AIGP Exam Flashcards

Q: What is the AIGP exam format?

IAPP administers the AIGP as a 100-question multiple-choice exam with a 2.75-hour appointment and a scheduled 15-minute break. Testing is delivered through Pearson VUE, with in-person test centers and OnVUE remote proctoring available, and the current body of knowledge took effect February 2, 2026.

Q: What score do I need to pass the AIGP?

IAPP reports AIGP results on a 100-500 scaled scoring range, and the passing score is 300. The scaled score is not the same as a raw percentage, so candidates cannot simply count correct answers to know whether they passed.

Q: What are the four AIGP blueprint domains?

The AIGP Body of Knowledge 2.1 covers four domains: Foundations of AI Governance (16-20 scored questions), Laws, Standards and Frameworks (19-23), Governing AI Development (21-25), and Governing AI Deployment and Use (21-25). The two largest domains govern development and deployment, so candidates should weight timed practice toward lifecycle scenarios.

Q: How much does the AIGP exam cost?

The AIGP exam fee is $649 for IAPP members and $799 for nonmembers, with retakes priced at $475 (member) and $625 (nonmember). Certification maintenance requires either IAPP membership (which includes the maintenance fee) or a $250 per two-year certification maintenance fee plus continuing privacy and AI governance education.

Q: What changed for AIGP prep in 2026?

The current AIGP body of knowledge took effect February 2, 2026 and explicitly incorporates generative and agentic AI, the South Korean AI Basic Law (effective January 22, 2026), Colorado's amended AI Act (effective June 30, 2026), and the EU AI Act's broad application date of August 2, 2026. Candidates should refresh 2026 regulatory milestones shortly before test day.

Q: Do I need a legal or technical background before taking AIGP?

No formal prerequisite is required to sit for the AIGP exam. The blueprint is cross-functional, so candidates from privacy, legal, security, product, risk, compliance, procurement, and technical roles can all prepare successfully if they study the governance lifecycle, the major legal buckets, and current AI laws and standards.

Question 1

Why AI needs governance beyond ordinary software

Accepted Answer

AI outputs are probabilistic, data-dependent, and harder to predict in edge cases than deterministic software, so errors, bias, drift, opacity, and misuse can surface after release. Governance adds structured oversight, monitoring, and accountability that ordinary software controls do not cover.

Question 2

Opacity and scale as a governance trigger

Accepted Answer

When an AI system acts with low transparency and high speed or scale, mistakes or unfairness can propagate before humans notice. That combination is what most directly justifies human oversight, monitoring, and clear accountability paths.

Question 3

Generative AI vs. classification model

Accepted Answer

A classification model assigns labels or scores to inputs, while a generative system produces new content such as text, code, audio, or images. The generative profile raises distinct governance risks around hallucination, IP, safety, and misuse that classifiers usually do not.

Question 4

Agentic AI vs. retrieval-only chatbot

Accepted Answer

An agentic system can plan, call tools, and take chained actions, so a single error can propagate beyond one answer. That justifies stricter controls such as approvals, permissions, rate limits, logging, and kill-switches that a retrieval-only chatbot does not need.

Question 5

Data dependency as a governance concern

Accepted Answer

AI behavior is shaped by the quality, relevance, and representativeness of training data, so poor, biased, stale, or unrepresentative data directly distorts outputs. Governance therefore treats data provenance, quality, permissions, and fitness for purpose as first-order controls, not afterthoughts.

Question 6

Fairness as a measurable control

Accepted Answer

Fairness in AI governance is not aspirational language; it must be translated into measurable evaluation such as testing error rates across protected groups. Without subgroup testing, an organization cannot detect disparate impact or defend consequential decisions.

Question 7

Accountability through named owners

Accepted Answer

Accountability requires identifying who is responsible for approvals, monitoring, incidents, and remediation at each lifecycle stage. Informal or vendor-delegated ownership creates ambiguity that makes governance difficult to enforce or improve.

Question 8

Safety and reliability vs. marketing claims

Accepted Answer

Safety and reliability depend on explicit performance thresholds and testing under realistic failure conditions, not on demo impressions or marketing language. Governance turns those expectations into repeatable validation controls before and after release.

Question 9

Human-centric AI governance

Accepted Answer

Human-centric governance keeps human rights, agency, and meaningful oversight central to design and deployment. It does not ban automation; it requires that automation remain aligned with human values and that review paths stay real, not ceremonial.

Question 10

Explainability in consequential decisions

Accepted Answer

Explainability matters most when AI affects people in high-stakes ways, because the organization must understand, justify, challenge, and monitor how decisions are made. It also supports compliance analysis when outcomes are later questioned.

Question 11

Deployer vs. provider in governance

Accepted Answer

A provider builds or markets an AI system, while a deployer puts it into use within its own operational context. Even when a vendor built the model, the deployer retains governance duties around use controls, monitoring, and downstream impact.

Question 12

User as a governance role

Accepted Answer

In governance terms the user is whoever interacts with the system and shapes how outputs are actually used downstream. That is why governance must train users, set acceptable-use controls, and capture feedback, because user behavior, not just model behavior, determines real-world impact.

Question 13

Importer and distributor roles

Accepted Answer

Modern AI laws often separate provider, deployer, importer, and distributor roles because each does different things in the supply chain. Governance must map real operational roles to those legal labels early instead of assuming the upstream vendor owns every obligation.

Question 14

Cross-functional governance group

Accepted Answer

AI risk rarely stays inside one function, so isolated legal, technical, or business review misses tradeoffs. A standing cross-functional group with legal, privacy, security, product, technical, and business representation reduces blind spots and makes ownership clearer across the lifecycle.

Question 15

Procurement as a governance control point

Accepted Answer

Procurement is often the gateway for third-party AI, so it shapes vendor diligence and contract terms before adoption. Governance breaks down if procurement signs AI deals without aligning on privacy, security, IP, testing, and audit obligations.

Question 16

Intake and review before build or deploy

Accepted Answer

Lifecycle governance starts before development or deployment, not after launch. A formal intake and review requirement creates the control point where risk assessment, role assignment, and documentation happen while the decision can still be changed.

Question 17

Lifecycle checkpoints

Accepted Answer

Checkpoints such as intake, testing approval, deployment approval, and monitoring review make governance operational by defining when approval, evidence, and escalation are required. They prevent material model or data changes from bypassing governance.

Question 18

Acceptable-use policy for AI tools

Accepted Answer

Acceptable-use rules limit both the tools employees may use and the use cases they may apply them to, with explicit data-handling restrictions. Confidence or convenience is not a substitute for approval, human review, and data controls.

Question 19

Incident-management procedure

Accepted Answer

An incident-management procedure predetermines how AI issues are detected, escalated, contained, communicated, and remediated. Predetermined steps make response predictable under pressure and help preserve evidence and meet legal obligations.

Question 20

IP and copyright risk in AI training

Accepted Answer

Training a model on copyrighted books or proprietary internal documents without clear permission can raise copyright and intellectual-property issues. IP review applies to third-party content and to internal material that may carry usage or confidentiality restrictions.

Question 21

Discrimination law and AI screening

Accepted Answer

When an AI tool disadvantages protected groups in employment, housing, credit, or insurance, discrimination law becomes a central governance concern. A vendor source does not remove the deployer's duty to examine downstream effects.

Question 22

Consumer protection and misleading AI claims

Accepted Answer

Marketing an AI system as objective or unbiased when internal testing shows disparities can create unfair or deceptive practices risk. Governance must ensure external claims match actual system behavior and evidence.

Question 23

Product liability for AI-enabled products

Accepted Answer

When an AI-enabled product causes injury or economic harm because it behaves unpredictably, product liability law is highly relevant. Governance must therefore address testing, warnings, and release readiness, not only contractual disclaimers.

Question 24

Why existing policies must be re-reviewed for AI

Accepted Answer

AI can change how data is collected, transformed, generated, monitored, or shared, so older privacy and security policies may not cover new AI-specific risks. Governance supplements existing policies rather than replacing them.

Question 25

EU AI Act risk tiers

Accepted Answer

The EU AI Act sorts AI uses into tiers such as prohibited (unacceptable), high-risk, limited-risk (transparency), and minimal-risk, each carrying different compliance consequences. Tier classification drives which controls, documentation, and approvals are required before deployment.

Question 26

Prohibited practices under the EU AI Act

Accepted Answer

Some uses are banned outright because lawmakers view them as unacceptable, distinct from high-risk uses that are allowed with obligations. Governance must distinguish prohibited from high-risk categories because no amount of mitigation makes a prohibited use lawful.

Question 27

Provider vs. deployer duties in AI-specific law

Accepted Answer

AI-specific laws often assign different duties to providers and deployers because each does different things in the lifecycle. Governance must map real operational roles to those legal labels instead of assuming one party owns every obligation.

Question 28

Transparency obligations in AI-specific law

Accepted Answer

AI-specific transparency rules often require telling people when they interact with certain systems or when content is synthetic. Governance must connect those legal duties to operational disclosures and downstream user-facing language.

Question 29

General-purpose AI models

Accepted Answer

General-purpose models sit upstream of many products and services, so lawmakers increasingly impose obligations tailored to their broad impact and downstream reuse. Governance must look beyond the immediate application and consider upstream model obligations.

Question 30

Lawful basis before AI training

Accepted Answer

Before using personal data to train or fine-tune a model, an organization must identify a lawful basis that addresses whether the use is allowed and under what conditions. Accuracy, security, and vendor controls do not substitute for permission to process.

Question 31

Purpose limitation in AI projects

Accepted Answer

Reusing data collected for one defined purpose, such as order updates, to train a marketing-optimization model is a materially different purpose. AI projects trigger purpose-limitation questions whenever existing data is repurposed without fresh legal support or transparency.

Question 32

Data minimization for AI

Accepted Answer

Data minimization limits collection and use to what is relevant and necessary for the defined purpose. In AI governance, that means resisting hoarding data simply because it might help later experiments.

Question 33

Privacy by design in AI

Accepted Answer

Privacy by design embeds privacy into requirements, architecture, workflows, controls, and records from the start rather than adding it late. For AI, it includes minimization, transparency, access controls, and ongoing rights handling across the lifecycle.

Question 34

OECD AI Principles

Accepted Answer

The OECD AI Principles are a widely cited, non-binding set of high-level expectations for trustworthy AI, including accountability, human-centered values, and transparency. They shape how organizations frame responsible AI even where they are not directly binding.

Question 35

NIST AI RMF four functions

Accepted Answer

The NIST AI Risk Management Framework is organized around four functions: Govern, Map, Measure, and Manage. Govern is cross-cutting and anchors organizational context, roles, and oversight, while Map, Measure, and Manage handle context-setting, analysis, and response.

Question 36

NIST AI RMF Playbook

Accepted Answer

The Playbook translates RMF concepts into concrete practices that teams can adopt when building or improving an AI governance program. It is a practical companion to the framework, not a legal override or a certifiable compliance scheme.

Question 37

ISO/IEC 42001

Accepted Answer

ISO/IEC 42001 is the first certifiable international management system standard for AI, structured in the same Plan-Do-Check-Act shape as ISO 27001 and ISO 9001. Unlike NIST AI RMF, it can be audited and certified by an accredited third party.

Question 38

ISO/IEC 22989

Accepted Answer

ISO/IEC 22989 provides shared AI concepts and terminology, which helps different teams use the same words to mean the same things. Governance breaks down quickly when stakeholders confuse terms such as model, system, deployer, or provider.

Question 39

Use-case definition before design

Accepted Answer

Before any design work begins, governance should help define the proposed system's purpose, success criteria, and boundaries. A structured impact assessment before building surfaces legal, ethical, and technical issues while they are still cheap to fix.

Question 40

Probability-severity matrix in design review

Accepted Answer

A probability-severity matrix helps teams rank AI risks by likelihood and impact so review effort can be prioritized. It turns vague risk talk into a structured design-review tool that supports go/no-go and mitigation decisions.

Question 41

Data provenance vs. lineage

Accepted Answer

Data provenance records where data came from, while lineage tracks how it moves and transforms through the pipeline. Both are governance controls because they make it possible to demonstrate lawful rights, fitness for purpose, and reproducibility.

Question 42

Fit for purpose in training data

Accepted Answer

Fit for purpose means the data is relevant, representative, and adequate for the intended use, not merely available. Governance must verify fitness before training rather than assuming more data always produces a better model.

Question 43

Lawful rights to collect and use training data

Accepted Answer

Before training begins, the organization should document its lawful rights to collect and use the data, including licenses, consents, and contractual permissions. Undocumented rights create legal and IP exposure that may block release or trigger remediation costs.

Question 44

ISO/IEC 42005 impact assessment

Accepted Answer

ISO/IEC 42005:2025 provides guidance for AI system impact assessments, helping organizations characterize effects on individuals, groups, and society across the lifecycle. It complements ISO/IEC 42001 by supplying the assessment methodology that the management system standard requires.

Question 45

Release readiness as a governance decision

Accepted Answer

Release readiness is a governance decision because a system can pass technical metrics yet lack monitoring, escalation paths, documentation, or user safeguards. Governance evidence, not just model metrics, is what makes release defensible.

Question 46

Model card at release

Accepted Answer

A model card summarizes intended use, limitations, evaluation results, and other key details for downstream users and reviewers. It supports transparency and more disciplined downstream use than raw technical documentation alone.

Question 47

Model drift and why it matters

Accepted Answer

Model drift is the gradual divergence between a model's launch-time behavior and its current behavior as inputs, users, or environment shift. Monitoring and scheduled retraining exist to catch drift before harm accrues.

Question 48

Red teaming in AI governance

Accepted Answer

Red teaming is structured adversarial testing that probes an AI system for failure modes standard validation tends to miss. It adds depth to readiness and monitoring evidence by viewing the system from an attacker or abuser perspective.

Question 49

Threat modeling for AI

Accepted Answer

Threat modeling systematically enumerates how an AI system could be attacked or misused and which controls would fail in each path. It is most valuable when AI components introduce new entry points or incentives for abuse.

Question 50

Incident logs with business and user impact

Accepted Answer

AI governance evaluates incidents by consequences to people, organizations, and systems, not only by the raw bug description. Capturing business and user impact, not just the technical defect, helps prioritize response and improve the control environment.

Free AIGP Exam Flashcards

Filter by Topic

Jump to Card

About These AIGP Flashcards

Topics Covered

Frequently Asked Questions

AIGP

Explore More IAPP Certifications

CIPP/E

CIPP/US

CIPT

CIPM

IAPP Certified Data Protection Officer — Brazil (CDPO/BR)

IAPP Certified Data Protection Officer — France (CDPO/FR)

More From This Family