Pass the IAPP Artificial Intelligence Governance AIGP Questions and answers with CertsForce

The correct answer is D because AI impact assessments primarily focus on risks to individuals, society, and legal compliance, such as privacy, fairness, and potential harm. Core elements typically include evaluating the impact on privacy rights, identifying data sources and their lawfulness, and assessing potential bias or discriminatory outcomes. These factors are directly tied to regulatory expectations and ethical AI governance principles. While environmental considerations like energy consumption are increasingly discussed in broader AI sustainability conversations, they are not standard or required components of most AI impact assessments, especially for narrow use cases. AI governance frameworks prioritize human-centric risks, ensuring systems are lawful, fair, and safe, rather than focusing on operational metrics like energy usage in typical assessment processes.

The correct answer is C, the Federal Trade Commission. The FTC plays a central role in U.S. AI governance by enforcing consumer protection and unfair or deceptive practices laws. In the context of AI systems such as companion chatbots, the FTC has authority to investigate risks related to user harm, transparency, safety, and misleading claims. AI governance frameworks emphasize regulatory oversight where AI systems may impact individuals psychologically, financially, or socially. Agencies like the FTC focus on ensuring that companies deploying AI systems do not cause harm through unsafe or de ceptive practices and that they provide adequate disclosures about risks and system behavior. This aligns with broader AI governance principles of accountability, transparency, and risk management highlighted in the AI Governance in Practice Report 2024 , which stresses the importance of regulatory involvement in managing AI-related risks.

Under the EU regulations, particularly the GDPR, banks using AI for decision-making must inform users about the use of AI and provide mechanisms for users to contest decisions. This is part of ensuring transparency and accountability in automated processing. Explicit consent under the privacy directive (A) and disclosing under the Digital Services Act (B) are not specifically required in this context. An adequacy decision is related to data transfers outside the EU (C).

A, D, and E introduce processing materially different from the practices described in the existing privacy policy. Storing chatbot inputs for RAG creates an additional retention and reuse purpose that should be addressed through appropriate privacy disclosures and retention controls. Using customer-session information to retrain the underlying model creates a distinct secondary purpose beyond processing an order, even when the data is subsequently deleted. Scanning a customer ' s appearance to infer frustration or confusion introduces an entirely new category of observation and inference, requiring additional transparency, legal-basis analysis, proportionality assessment, and safeguards. By contrast, B involves transferring customer information to a service provider so the requested service can operate, which the existing policy already permits. C involves ordinary contact and delivery information retained through completion of the transaction, which also fits the stated policy.

Bias in AI can be reduced during the planning and design phases through stakeholder involvement, human oversight, and careful data collection. While feature selection is critical in the development phase, it does not specifically occur during planning and design. Ensuring diverse stakeholder involvement and human oversight helps identify and mitigate potential biases early, and data collection ensures a representative dataset. Reference: AIGP Body of Knowledge on AI Development Lifecycle and Bias Mitigation.

Data aggregators are third parties that collect and license data from various sources. They are responsible for ensuring thelawful collectionandproper usage rightsof the data they distribute — especially when such data is used to train foundational AI models.

From theAI Governance in Practice Report 2025:

“As organizations have neither proximity to how third-party data was first collected nor direct control over the data governance practices of third parties, an organization can benefit from carrying out its own legal due diligence and third-party risk management.” (p. 19)

“Legal due diligence may include verification of the personal data ' s lawful collection by the databroker...” (p. 19)

This confirms thatdata aggregatorsbear the legal and ethical burden to verify that data has been lawfully collected and is appropriately licensed for use, including in AI training.

A. The marketing agencyandD. its clientmay use data, but they rely on upstream providers for its lawful origin.

B. The tech companymay train the model but depends on lawful sourcing by data aggregators.

The correct answer is D because Privacy Impact Assessments are already structured processes designed to identify risks related to data use, processing, and potential harm to individuals. These assessments can be readily adapted to evaluate AI-specific risks, such as bias, automated decision-making impacts, and data protection concerns. AI governance frameworks emphasize leveraging existing compliance mechanisms to efficiently integrate AI risk management without duplicating processes. Privacy impact assessments align closely with AI risk evaluation because they examine how personal data is collected, used, and protected throughout the system lifecycle. Other options, such as penetration testing or training, focus on narrower objectives like security or awareness and are not comprehensive tools for identifying broader AI risks. Adapting PIAs supports a risk-based, scalable, and governance-aligned approach to managing AI systems.

The greatest risk from AI systems generatingrealistic synthetic mediaisdownstream harm, such asdeepfakes, misinformation, reputational damage, and erosion of trust.

From theAI Governance in Practice Report 2025:

“With generative AI, downstream harms such as deception, reputational damage, misinformation, and manipulation can emerge even if original use was lawful.” (p. 55–56)

ISO/IEC 42001:2023 establishes an Artificial Intelligence Management System designed to integrate AI governance into an organization ' s existing management structure rather than create an isolated governance regime. Its AI-policy requirements state that the policy should refer, where relevant, to other organizational policies. Therefore, A most accurately describes the relationship. The standard does not require the organization to absorb all related security, privacy, quality, risk, or compliance policies into one AI policy, making B incorrect. C is inconsistent with integrated governance because AI issues commonly intersect with information security, privacy, procurement, data governance, human resources, and enterprise risk management. Management review is an important management-system activity, but D does not state the relationship required between the AI policy and existing policies. ISO/IEC 42001 consequently favors coordinated and mutually aligned organizational governance.

================

The correct answer isD. AI Impact Assessments are primarily used to identify and managerisks and harmsassociated with AI systems.

From the AIGP Body of Knowledge:

“The goal of an AI impact assessment is to ensure that risks are identified, evaluated, and mitigated prior to or during development and deployment.”

As further confirmed in the AI Governance in Practice Report 2025 (Part III):

“Risk-based tools like DPIAs and Algorithmic Impact Assessments help identify potential risks to individuals and society, enabling organizations to implement mitigation plans and safeguards.”

While benefits may be noted in such assessments, thecore objectiveis to manage risks andpromote responsible AI.

===========