AI Governance Professional (AIGP) practice questions

A facilities team builds a heating controller whose behaviour is fixed entirely by rules a programmer wrote, such as switching the boiler on whenever a sensor reads below 18 degrees. A governance lead is asked why this controller does not meet the widely used OECD and EU AI Act definition of an AI system. Which characteristic, present in that definition, does the controller lack?

• AIt infers from the inputs it receives how to generate outputs such as predictions or decisions, rather than only executing rules a human wrote.check_circle Correct
• BIt runs continuously rather than only when an operator manually triggers each individual action through the interface.
• CIt connects to the internet so that it can transmit its sensor readings to a remote server for storage.
• DIt stores a historical log of past temperature readings that an engineer can later download and inspect.

Why A is correct: The OECD and EU AI Act definition centres on a system that infers from input how to produce outputs like predictions, content, recommendations or decisions, which a fixed rules-only controller does not do.

Why B is wrong: Running continuously is tempting because people associate AI with always-on services, but autonomous scheduling is not what the definition turns on, and many simple automated devices run continuously without being AI.

Why C is wrong: Network connectivity sounds modern and AI-like, yet the definition says nothing about connectivity, and an offline model is still AI while a connected thermostat is not.

Why D is wrong: Keeping a data log feels relevant because AI uses data, but merely recording readings is passive storage and is not the inference of outputs that the definition requires.

A bank collected customer transaction records under a privacy notice that stated the data would be used to operate accounts and detect fraud. The data science team now wants to reuse those same records to train a marketing propensity model. Under the GDPR principle of purpose limitation, what must the team establish before proceeding on this basis?

• AThat the marketing model will, as a secondary benefit, improve the accuracy of the existing fraud detection model for the same customers
• BThat the records have been pseudonymised so that direct identifiers are replaced with tokens before training begins
• CThat the new marketing purpose is compatible with the original purposes, or otherwise obtain a fresh lawful basis such as consent for the reusecheck_circle Correct
• DThat the resulting model will be evaluated for demographic bias before any marketing campaign is launched

Why A is wrong: This is tempting because linking the new use to the original fraud purpose sounds like a compatibility argument, but a marketing propensity model is a distinct commercial objective, so an incidental fraud benefit does not make the marketing use lawful under the original notice.

Why B is wrong: Pseudonymisation is a useful safeguard and can support a compatibility assessment, but on its own it does not authorise a new incompatible purpose because pseudonymised data remains personal data subject to purpose limitation.

Why C is correct: Purpose limitation permits further processing only where it is compatible with the purposes for which data was collected, and where it is not compatible the controller must secure a separate lawful basis such as fresh consent before reusing the records.

Why D is wrong: Bias evaluation is good governance and may be required for fairness, but it addresses model outputs rather than the lawfulness of reusing the data, so it does not resolve the purpose limitation question about whether the reuse is permitted at all.

A provider is preparing a high-risk recruitment-screening system for the EU market and is allocating the human oversight obligations under the EU AI Act. The deploying employer insists that oversight is purely its own concern once the system is purchased. How does the EU AI Act actually allocate the human oversight duty for a high-risk system?

• AOnly the deployer bears any oversight duty, because oversight happens during use and the provider's responsibility ends once the system is placed on the market.
• BThe provider must design the system so that natural persons can effectively oversee it, and the deployer must then assign competent persons with the authority to intervene.check_circle Correct
• COversight may be delegated entirely to an automated monitoring component, so no identified natural person needs the authority to intervene in individual decisions.
• DHuman oversight is only recommended guidance for high-risk systems, so a provider that documents strong testing may omit oversight measures altogether.

Why A is wrong: This matches the employer's intuition and the fact that oversight occurs in operation, but it is wrong because the provider must build oversight measures into the system before placing it on the market, so the duty is shared rather than the deployer's alone.

Why B is correct: Article 14 requires the provider to build in oversight measures appropriate to the risks and the deployer to entrust oversight to people who are competent and empowered to act, so responsibility runs across both roles.

Why C is wrong: Automated monitoring is attractive because it scales, but it contradicts the Act's premise that effective oversight is exercised by natural persons who can understand and override the system, not by another automated layer.

Why D is wrong: Treating oversight as optional is tempting where validation looks rigorous, but for high-risk systems oversight is a binding requirement that testing cannot substitute for, so omitting it is non-compliant.