AI0-001 AI Governance and Ethics — Timed 20 Questions

Question 1

A data scientist is using SHAP to explain a complex ensemble model's predictions. A business stakeholder asks why a particular prediction was made. The data scientist wants to show the most influential features for that single prediction. Which SHAP visualisation is most appropriate?

20 minute time limit — choose an answer to begin.

Accepted Answer

A SHAP force plot for the individual prediction. A SHAP force plot is specifically designed to visualize the contribution of each feature to a single prediction, showing how features push the prediction from the base value (average model output) to the final prediction. This makes it the ideal choice for explaining an individual prediction to a business stakeholder, as it provides a clear, localized explanation of feature impacts.

Answer

A SHAP summary plot showing mean absolute SHAP values across all features

Answer

A SHAP dependence plot for the top feature

Answer

A SHAP bar chart of absolute feature importance

Question 2

A company deploys an AI resume screening tool. It learns from historical hiring data where most successful hires were male, leading the model to favour male candidates. Which type of bias is this primarily?

Accepted Answer

Historical bias. The model learned from historical hiring data that already contained a gender imbalance, where most successful hires were male. This is a classic case of historical bias, where the training data reflects past societal or organizational biases, and the AI system perpetuates those biases in its predictions. The bias originates in the data, not in the model's algorithm or the sampling method.

Answer

Confirmation bias

Answer

Algorithmic bias

Answer

Selection bias

Question 3

A healthcare AI startup is developing a model to predict patient readmission risk. The model will be used to allocate post-discharge resources. Which regulatory framework primarily governs the use of patient data in this scenario?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the correct regulatory framework because the scenario involves a healthcare AI startup using protected health information (PHI) to predict patient readmission risk. HIPAA governs the use, disclosure, and safeguarding of PHI by covered entities and their business associates, which includes AI models processing patient data for post-discharge resource allocation.

Answer

GDPR

Answer

CCPA

Answer

EU AI Act

Question 4

A company is developing an AI policy. Which of the following should be included to ensure accountability for AI-driven decisions?

Accepted Answer

Designated roles for human oversight and decision authority. Accountability for AI-driven decisions requires clear assignment of human roles with oversight and decision authority. This ensures that there is a responsible party who can review, override, or be held liable for the AI's outputs, which is a core principle of AI governance frameworks such as the NIST AI Risk Management Framework.

Answer

A set of acceptable use cases for the AI

Answer

A description of the model architecture used

Answer

A list of approved training data sources

Question 5

An AI system is being deployed to detect deepfakes in video content. To comply with transparency obligations, what should the company implement?

Accepted Answer

A visible or invisible watermark on AI-generated videos. Transparency obligations under AI governance frameworks (e.g., EU AI Act) require clear disclosure when content is AI-generated. A visible or invisible watermark directly informs viewers that the video is synthetic, fulfilling this requirement without over-blocking legitimate content. Option B is correct because it provides a verifiable, non-disruptive method of labeling AI-generated media.

Answer

A system to automatically block all deepfake content

Answer

A process to report deepfake content to law enforcement

Answer

Encryption of the video files to prevent tampering

Question 6

A company is adopting the EU AI Act's risk-based approach. They are classifying an AI system used for credit scoring. Which TWO risk tiers apply to credit scoring according to the Act?

Accepted Answer

High risk. Under the EU AI Act, credit scoring systems are classified as high risk because they determine access to financial resources and can significantly impact individuals' lives. This classification is based on the system's use in evaluating creditworthiness, which falls under Annex III's list of high-risk AI applications. Therefore, Option D is correct. The other options are not applicable: limited risk involves transparency obligations, minimal risk is for systems with little impact, general-purpose AI is a separate category, and unacceptable risk includes social scoring by governments.

Answer

Limited risk

Answer

Minimal risk

Answer

General purpose AI

Answer

Unacceptable risk

Question 7

A company is conducting a vendor AI assessment for a third-party natural language processing service. They need to ensure the vendor's AI governance practices align with their own. Which THREE areas should they evaluate?

Accepted Answer

The vendor's data handling and privacy practices. Data handling and privacy practices are a core component of AI governance, ensuring that the vendor's use of customer data complies with regulations like GDPR or CCPA and aligns with the company's own data protection policies. During a vendor AI assessment, evaluating how the vendor collects, stores, processes, and secures data is critical to mitigate risks of data breaches, unauthorized use, or non-compliance, which directly impacts trust and legal liability.

Answer

The vendor's model architecture and training framework

Answer

The vendor's marketing budget for AI services

Question 8

A healthcare AI startup is developing a model to predict patient readmission risk. The company wants to ensure the model's decisions can be understood by clinicians. Which explainability technique provides local, model-agnostic explanations by fitting a simple surrogate model around a prediction?

Accepted Answer

LIME. LIME (Local Interpretable Model-agnostic Explanations) is the correct technique because it generates local explanations by fitting a simple, interpretable surrogate model (e.g., linear regression or decision tree) around a specific prediction. It is model-agnostic, meaning it works with any black-box classifier, and it perturbs the input data near the instance of interest to understand which features most influenced the prediction.

Answer

SHAP values

Answer

Attention visualisation

Answer

Model cards

Question 9

A researcher is developing a generative AI model that creates realistic images. To comply with emerging transparency obligations, the researcher must ensure that AI-generated content can be identified as such. Which technique embeds a digital identifier directly into the content that survives compression and cropping?

Accepted Answer

Watermarking AI-generated content. Watermarking embeds a persistent digital identifier directly into the pixel data of an image, using techniques like spread-spectrum or discrete wavelet transform to survive common transformations such as JPEG compression and cropping. This makes it the correct technique for ensuring AI-generated content remains identifiable even after editing or distribution.

Answer

Model cards

Answer

Deepfake detection software

Answer

Disclosure statements in metadata

Question 10

A city government uses an AI system to allocate limited social services resources. To ensure fairness, they want to implement human oversight for high-stakes decisions. Which mechanism allows a human to review and potentially override the AI's decision before it is executed?

Accepted Answer

Human-in-the-loop. Human-in-the-loop (HITL) is the correct mechanism because it requires a human to review and approve or reject the AI's decision before it is executed. This ensures that for high-stakes decisions, such as allocating limited social services, a human can intervene to prevent unfair or erroneous outcomes, directly addressing the fairness requirement.

Answer

Human-on-the-loop

Answer

Human-in-command

Answer

Automated decision-making without human intervention

Question 11

A research lab is training a large language model and wants to minimize its environmental impact. Which THREE practices are most effective for reducing the carbon footprint of model training?

Accepted Answer

Apply model compression techniques like pruning and quantization. Model compression techniques like pruning and quantization directly reduce the computational requirements of training and inference. Pruning removes redundant weights, and quantization reduces the precision of weights (e.g., from 32-bit to 8-bit), which lowers the number of operations and memory bandwidth needed, thereby decreasing energy consumption and carbon emissions.

Answer

Extend the number of training epochs to ensure convergence

Answer

Increase the model size to achieve better accuracy faster

Question 12

A bank wants to ensure its credit scoring model is fair across demographic groups. The model currently uses features like zip code, income, and credit history. To mitigate potential bias, which TWO actions should the data science team prioritize?

Accepted Answer

Analyze the model for disparate impact using statistical tests. Analyzing the model for disparate impact using statistical tests (e.g., the 80% rule or chi-square test) directly measures whether the model produces systematically different outcomes for protected groups. This is a foundational step in fairness auditing, as it quantifies bias before any mitigation is applied, aligning with regulatory expectations like the Equal Credit Opportunity Act (ECOA).

Answer

Remove all features that could be correlated with protected attributes

Answer

Implement a fairness metric like demographic parity or equalized odds

Answer

Apply differential privacy to the training data

Question 13

A healthcare AI system uses patient data to predict disease risk. To comply with HIPAA, which privacy technique should be applied to the training data?

Accepted Answer

De-identification (Safe Harbor method). The Safe Harbor method of de-identification, as defined by the HIPAA Privacy Rule, removes 18 specific identifiers (e.g., names, dates, geographic subdivisions smaller than a state) from the training data. This ensures the data no longer qualifies as Protected Health Information (PHI), allowing it to be used for AI model training without violating HIPAA. Unlike other techniques, Safe Harbor provides a clear, legally safe harbor from privacy breach notification requirements when properly applied.

Answer

Differential privacy

Answer

Anonymisation

Answer

Pseudonymisation

Question 14

An AI team notices that their hiring model consistently selects male candidates over equally qualified female candidates. Analysis shows the training data contains past hiring decisions where men were predominantly hired. Which type of bias is the root cause?

Accepted Answer

Historical bias. Historical bias is the root cause because the training data reflects past hiring decisions that systematically favored male candidates, encoding societal or organizational prejudices into the model. The model learns these historical patterns and perpetuates them, leading to discriminatory outcomes against equally qualified female candidates. This is distinct from algorithmic bias, which would arise from the model's design or optimization process itself.

Answer

Algorithmic bias

Answer

Confirmation bias

Answer

Selection bias

Question 15

A hospital wants to train a diagnostic AI model using data from multiple hospitals without sharing raw patient data. Which privacy-preserving technique allows collaborative training while keeping data local?

Accepted Answer

Federated learning. Federated learning is the correct technique because it enables multiple hospitals to collaboratively train a shared diagnostic AI model without exchanging raw patient data. Instead, each hospital trains a local model on its own data, and only encrypted model updates (e.g., gradients or weights) are sent to a central server for aggregation. This keeps all sensitive patient information local, directly addressing the requirement of data locality while still benefiting from collective learning.

Answer

Differential privacy

Answer

Data anonymisation

Answer

Data pseudonymisation

Question 16

A company is developing an AI policy for internal use. According to corporate AI governance best practices, which TWO components are essential for the policy?

Accepted Answer

Establishment of an AI ethics board. An AI ethics board is essential because it provides independent oversight to ensure AI systems align with ethical principles, legal requirements, and corporate values. This board reviews high-risk AI use cases, approves ethical impact assessments, and enforces accountability, which is a core requirement of AI governance frameworks like the NIST AI Risk Management Framework.

Answer

Definition of roles and responsibilities for AI development

Answer

Vendor AI assessment procedures

Answer

Data minimization requirements

Question 17

A company wants to adopt green AI practices to reduce the environmental impact of training large models. Which TWO actions are most effective?

Accepted Answer

Use efficient model architectures (e.g., pruning, quantization). Using efficient model architectures (A) and energy-efficient hardware (E) directly reduce energy consumption. Using larger datasets (B) increases energy use. Training models on weekends (C) does not affect total energy consumption. Training models in the cloud (D) may offload energy costs to the provider but does not reduce total energy used.

Answer

Use larger datasets to improve accuracy

Answer

Train models only on weekends

Answer

Train models in the cloud to offload energy costs

Question 18

An insurance company uses a black-box deep learning model to set premiums. Regulators demand explanation for individual decisions. Which interpretability technique should the data science team apply to generate local explanations for each prediction?

Accepted Answer

LIME. LIME (Local Interpretable Model-agnostic Explanations) is the correct choice because it generates local, interpretable explanations for individual predictions by approximating the black-box model with a simpler, interpretable surrogate model around the specific instance. This directly meets the regulatory requirement for explaining why a particular premium was set for a specific customer, without needing access to the model's internal structure.

Answer

Attention visualization

Answer

Model cards

Answer

SHAP values

Question 19

A company is deploying a generative AI system that produces text content. To comply with emerging transparency obligations, which THREE measures should they implement?

Accepted Answer

Watermark AI-generated content. Watermarking AI-generated content (Option A) is correct because it embeds an imperceptible, machine-detectable signal into the output, enabling provenance verification. This directly addresses transparency obligations by allowing downstream systems to identify synthetic text, which is a key requirement in emerging AI regulations such as the EU AI Act.

Answer

Encrypt all training data

Answer

Limit model access to internal employees only

Question 20

A healthcare AI system uses patient data to predict disease risk. To comply with HIPAA and reduce the risk of re-identification, which technique should be applied to the training data before model development?

Accepted Answer

Differential privacy with a carefully chosen epsilon. Differential privacy (Option C) is the correct technique because it adds calibrated noise to the training data or model outputs, providing a mathematical guarantee against re-identification even if an attacker has auxiliary information. This directly addresses HIPAA's requirement to protect patient privacy while preserving statistical utility for disease risk prediction.

Answer

Pseudonymisation by replacing patient names with random IDs

Answer

Data augmentation to create synthetic samples

Answer

Data minimisation by removing all features except age and gender