Free AIGP flashcards

Data was collected to run accounts and detect fraud. The team now wants to reuse it to train a marketing model. What must GDPR purpose limitation require first?

Either establish that the new marketing purpose is compatible with the original collection purposes, or obtain a fresh lawful basis such as consent. Purpose limitation allows further processing only where it is compatible with the purposes data was collected for; a marketing propensity model is usually a distinct commercial objective and not compatible with fraud detection, so a separate lawful basis is needed before training.

Reusing fraud-detection data to train a marketing model is fine because the marketing model will, as a side benefit, improve fraud detection for the same customers.

An incidental fraud benefit does not make the marketing use lawful. A marketing propensity model is a distinct commercial objective, so linking it loosely to the original fraud purpose is not a valid compatibility argument. The reuse still needs a compatibility finding or a fresh lawful basis such as consent.

What is the defining contrast between generative AI and classic AI?

Generative AI synthesises novel content such as text by modelling and sampling from its training data distribution. Classic discriminative AI maps an input to one of a fixed set of predefined labels, such as approve or decline. The line is creating new output versus selecting among set categories.

Is generative AI distinguished by training on labelled examples while classic systems use only unlabelled data?

No, this inverts the truth. Many classic classifiers train on labelled data, and generative models often learn in a self-supervised way. Supervision is a real distinction but it does not separate generative from classic AI. The real contrast is creating new content versus classifying into fixed categories.

Under the EU AI Act, who bears the human oversight duty for a high-risk system once it is sold to a deployer?

Both. Article 14 makes the provider design and build in oversight measures so natural persons can monitor, interpret output and intervene or stop the system, and the deployer must then assign competent, empowered people to exercise that oversight in real use. The duty spans design and operation.

Once a high-risk system is placed on the market, oversight is purely the deployer's concern and the provider's role has ended.

Wrong. The provider must build oversight measures into the system before placing it on the market, so the duty is shared. Oversight does occur during use, but it depends on design features the provider is obliged to create, so it never rests on the deployer alone.

What single characteristic separates an AI system from ordinary deterministic software under the OECD and EU AI Act definition?

Inference. An AI system derives outputs such as predictions, content, recommendations or decisions from the inputs it receives, rather than only executing rules a human hand-coded. A rules-only boiler controller is excluded because every response is fixed by the programmer.

Keeping a historical log of past readings that an engineer can inspect is enough to make a controller an AI system.

Recording data is passive storage, not inference. The definition requires the system to infer outputs such as predictions or decisions from its inputs. Merely logging temperature readings does no such inference, so it does not meet the definition.