AI Governance and Ethics practice questions

A SHAP summary plot showing mean absolute SHAP values across all features

Why wrong: Summary plots show global feature importance, not the explanation for a specific prediction.

A SHAP dependence plot for the top feature

Why wrong: Dependence plots show how a feature's value affects predictions across the dataset, not a single instance.

A SHAP bar chart of absolute feature importance

Why wrong: Bar charts show global importance but do not indicate direction or magnitude for a specific instance.

Confirmation bias

Why wrong: Confirmation bias is a human cognitive bias where one favours information confirming pre-existing beliefs, not a data bias.

Algorithmic bias

Why wrong: Algorithmic bias results from the model architecture or optimisation choices, not from biased training data.

Selection bias

Why wrong: Selection bias would involve a non-representative sample of the population, not the reflection of historical societal biases.

GDPR

Why wrong: GDPR applies to personal data of EU residents, but the scenario does not specify that the patients are in the EU.

CCPA

Why wrong: CCPA applies to California residents' personal information but is not specific to healthcare data.

EU AI Act

Why wrong: The EU AI Act governs the use of AI systems based on risk, but does not directly regulate healthcare data privacy.

A set of acceptable use cases for the AI

Why wrong: Use cases define scope but not accountability.

A description of the model architecture used

Why wrong: Technical details are useful but do not assign responsibility.

A list of approved training data sources

Why wrong: This covers data governance but not accountability for decisions.

A system to automatically block all deepfake content

Why wrong: Completely blocking deepfakes is technically challenging and may not be required; transparency focuses on disclosure.

A process to report deepfake content to law enforcement

Why wrong: Reporting is reactive and does not proactively inform users about the nature of the content.

Encryption of the video files to prevent tampering

Why wrong: Encryption protects content but does not disclose its origin.

Limited risk

Why wrong: Limited risk applies to systems with specific transparency obligations, such as chatbots.

Minimal risk

Why wrong: Minimal risk is a residual category for all other AI systems.

General purpose AI

Why wrong: General purpose AI is a separate category not directly tied to risk tiers.

Unacceptable risk

Why wrong: Unacceptable risk includes systems like social scoring by public authorities, not credit scoring.

The vendor's model architecture and training framework

Why wrong: While technical details can be useful, governance assessment focuses on policies and practices, not necessarily proprietary architecture.

The vendor's marketing budget for AI services

Why wrong: Marketing budget is unrelated to AI governance.

SHAP values

Why wrong: SHAP values provide local explanations based on Shapley values, but they are not surrogate models; they compute feature contributions directly.

Attention visualisation

Why wrong: Attention visualisation is used in transformer models but is not a general-purpose model-agnostic explainability technique.

Model cards

Why wrong: Model cards are transparency documentation, not a technique for explaining individual predictions.

Model cards

Why wrong: Model cards are documentation about the model, not a technique to mark generated content.

Deepfake detection software

Why wrong: Deepfake detection is a method to identify manipulated content after the fact, not a technique to embed identifiers during generation.

Disclosure statements in metadata

Why wrong: Metadata can be easily removed or stripped by users, making it an unreliable method for persistent identification.

Human-on-the-loop

Why wrong: Human-on-the-loop monitors system behavior and can intervene, but decisions are executed automatically unless intervention occurs.

Human-in-command

Why wrong: Human-in-command gives overall control to humans but does not require per-decision review.

Automated decision-making without human intervention

Why wrong: This lacks human oversight entirely, which is the opposite of what is desired.

Extend the number of training epochs to ensure convergence

Why wrong: More epochs increase total energy consumption.

Increase the model size to achieve better accuracy faster

Why wrong: Larger models require more computation and energy, not less.

Remove all features that could be correlated with protected attributes

Why wrong: Removing correlated features may reduce predictive performance and does not guarantee fairness due to proxies.

Implement a fairness metric like demographic parity or equalized odds

Why wrong: Implementing a metric is important, but the question asks for actions to mitigate bias; metric implementation alone does not modify the model or data.

Apply differential privacy to the training data

Why wrong: Differential privacy protects individual privacy but does not mitigate bias across groups.

Differential privacy

Why wrong: Differential privacy is a mathematical privacy guarantee but not a HIPAA-specific requirement.

Anonymisation

Why wrong: Anonymisation is broader; HIPAA's Safe Harbor specifically uses de-identification.

Pseudonymisation

Why wrong: Pseudonymisation is reversible and does not fully comply with HIPAA's de-identification standard.

Algorithmic bias

Why wrong: Algorithmic bias would stem from model design choices, not from the training data itself.

Confirmation bias

Why wrong: Confirmation bias is a human cognitive bias, not a data bias.

Selection bias

Why wrong: Selection bias results from a non-representative sample, not from historical inequalities in the data.

Differential privacy

Why wrong: Differential privacy adds noise to protect privacy but can be applied to the model update; it does not inherently keep data local.

Data anonymisation

Why wrong: Anonymisation removes identifiers but still requires sharing the dataset.

Data pseudonymisation

Why wrong: Pseudonymisation replaces identifiers but still shares data.

Definition of roles and responsibilities for AI development

Why wrong: While important, roles are often defined separately from the policy.

Vendor AI assessment procedures

Why wrong: Vendor assessment is part of procurement, not the internal AI policy.

Data minimization requirements

Why wrong: Data minimization is a privacy principle, not a core policy component.

Use larger datasets to improve accuracy

Why wrong: Larger datasets increase computational and energy demands.

Train models only on weekends

Why wrong: Timing does not reduce energy use.

Train models in the cloud to offload energy costs

Why wrong: Offloading does not reduce total energy consumption.

Attention visualization

Why wrong: Attention mechanisms are specific to transformer models and may not apply to other architectures.

Model cards

Why wrong: Model cards document overall model behavior, not individual predictions.

SHAP values

Why wrong: SHAP provides global and local feature importance based on game theory, but LIME is more commonly used for local explanations.

Encrypt all training data

Why wrong: Encryption is a security measure, not a transparency obligation.

Limit model access to internal employees only

Why wrong: Access control is about security and privacy, not transparency.

Pseudonymisation by replacing patient names with random IDs

Why wrong: Pseudonymisation is reversible and can be combined with other data to re-identify individuals; it does not satisfy HIPAA's de-identification requirements.

Data augmentation to create synthetic samples

Why wrong: Synthetic data can still leak information from the original data and does not provide formal privacy guarantees.

Data minimisation by removing all features except age and gender

Why wrong: Removing features may still allow re-identification and does not provide formal privacy guarantees required by HIPAA.