Free AIGP practice questions

Synthetic video erodes public willingness to believe genuine footage. Which harm category is this?

• AGroup harm.
• BEcosystem harm.
• CSocietal harm.
• DIndividual harm.

Synthetic video erodes public willingness to believe genuine footage. Which harm category is this?

• AIndividual harm.
• BSocietal harm.
• CGroup harm.
• DEcosystem harm.

A SaaS vendor processes customer data on the customer’s documented instructions. Separately, it decides on its own to use the same data to improve its general model. What is its GDPR role in the first operation and in the second?

• AController for the first; processor for the second.
• BProcessor for both operations.
• CJoint controller with the customer for both.
• DProcessor for the first; controller for the second.

Which is LEAST likely to provide guidance on reducing discrimination in an AI hiring tool?

• AThe Equal Employment Opportunity Commission.
• BThe Fair Credit Reporting Act.
• CTitle VII of the Civil Rights Act of 1964.
• DThe National Artificial Intelligence Initiative Act.

A team wants to process special-category data to test a model for bias. Under the GDPR, what does it need?

• AAn Art. 9(2) condition, which replaces Art. 6.
• BAn Art. 6 basis and an Art. 9(2) condition.
• CAn Art. 6 basis and a completed DPIA.
• DAn Art. 9(2) condition and a completed DPIA.

A company is a GDPR controller for the personal data in its AI system and satisfies every GDPR obligation. What does that establish about its EU AI Act compliance?

• AThat it is largely compliant.
• BThat Art. 10 data governance is met.
• CNothing on its own.
• DThat only Art. 50 duties remain.

A non-EU provider of a high-risk AI system must appoint an authorised representative in the Union. Which article requires it?

• AEU AI Act Art. 27.
• BGDPR Art. 22.
• CEU AI Act Art. 22.
• DGDPR Art. 27.

Under the Digital Omnibus amendments, which AI Act deadline did NOT move?

• AAnnex I high-risk obligations.
• BArt. 50 transparency obligations.
• CAnnex III high-risk obligations.
• DNational regulatory sandboxes.

A US analytics company with no EU establishment tracks the browsing behaviour of users located in Germany. Which provision brings it within the GDPR?

• AArt. 3(3).
• BArt. 3(2)(a).
• CArt. 3(2)(b).
• DArt. 3(1).

The BOK describes four value-chain actors: developer, provider, deployer and user. Which of them are also operator roles defined in the EU AI Act?

• AProvider and deployer only.
• BDeveloper, provider and deployer.
• CAll four of them.
• DProvider, deployer and user.

A private company deploys a high-risk AI system to screen job applicants. Who owes a fundamental rights impact assessment under EU AI Act Art. 27 for this deployment?

• AThe provider, before market placement.
• BThe company, as deployer.
• CNobody, on these facts.
• DThe company and the provider jointly.

A team has agreed the business problem its new AI system will solve. Which step comes next?

• AIdentify the data it will need.
• BIdentify the gaps and risks.
• CDetermine the specific use cases.
• DIdentify the applicable laws.

Aldermere starts using client survey data to improve its own assistant. What changes?

• AIt becomes a controller for that processing.
• BIt becomes a joint controller for that processing.
• CIt becomes a controller for all the survey data.
• DIt remains a processor for that processing.

How many principles does GDPR Art. 5 contain?

• AEight.
• BSix.
• CFive.
• DSeven.

An option reads: "Anonymising the training data resolves the privacy concerns." Which distractor pattern is this?

• AWrong risk tier.
• BShifted accountability.
• CAbsolutes.
• DSingle safeguard.