Free AIGP Exam Flashcards

AI outputs are probabilistic, data-dependent, and harder to predict in edge cases than deterministic software, so errors, bias, drift, opacity, and misuse can surface after release. Governance adds structured oversight, monitoring, and accountability that ordinary software controls do not cover.

When an AI system acts with low transparency and high speed or scale, mistakes or unfairness can propagate before humans notice. That combination is what most directly justifies human oversight, monitoring, and clear accountability paths.

A classification model assigns labels or scores to inputs, while a generative system produces new content such as text, code, audio, or images. The generative profile raises distinct governance risks around hallucination, IP, safety, and misuse that classifiers usually do not.

An agentic system can plan, call tools, and take chained actions, so a single error can propagate beyond one answer. That justifies stricter controls such as approvals, permissions, rate limits, logging, and kill-switches that a retrieval-only chatbot does not need.

AI behavior is shaped by the quality, relevance, and representativeness of training data, so poor, biased, stale, or unrepresentative data directly distorts outputs. Governance therefore treats data provenance, quality, permissions, and fitness for purpose as first-order controls, not afterthoughts.

Fairness in AI governance is not aspirational language; it must be translated into measurable evaluation such as testing error rates across protected groups. Without subgroup testing, an organization cannot detect disparate impact or defend consequential decisions.

Accountability requires identifying who is responsible for approvals, monitoring, incidents, and remediation at each lifecycle stage. Informal or vendor-delegated ownership creates ambiguity that makes governance difficult to enforce or improve.

Safety and reliability depend on explicit performance thresholds and testing under realistic failure conditions, not on demo impressions or marketing language. Governance turns those expectations into repeatable validation controls before and after release.

Human-centric governance keeps human rights, agency, and meaningful oversight central to design and deployment. It does not ban automation; it requires that automation remain aligned with human values and that review paths stay real, not ceremonial.

Explainability matters most when AI affects people in high-stakes ways, because the organization must understand, justify, challenge, and monitor how decisions are made. It also supports compliance analysis when outcomes are later questioned.

A provider builds or markets an AI system, while a deployer puts it into use within its own operational context. Even when a vendor built the model, the deployer retains governance duties around use controls, monitoring, and downstream impact.

In governance terms the user is whoever interacts with the system and shapes how outputs are actually used downstream. That is why governance must train users, set acceptable-use controls, and capture feedback, because user behavior, not just model behavior, determines real-world impact.

Modern AI laws often separate provider, deployer, importer, and distributor roles because each does different things in the supply chain. Governance must map real operational roles to those legal labels early instead of assuming the upstream vendor owns every obligation.

AI risk rarely stays inside one function, so isolated legal, technical, or business review misses tradeoffs. A standing cross-functional group with legal, privacy, security, product, technical, and business representation reduces blind spots and makes ownership clearer across the lifecycle.

Procurement is often the gateway for third-party AI, so it shapes vendor diligence and contract terms before adoption. Governance breaks down if procurement signs AI deals without aligning on privacy, security, IP, testing, and audit obligations.

Lifecycle governance starts before development or deployment, not after launch. A formal intake and review requirement creates the control point where risk assessment, role assignment, and documentation happen while the decision can still be changed.

Checkpoints such as intake, testing approval, deployment approval, and monitoring review make governance operational by defining when approval, evidence, and escalation are required. They prevent material model or data changes from bypassing governance.

Acceptable-use rules limit both the tools employees may use and the use cases they may apply them to, with explicit data-handling restrictions. Confidence or convenience is not a substitute for approval, human review, and data controls.

An incident-management procedure predetermines how AI issues are detected, escalated, contained, communicated, and remediated. Predetermined steps make response predictable under pressure and help preserve evidence and meet legal obligations.

Training a model on copyrighted books or proprietary internal documents without clear permission can raise copyright and intellectual-property issues. IP review applies to third-party content and to internal material that may carry usage or confidentiality restrictions.

When an AI tool disadvantages protected groups in employment, housing, credit, or insurance, discrimination law becomes a central governance concern. A vendor source does not remove the deployer's duty to examine downstream effects.

Marketing an AI system as objective or unbiased when internal testing shows disparities can create unfair or deceptive practices risk. Governance must ensure external claims match actual system behavior and evidence.

When an AI-enabled product causes injury or economic harm because it behaves unpredictably, product liability law is highly relevant. Governance must therefore address testing, warnings, and release readiness, not only contractual disclaimers.

AI can change how data is collected, transformed, generated, monitored, or shared, so older privacy and security policies may not cover new AI-specific risks. Governance supplements existing policies rather than replacing them.

The EU AI Act sorts AI uses into tiers such as prohibited (unacceptable), high-risk, limited-risk (transparency), and minimal-risk, each carrying different compliance consequences. Tier classification drives which controls, documentation, and approvals are required before deployment.

Some uses are banned outright because lawmakers view them as unacceptable, distinct from high-risk uses that are allowed with obligations. Governance must distinguish prohibited from high-risk categories because no amount of mitigation makes a prohibited use lawful.

AI-specific laws often assign different duties to providers and deployers because each does different things in the lifecycle. Governance must map real operational roles to those legal labels instead of assuming one party owns every obligation.

AI-specific transparency rules often require telling people when they interact with certain systems or when content is synthetic. Governance must connect those legal duties to operational disclosures and downstream user-facing language.

General-purpose models sit upstream of many products and services, so lawmakers increasingly impose obligations tailored to their broad impact and downstream reuse. Governance must look beyond the immediate application and consider upstream model obligations.

Before using personal data to train or fine-tune a model, an organization must identify a lawful basis that addresses whether the use is allowed and under what conditions. Accuracy, security, and vendor controls do not substitute for permission to process.

Reusing data collected for one defined purpose, such as order updates, to train a marketing-optimization model is a materially different purpose. AI projects trigger purpose-limitation questions whenever existing data is repurposed without fresh legal support or transparency.

Data minimization limits collection and use to what is relevant and necessary for the defined purpose. In AI governance, that means resisting hoarding data simply because it might help later experiments.

Privacy by design embeds privacy into requirements, architecture, workflows, controls, and records from the start rather than adding it late. For AI, it includes minimization, transparency, access controls, and ongoing rights handling across the lifecycle.

The OECD AI Principles are a widely cited, non-binding set of high-level expectations for trustworthy AI, including accountability, human-centered values, and transparency. They shape how organizations frame responsible AI even where they are not directly binding.

The NIST AI Risk Management Framework is organized around four functions: Govern, Map, Measure, and Manage. Govern is cross-cutting and anchors organizational context, roles, and oversight, while Map, Measure, and Manage handle context-setting, analysis, and response.

The Playbook translates RMF concepts into concrete practices that teams can adopt when building or improving an AI governance program. It is a practical companion to the framework, not a legal override or a certifiable compliance scheme.

ISO/IEC 42001 is the first certifiable international management system standard for AI, structured in the same Plan-Do-Check-Act shape as ISO 27001 and ISO 9001. Unlike NIST AI RMF, it can be audited and certified by an accredited third party.

ISO/IEC 22989 provides shared AI concepts and terminology, which helps different teams use the same words to mean the same things. Governance breaks down quickly when stakeholders confuse terms such as model, system, deployer, or provider.

Before any design work begins, governance should help define the proposed system's purpose, success criteria, and boundaries. A structured impact assessment before building surfaces legal, ethical, and technical issues while they are still cheap to fix.

A probability-severity matrix helps teams rank AI risks by likelihood and impact so review effort can be prioritized. It turns vague risk talk into a structured design-review tool that supports go/no-go and mitigation decisions.

Data provenance records where data came from, while lineage tracks how it moves and transforms through the pipeline. Both are governance controls because they make it possible to demonstrate lawful rights, fitness for purpose, and reproducibility.

Fit for purpose means the data is relevant, representative, and adequate for the intended use, not merely available. Governance must verify fitness before training rather than assuming more data always produces a better model.

Before training begins, the organization should document its lawful rights to collect and use the data, including licenses, consents, and contractual permissions. Undocumented rights create legal and IP exposure that may block release or trigger remediation costs.

ISO/IEC 42005:2025 provides guidance for AI system impact assessments, helping organizations characterize effects on individuals, groups, and society across the lifecycle. It complements ISO/IEC 42001 by supplying the assessment methodology that the management system standard requires.

Release readiness is a governance decision because a system can pass technical metrics yet lack monitoring, escalation paths, documentation, or user safeguards. Governance evidence, not just model metrics, is what makes release defensible.

A model card summarizes intended use, limitations, evaluation results, and other key details for downstream users and reviewers. It supports transparency and more disciplined downstream use than raw technical documentation alone.

Model drift is the gradual divergence between a model's launch-time behavior and its current behavior as inputs, users, or environment shift. Monitoring and scheduled retraining exist to catch drift before harm accrues.

Red teaming is structured adversarial testing that probes an AI system for failure modes standard validation tends to miss. It adds depth to readiness and monitoring evidence by viewing the system from an attacker or abuser perspective.

Threat modeling systematically enumerates how an AI system could be attacked or misused and which controls would fail in each path. It is most valuable when AI components introduce new entry points or incentives for abuse.

AI governance evaluates incidents by consequences to people, organizations, and systems, not only by the raw bug description. Capturing business and user impact, not just the technical defect, helps prioritize response and improve the control environment.