AIGP - Understanding how to govern AI development (27% of the exam) - Section 3.3

Establish data governance requirements for AI training and testing, including lawful rights to collect and use data, data quality assessment, data lineage and provenance documentation.

Establish data governance requirements for AI training and testing, including verifying lawful rights to collect and use data, assessing data quality, and documenting data lineage and provenance. Recognise how gaps in these controls create legal and model-quality risk.

data governancedata lineagedata provenancetraining data rights

Practice question for this objective

Free sampleUnderstanding how to govern AI developmentmedium

A team is assembling a training corpus for a new AI system, drawing on a licensed third-party dataset, records the firm collected from its own customers, and a batch of images bought from a data broker. The governance lead is defining what must be documented to evidence that the organisation holds lawful rights to collect and use each source for AI training. Which two records most directly establish those lawful rights for the corpus? Select TWO.

AThe licence terms for each acquired dataset, confirming the agreed scope permits use of the data for training an AI model. Correct
BThe lawful basis recorded for the customer records, plus the consent or notice conditions under which that personal data was obtained. Correct
CThe sequence of cleaning, joining and feature-engineering transformations each dataset passed through inside the training pipeline.
DThe class-balance and label-accuracy statistics computed across the assembled corpus to confirm it is fit for purpose before training.
EThe validation and test partition splits and the random seed recorded so that the sampling can later be reproduced exactly.

Lawful rights to use training data are evidenced by source licences and the recorded lawful basis with collection conditions, not by quality or pipeline records. Establishing lawful rights turns on the legal permissions attached to each source: a licence that permits AI-training use for acquired data, and a documented lawful basis plus the consent or notice conditions for personal data. Lineage, quality metrics and partition splits are separate governance concerns that do not confer or evidence a right to process the data.

Why A is correct: Correct: a supplier licence that expressly allows AI-training use is the direct evidence that the firm holds the rights to use that acquired source for this purpose.

Why B is correct: Correct: for personal data the documented lawful basis and the original collection conditions are what evidence a lawful right to process those records for training.

Why C is wrong: Tempting because it is core data documentation, but this is lineage of internal processing and speaks to traceability, not to whether the firm lawfully held the rights to the source.

Why D is wrong: Tempting as essential governance evidence, but these are data-quality measures of fitness for purpose and say nothing about the legal right to collect or use the data.

Why E is wrong: Tempting because it supports reproducible evaluation, but partitioning is an experimental-design record that has no bearing on the lawful rights to the underlying data.

See more AIGP practice questions, answers explained.

Exam traps in Understanding how to govern AI development

Answers that look right on this material and are not. Each one is a distractor from a different question in the AIGP bank for this domain.

The synthetic data needs no provenance record because it is artificially generated, so documenting its origin would add governance overhead without reducing any legal or quality risk
Why it is wrong: This is tempting because synthetic data is often promoted as privacy-safe, but skipping provenance ignores that the generator was fitted on real personal data, so the synthetic set still carries inherited rights and quality questions that documentation must capture.
Provenance records the model's hyperparameters and training runs, while lineage records the access controls applied to each dataset.
Why it is wrong: This conflates both terms with unrelated artefacts; hyperparameters belong to model documentation and access controls belong to security, so neither half names what provenance or lineage actually captures.
Data minimisation, because limiting the volume of collected data reduces the legal exposure of the training set
Why it is wrong: Data minimisation is tempting because it is a recognised data governance principle, but it concerns restricting how much data is collected rather than documenting where data came from and on what legal terms, so it does not describe the first practice.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.