Free AIGP practice questions

Synthetic video erodes public willingness to believe genuine footage. Which harm category is this?

• AEcosystem harm.
• BIndividual harm.
• CSocietal harm.
• DGroup harm.

Synthetic video erodes public willingness to believe genuine footage. Which harm category is this?

• AEcosystem harm.
• BGroup harm.
• CSocietal harm.
• DIndividual harm.

A SaaS vendor processes customer data on the customer’s documented instructions. Separately, it decides on its own to use the same data to improve its general model. What is its GDPR role in the first operation and in the second?

• AJoint controller with the customer for both.
• BProcessor for the first; controller for the second.
• CProcessor for both operations.
• DController for the first; processor for the second.

Which is LEAST likely to provide guidance on reducing discrimination in an AI hiring tool?

• AThe Equal Employment Opportunity Commission.
• BThe National Artificial Intelligence Initiative Act.
• CThe Fair Credit Reporting Act.
• DTitle VII of the Civil Rights Act of 1964.

A team wants to process special-category data to test a model for bias. Under the GDPR, what does it need?

• AAn Art. 9(2) condition and a completed DPIA.
• BAn Art. 9(2) condition, which replaces Art. 6.
• CAn Art. 6 basis and a completed DPIA.
• DAn Art. 6 basis and an Art. 9(2) condition.

A company is a GDPR controller for the personal data in its AI system and satisfies every GDPR obligation. What does that establish about its EU AI Act compliance?

• ANothing on its own.
• BThat only Art. 50 duties remain.
• CThat Art. 10 data governance is met.
• DThat it is largely compliant.

A non-EU provider of a high-risk AI system must appoint an authorised representative in the Union. Which article requires it?

• AEU AI Act Art. 22.
• BGDPR Art. 22.
• CGDPR Art. 27.
• DEU AI Act Art. 27.

Under the Digital Omnibus amendments, which AI Act deadline did NOT move?

• AArt. 50 transparency obligations.
• BAnnex III high-risk obligations.
• CAnnex I high-risk obligations.
• DNational regulatory sandboxes.

A US analytics company with no EU establishment tracks the browsing behaviour of users located in Germany. Which provision brings it within the GDPR?

• AArt. 3(1).
• BArt. 3(3).
• CArt. 3(2)(b).
• DArt. 3(2)(a).

The BOK describes four value-chain actors: developer, provider, deployer and user. Which of them are also operator roles defined in the EU AI Act?

• AProvider, deployer and user.
• BProvider and deployer only.
• CDeveloper, provider and deployer.
• DAll four of them.

A private company deploys a high-risk AI system to screen job applicants. Who owes a fundamental rights impact assessment under EU AI Act Art. 27 for this deployment?

• AThe company and the provider jointly.
• BThe provider, before market placement.
• CNobody, on these facts.
• DThe company, as deployer.

A team has agreed the business problem its new AI system will solve. Which step comes next?

• ADetermine the specific use cases.
• BIdentify the applicable laws.
• CIdentify the data it will need.
• DIdentify the gaps and risks.

Aldermere starts using client survey data to improve its own assistant. What changes?

• AIt becomes a joint controller for that processing.
• BIt becomes a controller for all the survey data.
• CIt becomes a controller for that processing.
• DIt remains a processor for that processing.

How many principles does GDPR Art. 5 contain?

• ASeven.
• BFive.
• CSix.
• DEight.

An option reads: "Anonymising the training data resolves the privacy concerns." Which distractor pattern is this?

• AAbsolutes.
• BSingle safeguard.
• CShifted accountability.
• DWrong risk tier.