AIGP - Understanding the foundations of AI governance (21% of the exam) - Section 1.3

Identify and apply the common principles of responsible AI, including fairness, safety and reliability, privacy and security, transparency and explainability, accountability and human-centricity.

Define the core responsible AI principles - fairness, safety, reliability, privacy, security, transparency, explainability, accountability, and human-centricity. Apply these principles to evaluate whether an AI system design meets an organisation's ethical commitments.

responsible AI principlesfairnesstransparency and explainabilityhuman-centricity

Practice question for this objective

Free sampleUnderstanding the foundations of AI governancemedium

A bank is configuring a customer-facing generative AI assistant and wants controls that express the privacy and security principle, as opposed to controls that belong to other responsible AI principles. Which two measures most directly uphold the privacy and security principle? Select TWO.

AMinimise the personal data the assistant retains and purge transcripts once a query is resolved. Correct
BHarden the assistant against prompt-injection attempts that try to extract its hidden instructions or data. Correct
CProvide a clear route for a customer to reach a human agent when the assistant cannot help.
DDisclose to customers that they are interacting with an AI assistant rather than a person.
EMonitor the assistant for output drift and retrain it when its answer quality degrades over time.

The privacy and security principle is upheld by minimising retained personal data and by defending the system against adversarial inputs that exfiltrate data. Privacy and security combine two duties: protecting personal data through minimisation and purging, and protecting the system against attacks such as prompt injection that extract data or instructions. A human-escalation route serves human-centricity, AI disclosure serves transparency, and drift monitoring serves safety and reliability, so those measures sit under other principles.

Why A is correct: Limiting and purging retained personal data directly serves the privacy half of the privacy and security principle.

Why B is correct: Defending against adversarial inputs that exfiltrate data is a core expression of the security half of the principle.

Why C is wrong: A human-escalation route is good design but it expresses human-centricity, not the privacy and security principle.

Why D is wrong: Disclosing the AI nature of the tool is tempting as a safeguard but it serves transparency, not privacy and security.

Why E is wrong: Drift monitoring is sound practice but it serves the safety and reliability principle rather than privacy and security.

See more AIGP practice questions, answers explained.

Exam traps in Understanding the foundations of AI governance

Answers that look right on this material and are not. Each one is a distractor from a different question in the AIGP bank for this domain.

Fairness, because the pricing system produced different outcomes for different customer segments during the incident
Why it is wrong: Differential pricing raises fairness questions, but the regulator's concern was the absence of an identifiable owner and authorisation trail, which is a failure of accountability rather than of fairness.
Withhold the report entirely until the system is retired, since any disclosure about a security-relevant AI system inevitably hands an advantage to attackers
Why it is wrong: Suppressing all disclosure is tempting as the safest security posture, but it treats transparency as expendable and uses an absolute claim that ignores the layered disclosure responsible AI frameworks expect even for sensitive systems.
Encrypt each applicant's stored financial records and restrict database access to a small group of named caseworkers using role-based permissions
Why it is wrong: Tightening access controls is tempting because benefit data is sensitive, but it serves the privacy and security principle and does nothing to give affected people agency over a decision the system made autonomously.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.