canadian company must take several steps to comply with the EU AI Act. These steps include establishing a risk and quality management system (B), engaging a third-party auditor to perform a bias audit (C), and drawing up technical documentation and instructions for use (D). However, there is no requirement to register the AI solution in a public EU database (A). This registration step is not specified as part of the compliance requirements under the EU AI Act for such solutions​​​​.

The correct answer is D because conformity requirements are primarily intended to ensure that AI systems meet applicable legal, regulatory, and safety standards before deployment. AI governance frameworks, including the EU AI Act and international standards, require conformity assessments to verify that systems are safe, reliable, and compliant with risk management, documentation, and performance obligations. These assessments help identify and mitigate risks prior to market release, particularly for high-risk AI systems that may impact individuals’ rights, health, or safety. Conformity ensures accountability, transparency, and trustworthiness, which are central principles of responsible AI governance. The other options relate to usability or technical considerations, but they do not address the primary purpose of conformity assessments, which is regulatory compliance and risk mitigation prior to deployment.

In the United States, the use of AI hiring tools must comply with anti-discrimination laws, accessibility laws, and privacy laws to avoid increasing liability. Anti-discrimination laws (A) ensure that hiring practices do not unlawfully discriminate against protected classes. Accessibility laws (C) require that hiring tools are accessible to all applicants, including those with disabilities. Privacy laws (D) govern the handling of personal data during the hiring process. Product liability laws (B), however, typically apply to the safety and reliability of physical products and would not generally increase liability specifically related to the responsible use of AI hiring tools in the employment context​​​​.