IAPP AIGP - Artificial Intelligence Governance Professional

Ensuringoversight and auditabilityrequires that the organization hassufficient access to data, documentation, and model internalsor outputs necessary for evaluation.

From theAI Governance in Practice Report 2025:

“Access to technical documentation and system internals is essential to enable effective auditing, conformity checks, and accountability mechanisms.” (p. 11, 34)

Ais about liability, not auditability.

Bmatters for IP rights, not oversight.

Crelates to lifecycle responsibility but doesn’t guarantee audit access.

Respecting intellectual property rights means adhering to licensing terms and ensuring that generated content complies with these terms. A system that categorizes and applies filters based on licensing terms ensures that content is used legally and ethically, respecting the rights of content creators. While providing attribution is important, categorization and application of filters based on licensing terms are more directly tied to compliance with intellectual property laws. This principle is elaborated in the IAPP AIGP Body of Knowledge sections on intellectual property and compliance.

ISO/IEC 42001:2023 establishes an Artificial Intelligence Management System designed to integrate AI governance into an organization ' s existing management structure rather than create an isolated governance regime. Its AI-policy requirements state that the policy should refer, where relevant, to other organizational policies. Therefore, A most accurately describes the relationship. The standard does not require the organization to absorb all related security, privacy, quality, risk, or compliance policies into one AI policy, making B incorrect. C is inconsistent with integrated governance because AI issues commonly intersect with information security, privacy, procurement, data governance, human resources, and enterprise risk management. Management review is an important management-system activity, but D does not state the relationship required between the AI policy and existing policies. ISO/IEC 42001 consequently favors coordinated and mutually aligned organizational governance.

================

Before offering an AI solution in the EU market, a Canadian company must take several steps to comply with the EU AI Act. These steps include establishing a risk and quality management system (B), engaging a third-party auditor to perform a bias audit (C), and drawing up technical documentation and instructions for use (D). However, there is no requirement to register the AI solution in a public EU database (A). This registration step is not specified as part of the compliance requirements under the EU AI Act for such solutions​​​​.

Under the EU AI Act, a deployer is a natural or legal person, public authority, agency, or other body that uses an AI system under its authority, except where the system is used in a personal, non-professional activity. The consulting firm is using an existing AI system to support its employees and is therefore acting as a deployer. It is not a provider because the scenario does not state that the firm develops the AI system, has it developed, or places it on the market under its own name or trademark. It is not a distributor because it is not making the system available in the supply chain. An authorized representative acts on behalf of a provider established outside the EU. Consequently, D correctly describes the firm ' s role.

================

Under theEU AI Act, serious incidents involvinghigh-risk AI systemsmust be reported. The deployer is required topromptly inform the provider and relevant authoritiesabout the issue.

From theAI Governance in Practice Report 2025:

“Serious incidents involving high-risk systems… must be reported to the provider and relevant market surveillance authority.” (p. 35)

“Timely reporting is required when AI systems result in or may result in violations of fundamental rights.” (p. 35)

In selecting the specific type of algorithm for the AI solution, the healthcare network ' s data science team is most important. This team possesses the technical expertise and understanding of the data, the clinical context, and the performance requirements needed to make an informed decision about which algorithm is most suitable. While the cloud provider and consulting firm can offer support and infrastructure, and the AI governance committee provides oversight, the data science team’s specialized knowledge is crucial for selecting and implementing the appropriate algorithm. Reference: AIGP Body of Knowledge, AI governance and team roles section.

D is the exception because the EU AI Act distinguishes obligations imposed on providers from those imposed on deployers. Under Article 16, providers of high-risk AI systems must maintain required documentation and automatically generated logs under their control. Article 17 requires providers to establish a documented quality management system, which includes setting up, implementing, and maintaining a post-market monitoring system. These provisions support A, B, and C. By contrast, Article 26 requires deployers to take appropriate organizational and technical measures to use high-risk systems according to the provider ' s instructions and to assign human oversight to suitably competent, trained, and authorized natural persons. Providers must design high-risk systems so effective human oversight is possible, but actually ensuring oversight during operational use in accordance with instructions is principally a deployer obligation.

================

External communication plans primarily establish how an organization communicates relevant AI information, risks, incidents, limitations, deployment changes, and governance matters to people outside the organization. A therefore provides the broadest and most accurate purpose. The current IAPP AIGP Study Guide expressly treats external communications as part of ongoing AI operations and associates them with transparency and trust-building. NIST AI RMF likewise requires communication plans for identified and measured AI risks and encourages communication with external stakeholders, affected communities, users, and other relevant AI actors. B concerns internal training rather than external communication. C belongs to third-party procurement and contract governance. Regulatory notification in D may form one component of an external communication plan when legally required, but it is considerably narrower than the overall governance objective of transparent stakeholder communication represented by A.

Business A is integrating a generative AI model licensed from a third party (Business B) and is primarily concerned with the risk of toxic or obscene outputs being delivered to users. In this scenario,testing and validationof the AI model for such content risks is the most direct and effective governance strategy.

According to theAI Governance in Practice Report 2025, organizations thatdeployAI must engage inperformance monitoring protocolsand ensure systems perform adequately for theirintended purposes, including filtering harmful content:

“Operational governance… development of: →Performance monitoring protocols to ensure systems perform adequately for their intended purposes.” (p. 12)

“Product governance... includes: →System impact assessments to identify and address risk prior to product development or deployment.” (p. 11)

Furthermore, under theEU AI Act, which sets the global standard many organizations aim to align with, there is a clear obligation to test and monitor systems for potential harmful behavior:

“The act imposes regulatory obligations… such as establishing appropriate accountability structures,assessing system impact, providing technical documentation,establishing risk management protocols and monitoring performance...” (p. 7)

Option B directly reflects this best practice ofpre-deployment testing and validationto ensure that the model aligns with Business A’s minimum content safety requirements.

Let’s now evaluate the incorrect options:

A. Fine-tuning on verified user-generated textmay improve model alignment but does not guarantee that the model will generalize correctly, especially if Business A lacks access to model internals (common in third-party licensing scenarios). Fine-tuning also introduces its own risks and may be contractually restricted.

C. A user reporting featureisreactive, not preventive. While helpful for long-term monitoring and mitigation, it does not prevent the initial harm of toxic outputs, which isBusiness A ' s primary concern.

D. Requesting documentation from Business Bis useful for transparency and risk management, but it does not replaceindependent verificationthat the model meets Business A’s content safety standards.

Thus,testing the model ' s behavior for unacceptable outputs before deploymentis the most aligned approach with AI governance best practices and obligations.