IAPP AIGP Certification Sample Questions

01. Cost and latency constraints mean a team must choose a smaller, faster model than the one it evaluated. The use case is unchanged. What does governance most need to see before this substitution is accepted?
a) A comparison of the two models' published benchmark scores, showing how far apart they sit on standard evaluations
b) Evidence that the substitute model still meets every one of the requirements that were set for this particular use case
c) An updated model card describing the substitute model, its provenance and the limitations its supplier has disclosed
d) Confirmation that the cost saving is material enough to justify the additional evaluation work the change will require

02. Staff were trained on a decision-support tool at launch. The model has since been updated twice and now behaves differently in several common situations. No further training has been given. What is the most significant risk?
a) Staff are still applying an understanding of the system that no longer matches the way that it now behaves
b) The updates were released without assessing their effect on the people who use the system day to day
c) Staff will lose confidence in the system as they encounter behavior that differs from what they were taught
d) The organization cannot demonstrate that its staff were competent to operate the system at the time of use

03. An organization must be able to answer, months later, why an AI system reached a particular decision about a particular person. What must be in place while the system is running?
a) An explainability capability able to generate an account of any decision the system has produced on request
b) Retention of the inputs, the output and the model version that was in force for each individual decision
c) A documented description of the model's logic, maintained in the technical documentation and kept current
d) A log of the human reviews carried out on decisions the system produced during the period in question

04. Following an AI incident, the delivery team's review concludes the cause was a data quality problem upstream. The governance lead convenes a wider group including operations, the business owner and the team that supplies the data.
What does the wider review add?
a) A record of the incident that satisfies the organization's documentation requirements for AI incidents
b) Independent verification of the delivery team's conclusion that data quality was the underlying cause
c) The wider conditions outside the model itself that allowed the problem to arise and then to go unnoticed
d) Agreement on which team is accountable for preventing a recurrence of this particular class of failure

05. A vendor agreement contains a broad indemnity under which the vendor will cover losses arising from its model. The organization's board concludes that its exposure is therefore addressed. Why is that conclusion unsafe?
a) An indemnity allocates money after the event and does not move the organization's own regulatory duties or reputational exposure
b) The indemnity may not survive termination of the agreement, leaving losses discovered later outside its scope
c) Indemnities are typically capped at the value of the contract, so large losses may exceed what the vendor will pay
d) The vendor may dispute whether a given loss arose from its model rather than from the organization's integration

06. Monitoring shows a model's performance has declined steadily over four months. It remains inside the threshold at which the documented escalation procedure would be triggered. What should the monitoring arrangement do with this observation?
a) Retrain the model at once, since the decline indicates the training data no longer represents live conditions
b) Record the readings and take no action, since the documented threshold has not yet been crossed
c) Treat the sustained direction of travel as a signal in itself and review before the threshold is reached
d) Lower the escalation threshold so that the current level of performance triggers the procedure immediately

07. An organization maintains a thorough record of AI incidents. Its governance committee asks what else post-deployment records should capture. What is the most important addition?
a) The changes made to the model and the approvals obtained for each one before it was released
b) Risks and issues that have been identified but have not yet been realized as incidents affecting any person
c) The decisions made by each individual reviewer who exercised oversight over the system's outputs
d) The performance metrics the system reports, recorded at each monitoring interval across its operating life

08. Due diligence establishes that a vendor's governance practices are sound. The vendor's model, however, is itself built on a foundation model licensed from another company, about which the vendor discloses little. What does this reveal?
a) The organization should require the vendor to replace the licensed foundation model with one it has developed itself
b) The vendor is acting as a deployer rather than a developer, which changes the obligations it carries under AI-specific law
c) The vendor's own governance practices should be re-examined, since its disclosure has proved to be incomplete
d) Diligence stopped at the first tier of a supply chain that in fact extends considerably further than the vendor

09. A deployed assistant reads customer-supplied documents and then acts on them. Testing finds that text placed inside a document can cause the assistant to disregard its own operating instructions. Which governance response addresses the underlying exposure?
a) Retrain the assistant on examples of documents containing embedded instructions so it learns to ignore them
b) Treat content the system reads as untrusted input, and constrain what it is permitted to do in response
c) Require a member of staff to read each customer document before the assistant is allowed to process it
d) Add the observed phrasings to a blocklist so that documents containing them are rejected before processing

10. An organization runs annual internal audits of its deployed AI systems. Its governance committee asks whether that is sufficient for a system making consequential decisions about individuals. What most strengthens the assurance?
a) Expanding the audit scope to cover the system's training data as well as its operational performance
b) Increasing the frequency of the internal audits from annually to a quarterly cycle for the highest-risk systems
c) Assessment carried out by a party that is wholly independent of the team that built the system and runs it
d) Requiring the audit findings to be reported directly to the governance committee rather than to the delivery team