I85PREP
⌘ K
EXIN AI Compliance Professional study materials
EXIN AI Compliance Professional study resources

EXIN AI Compliance Professional practice questions

One question at a time. Build your EXIN AI Compliance Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AI compliance fundamentals

In AI compliance terminology, what does the term 'AI system' most precisely refer to when scoping an organization's obligations?

  1. A machine-based system that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions Correct answer.
  2. A physical robot that interacts with humans in a workplace environment
  3. Only machine-learning models trained on personal data within the organization
  4. Any software program that contains a conditional statement or rule-based logic

Explanation

AI compliance frameworks define an AI system by its capacity to infer from inputs and produce outputs like predictions, content, recommendations, or decisions, operating with varying levels of autonomy. This definition is deliberately broader than rule-based software or physical robotics, so scoping exercises must not be limited to machine-learning models or tangible devices.

Question 2AI compliance fundamentals

What is the primary purpose of a risk-based approach in AI compliance?

  1. To shift all liability for AI outcomes onto the end user of the system
  2. To calibrate obligations and controls according to the likelihood and severity of harm an AI system may cause Correct answer.
  3. To ban all AI systems until regulators approve each deployment individually
  4. To ensure every AI system receives an identical set of documentation requirements

Explanation

A risk-based approach scales compliance effort to the level of risk: higher-risk uses attract stricter obligations such as conformity assessment and documentation, while minimal-risk uses face lighter transparency duties. It is a proportionality principle, not a blanket prohibition or a uniform checklist.

Question 3AI compliance fundamentals

Which practice is typically classified as a prohibited AI practice under modern AI regulation?

  1. Using AI to summarize internal meeting notes for staff
  2. Using machine learning to forecast inventory demand in a warehouse
  3. Social scoring of individuals by public authorities leading to detrimental treatment in unrelated contexts Correct answer.
  4. Deploying a chatbot that answers customer questions about product warranties

Explanation

Social scoring by public authorities, where generalized scores lead to detrimental treatment in unrelated social contexts, is a paradigm example of a prohibited practice because it is considered an unacceptable risk to fundamental rights. The other examples are ordinary business applications subject to transparency or general safety duties rather than prohibition.

Question 4AI compliance fundamentals

In AI governance, what distinguishes a 'provider' from a 'deployer' of an AI system?

  1. A provider is always a public authority, while a deployer is always a private company
  2. A provider only operates the system internally, while a deployer places it on the market
  3. A provider develops or places the system on the market under its own name, while a deployer uses the system in the course of its activities Correct answer.
  4. A provider owns the training data, while a deployer owns the model weights

Explanation

The provider is the entity that develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark. The deployer is the entity that uses the system in a professional capacity, and the two roles carry different obligation sets.

Question 5AI compliance fundamentals

What does 'human oversight' require in the context of high-risk AI systems?

  1. Human oversight is satisfied by publishing a disclaimer that outputs may be inaccurate
  2. A human must manually approve every single output the system generates before it is shown to anyone
  3. Measures enabling humans to understand, monitor, intervene in, and where necessary stop the system's operation Correct answer.
  4. A human must retrain the model after each production incident without exception

Explanation

Human oversight means designing and implementing measures that let responsible people understand the system's capabilities and limits, monitor its operation, interpret outputs, and intervene or halt it when needed. It is about effective control, not about approving each individual output or shifting responsibility through disclaimers.

Question 6AI compliance fundamentals

Which statement best describes the role of a conformity assessment for a high-risk AI system?

  1. It is a tax filing submitted to the finance authority after deployment begins
  2. It is an optional customer survey collected after the system has been withdrawn
  3. It is a marketing certification that any vendor may self-issue without evidence
  4. It is a verification process demonstrating that the system meets the applicable legal requirements before it is placed on the market Correct answer.

Explanation

Conformity assessment is the structured process by which a provider demonstrates, through documentation and testing, that a high-risk AI system satisfies the required obligations before market placement. It is evidence-based and precedes deployment rather than following it.

Question 7AI compliance fundamentals

What is the purpose of an AI literacy obligation in an organization?

  1. To guarantee that AI systems never produce incorrect outputs
  2. To ensure staff who deal with AI systems have sufficient knowledge to use them responsibly and understand their risks Correct answer.
  3. To certify that only engineers with university degrees may touch AI tools
  4. To require every employee to pass a government licensing examination

Explanation

AI literacy obligations require organizations to take measures so that staff involved in operating and using AI systems understand their capabilities, limitations, and risks well enough to act responsibly. The goal is informed, responsible use across relevant roles, not formal credentialing or a guarantee of perfect outputs.

Question 8AI compliance fundamentals

Which item is a core component of an AI compliance management system?

  1. A policy that all AI decisions are final and cannot be appealed
  2. A rule that compliance records are destroyed after thirty days
  3. A requirement that only external auditors may access system documentation
  4. A documented inventory of AI systems with assigned risk classifications and owners Correct answer.

Explanation

An AI system inventory with risk classification and accountable owners is foundational because obligations, controls, and monitoring all attach to identified systems and their risk levels. Without an inventory, an organization cannot scope its duties or demonstrate oversight.

Question 9AI compliance fundamentals

A company wants to deploy an AI tool that infers employees' emotional states from voice recordings during meetings. Under a risk-based AI framework, how should compliance classify this use?

  1. As a prohibited practice in workplace contexts because emotion recognition of employees is generally banned Correct answer.
  2. As a minimal-risk productivity tool requiring no specific measures
  3. As a fully unregulated use because it involves no personal data
  4. As a low-risk use that only requires a privacy notice in the staff handbook

Explanation

Emotion recognition in the workplace and in education is generally treated as a prohibited practice because of the power imbalance and the intrusive nature of inferring emotional states. The prohibition applies regardless of whether the tool is marketed as productivity software.

Question 10AI compliance fundamentals

A provider substantially modifies a high-risk AI system already on the market, changing its intended purpose. What is the compliance consequence?

  1. The modification requires only an internal email to the quality team
  2. The system must be withdrawn from the market with no further assessment possible
  3. The original conformity assessment automatically covers the new purpose
  4. The modification is treated as a new placing on the market, so the provider must reassess conformity for the changed purpose Correct answer.

Explanation

A substantial modification that changes a system's intended purpose effectively creates a new product for regulatory purposes, so the provider must re-run the conformity assessment against the new intended use. Prior approvals do not automatically extend to materially different purposes.

Question 11AI compliance fundamentals

A bank uses a third-party AI credit-scoring model. Which statement best reflects its compliance responsibilities as a deployer?

  1. The bank's only duty is to negotiate a discount on the licence fee
  2. The bank must retrain the vendor's model on its own data before any use
  3. The bank must ensure the system is used per the provider's instructions and monitor for risks arising in its own context Correct answer.
  4. The bank bears no responsibility because the model was built by a vendor

Explanation

Deployers of high-risk systems must use the system in accordance with the provider's instructions and keep their own monitoring and oversight in place, since risks can emerge from the deployment context. Being a customer of a vendor does not remove the deployer's duties.

Question 12AI compliance fundamentals

Which measure most directly supports the data governance requirement for a high-risk AI system?

  1. Examining training datasets for bias and representativeness, and documenting their provenance and preparation Correct answer.
  2. Publishing the model's source code on a public repository
  3. Limiting system access to the compliance department only
  4. Encrypting the model's API keys and rotating them quarterly

Explanation

Data governance for high-risk AI focuses on the quality of training, validation, and testing datasets, including examination for biases, appropriate representativeness, and documented provenance. Security controls and code publication address different concerns.

Question 13AI compliance fundamentals

What must a technical documentation package for a high-risk AI system typically enable a regulator to do?

  1. Review the provider's marketing campaign performance metrics
  2. Confirm that the provider's staff hold professional engineering licences
  3. Verify the provider's quarterly revenue and tax position
  4. Assess the system's intended purpose, design, risk management, and conformity with obligations Correct answer.

Explanation

Technical documentation exists so that authorities can evaluate whether the system's design, risk management, data handling, and testing demonstrate conformity with the applicable requirements. It is a compliance evidence file, not a financial or marketing disclosure.

Question 14AI compliance fundamentals

An AI system used to screen job applicants is generally considered high-risk. Which obligation is most directly tied to that classification?

  1. The provider must obtain a patent for the screening algorithm before deployment
  2. The provider must publish the full training dataset under an open licence
  3. The deployer must guarantee that the system selects at least one candidate per vacancy
  4. The deployer must provide candidates with information about the system's use and enable human review of adverse decisions Correct answer.

Explanation

Employment screening is high-risk because it materially affects access to livelihoods, so transparency toward candidates and meaningful human review of adverse outcomes are core safeguards. Patenting, open data publication, and outcome quotas are not obligations that flow from the risk classification.

Question 15AI compliance fundamentals

Which element is essential for the transparency obligation toward users of an AI system that interacts directly with them?

  1. Requiring users to sign a waiver of all legal rights before chatting
  2. Informing users that they are interacting with an AI system, unless this is obvious from the circumstances Correct answer.
  3. Displaying the model's full parameter count on the login screen
  4. Concealing the AI nature of the system to preserve user engagement

Explanation

Transparency duties require that people are made aware they are interacting with an AI system, unless it is evident from the context to a reasonably informed person. The obligation is about informed interaction, not technical disclosure of model internals.

Question 16AI compliance fundamentals

How does a fundamental rights impact assessment differ from a general AI risk assessment?

  1. It is a one-time financial audit of the AI project budget
  2. It replaces the need for any technical testing of the model
  3. It is only performed for AI systems that process no personal data
  4. It focuses specifically on how the system affects individuals' rights such as privacy, non-discrimination, and access to services Correct answer.

Explanation

A fundamental rights impact assessment examines the effects of a system on people's rights and freedoms, including discrimination, privacy, and access to essential services, and is often required for high-risk public-sector or essential-service deployments. It complements rather than replaces technical risk assessment.

Question 17AI compliance fundamentals

A provider markets a general-purpose AI model. Which compliance concern is most characteristic of this category compared with a narrow task-specific system?

  1. Documentation of training data and known limitations that downstream integrators will need for their own assessments Correct answer.
  2. Ensuring the model can only answer questions about a single product line
  3. Guaranteeing that no downstream user will ever apply the model in a high-risk context
  4. Removing all safety filters to maximize flexibility for integrators

Explanation

General-purpose models can be adapted to many downstream uses, so the provider must supply information about training data, capabilities, and known limitations that integrators need to assess their own applications. The provider cannot guarantee how every downstream user will deploy the model.

Question 18AI compliance fundamentals

What is the function of post-market monitoring for an AI system?

  1. To confirm that no user will ever file a complaint about the system
  2. To verify the provider's share price after the launch announcement
  3. To collect and analyze performance and incident data after deployment so that emerging risks can be addressed Correct answer.
  4. To replace the pre-deployment conformity assessment with a retrospective review

Explanation

Post-market monitoring is a continuous process of gathering and analyzing data on how the system performs in real use, detecting drift or incidents, and feeding that back into risk management. It supplements, rather than substitutes for, pre-market assessment.

Question 19AI compliance fundamentals

An organization discovers that its deployed high-risk AI system has caused a serious incident affecting users. What is the most appropriate compliance action?

  1. Report the incident to the relevant authority within the required timeframe and investigate the cause Correct answer.
  2. Quietly patch the system and omit the incident from internal records
  3. Delete the logs to reduce storage costs and reputational exposure
  4. Wait for a user to sue before taking any action

Explanation

Serious incidents involving high-risk systems trigger reporting duties to the competent authority within prescribed deadlines, alongside internal investigation and corrective action. Concealment or log deletion obstructs both regulatory oversight and the organization's own remediation.

Question 20AI compliance fundamentals

Which statement correctly describes the relationship between AI compliance and data protection law?

  1. The two regimes never interact because AI law concerns only technical documentation
  2. Data protection law applies only to systems that make automated decisions with no human involvement
  3. They overlap where AI systems process personal data, but AI compliance also covers non-data risks such as safety and oversight Correct answer.
  4. AI compliance fully replaces data protection obligations once a system is classified as high-risk

Explanation

AI compliance and data protection are overlapping but distinct regimes: data protection governs personal data processing, while AI rules also address safety, transparency, human oversight, and systemic risks. Organizations must satisfy both where they apply.

Question 21AI compliance fundamentals

A public authority plans to use an AI system to evaluate citizens' eligibility for social benefits. Which combination of compliance measures is most appropriate?

  1. A marketing review to ensure the system's branding appeals to citizens
  2. A fundamental rights impact assessment, human review of adverse decisions, and registration or notification as required Correct answer.
  3. A clause transferring all responsibility for errors to the software vendor
  4. An exemption from transparency because the authority is a public body

Explanation

AI used to determine access to essential public benefits is high-risk, so a fundamental rights impact assessment, meaningful human review of adverse decisions, and any required registration or notification are the appropriate measures. Public status does not exempt an authority from transparency or accountability.

Question 22AI compliance fundamentals

A vendor argues that because its AI system is 'open source', it is exempt from AI compliance obligations. How should a compliance professional evaluate this claim?

  1. Open-source software is automatically classified as minimal risk regardless of use
  2. Open-source status provides a complete exemption from all AI obligations
  3. Open-source models may not be used in high-risk contexts under any circumstances
  4. Open-source release may affect certain documentation duties but does not remove obligations such as risk management and transparency where the system is high-risk Correct answer.

Explanation

Open-source distribution can modify some obligations, for example by shifting certain documentation duties toward downstream providers, but it does not create a general exemption. Where a system is high-risk in its intended use, core duties such as risk management and transparency continue to apply.

Question 23AI compliance fundamentals

An AI system's performance degrades over time because real-world data drifts from the training distribution. Which compliance control most directly addresses this?

  1. Removing performance metrics from dashboards to avoid misleading reports
  2. Extending the licence term of the underlying software platform
  3. Ongoing accuracy monitoring with defined thresholds and retraining or rollback procedures Correct answer.
  4. Increasing the marketing budget to offset declining user satisfaction

Explanation

Model drift is a known lifecycle risk, so compliance requires continuous monitoring of accuracy and other performance indicators, with pre-defined thresholds and procedures for retraining, adjustment, or rollback. Hiding metrics or ignoring drift undermines the provider's risk management obligations.

Question 24AI compliance fundamentals

A provider wants to rely on a harmonized standard to demonstrate conformity for a high-risk AI system. What is the correct understanding of its legal effect?

  1. Applying the standard guarantees immunity from all regulatory enforcement action
  2. Standards are legally binding only on deployers and never on providers
  3. Applying the standard creates a presumption of conformity with the requirements it covers, while the provider remains responsible for overall compliance Correct answer.
  4. Standards may be used only after a serious incident has already occurred

Explanation

Harmonized standards give a presumption of conformity with the specific requirements they address, which eases the conformity assessment, but the provider still bears responsibility for the system's overall compliance. Standards are voluntary tools that support, not replace, legal accountability.

Question 25AI compliance fundamentals

Which situation best illustrates a conflict between an AI system's explainability and its accuracy, requiring a documented compliance trade-off?

  1. A model's documentation is translated into three languages for international staff
  2. A complex ensemble model is more accurate but its decisions cannot be meaningfully explained to affected individuals who request reasons Correct answer.
  3. A provider reduces inference costs by batching requests overnight
  4. A simple rule-based system is easy to explain and equally accurate on all datasets

Explanation

Compliance often requires balancing predictive performance against the ability to give meaningful explanations to affected people, and such trade-offs must be documented and justified in light of the system's risk level and context. The other options describe routine operational or documentation choices without a substantive rights trade-off.

Question 26AI compliance fundamentals

In AI compliance terminology, what distinguishes a 'provider' from a 'deployer' of an AI system?

  1. A provider is always a public authority, while a deployer is always a private company
  2. A provider develops or places the system on the market under its own name, while a deployer uses it in its own operations Correct answer.
  3. A provider only supplies training data, while a deployer builds the model architecture
  4. A provider is the end user of the output, while a deployer is the entity that certifies the system

Explanation

The provider is the natural or legal person that develops an AI system or has one developed and places it on the market or puts it into service under its own name or trademark. The deployer is the entity that uses the system in the course of its professional activity. This allocation of roles determines which obligations attach to each party.

Question 27AI compliance fundamentals

Which category of AI practice is generally prohibited outright rather than merely subject to strict conditions?

  1. AI-assisted recruitment screening for senior management roles
  2. Real-time biometric identification used for border control
  3. Social scoring of individuals by public authorities leading to detrimental treatment unrelated to the context of data collection Correct answer.
  4. Emotion recognition in workplace settings with prior employee consent

Explanation

Certain practices are banned because they are considered an unacceptable risk, and general social scoring by public authorities that leads to detrimental or unfavourable treatment in unrelated contexts is one of them. Prohibitions do not depend on consent or on safeguards because the practice itself is deemed unacceptable. Other uses may be high-risk and permitted only with compliance measures.

Question 28AI compliance fundamentals

What is the primary function of a risk management system for a high-risk AI system?

  1. A one-time document produced only at the moment of market entry
  2. A financial audit of the provider's investment in AI research
  3. A marketing plan describing the intended customer segments
  4. A continuous, iterative process of identifying, evaluating, and mitigating risks across the system's lifecycle Correct answer.

Explanation

Risk management for high-risk AI is conceived as a continuous iterative process that runs throughout the lifecycle and is updated as the system and its context evolve. It requires identification of known and foreseeable risks and adoption of targeted mitigation measures. Treating it as a single document at launch misses the lifecycle dimension.

Question 29AI compliance fundamentals

Which statement best captures the purpose of the technical documentation required for a high-risk AI system?

  1. It demonstrates compliance and gives authorities the information needed to assess conformity Correct answer.
  2. It records the commercial price negotiated with each customer
  3. It serves as the user manual for the general public
  4. It replaces the need for any testing or validation of the system

Explanation

Technical documentation is meant to demonstrate that the high-risk system meets the applicable requirements and to provide national competent authorities with the information necessary to assess conformity. It is kept up to date and drawn up before the system is placed on the market. It complements, rather than replaces, testing and validation.

Question 30AI compliance fundamentals

What does 'human oversight' require for a high-risk AI system?

  1. That every individual decision is made manually without any AI support
  2. That users are shown the full source code of the model
  3. Measures enabling natural persons to monitor, intervene in, and, where needed, override the system's operation Correct answer.
  4. That oversight is performed only by the provider's external auditor

Explanation

Human oversight is designed so that natural persons can effectively monitor the system, understand its capabilities and limitations, and intervene or stop it when necessary. It is about meaningful control rather than abolishing automation. Oversight measures must be built into the system and supported by the deployer's organisational arrangements.

Question 31AI compliance fundamentals

Which description fits an AI system that qualifies as 'general-purpose'?

  1. A system restricted by design to a single narrow task with no reuse potential
  2. A system that is used exclusively by one deployer for internal payroll processing
  3. A model trained on broad data that can perform a wide range of tasks and be adapted to many downstream uses Correct answer.
  4. A system whose only function is to store and retrieve documents without any inference

Explanation

General-purpose AI models are characterised by their ability to perform a wide variety of distinct tasks and to be integrated into many downstream systems. Their breadth of capability is what distinguishes them from narrowly scoped AI systems. This breadth drives distinct transparency and documentation concerns.

Question 32AI compliance fundamentals

What is the main purpose of registering a high-risk AI system in a public EU database before placing it on the market?

  1. To transfer liability for the system from the provider to the deployer
  2. To obtain a patent for the underlying algorithm
  3. To provide transparency about the system and support supervision by authorities and the public Correct answer.
  4. To certify that the system has no residual risks

Explanation

Registration in the public database supports transparency and enables authorities, deployers, and affected persons to understand which high-risk systems are on the market. It is an information and supervision tool, not a grant of intellectual property or a liability transfer. Registration does not certify the absence of risk.

Question 33AI compliance fundamentals

What does the AI literacy obligation require of organisations?

  1. Taking measures to ensure staff dealing with AI have sufficient understanding of the technology and its risks Correct answer.
  2. Publishing the organisation's internal AI source code on its website
  3. Requiring every employee to obtain a university degree in computer science
  4. Replacing human staff with AI in all decision-making roles

Explanation

AI literacy obligations require organisations to take measures so that persons dealing with AI systems on their behalf have sufficient knowledge and understanding of the systems and their risks. The depth of literacy should be proportionate to the context and the person's role. It is not a formal degree requirement.

Question 34AI compliance fundamentals

A company wants to introduce an AI tool that draws on multiple data sources to rank job candidates. Before deployment, which step best reflects a compliance-first approach?

  1. Classify the system's risk level and map the resulting obligations to the provider and the company as deployer Correct answer.
  2. Assume that because the tool is a commercial product, all compliance duties rest with the vendor
  3. Rely on the vendor's marketing claims as sufficient evidence of conformity
  4. Deploy the tool immediately and evaluate compliance only if a complaint is filed

Explanation

A compliance-first approach begins with classifying the system against the risk categories and then mapping obligations to each actor. Recruitment and candidate ranking are typically high-risk uses, which triggers duties for both provider and deployer. Vendor assurances inform but do not replace the deployer's own due diligence.

Question 35AI compliance fundamentals

A hospital deploys a high-risk AI triage system purchased from a vendor. Which obligation falls most directly on the hospital as deployer?

  1. Assigning competent human oversight and monitoring the system's operation in its clinical context Correct answer.
  2. Performing the conformity assessment and affixing the CE marking
  3. Designing the model's training architecture
  4. Drafting the technical documentation package for the vendor's model

Explanation

Deployers of high-risk systems must use the system in accordance with the instructions for use, assign human oversight, and monitor operation, informing the provider of relevant findings. Drafting technical documentation, conducting conformity assessment, and designing the model are provider responsibilities. The deployer's duties focus on operational use and vigilance.

Question 36AI compliance fundamentals

An organisation is unsure whether its AI feature falls within a prohibited practice. What is the most defensible compliance action?

  1. Delegate the decision entirely to the engineering team that built the feature
  2. Document a reasoned assessment against the prohibition criteria and pause deployment pending resolution Correct answer.
  3. Wait until a regulator issues a formal enforcement notice before reviewing the feature
  4. Proceed with deployment because the feature is small in scope

Explanation

When a practice may fall within a prohibition, the prudent step is a documented assessment against the legal criteria, with deployment paused until the question is resolved. Prohibitions are not scaled by the size of the feature. Waiting for enforcement exposes the organisation to significant legal risk.

Question 37AI compliance fundamentals

A provider updates a high-risk AI system's model weights after market entry in a way that affects its behaviour. How should this be handled under change-management principles?

  1. Treat any update as automatically exempt from documentation
  2. Assess whether the change is substantial and, if so, re-run the relevant conformity steps before release Correct answer.
  3. Release the update silently because the system was already certified once
  4. Delay all documentation until the next scheduled external audit

Explanation

Change management for AI requires assessing whether a modification is substantial enough to affect compliance, and substantial changes trigger renewed conformity assessment and documentation updates. Silent release of behaviour-altering updates undermines the initial conformity basis. Documentation should be maintained continuously, not deferred.

Question 38AI compliance fundamentals

What is the role of a notified body in the AI compliance framework?

  1. A government ministry that writes the AI legislation
  2. An independent conformity assessment body that evaluates certain high-risk systems where third-party assessment is required Correct answer.
  3. A consumer association that files complaints about AI products
  4. An internal department of the provider that approves its own systems

Explanation

Notified bodies are independent organisations designated to carry out third-party conformity assessment for certain high-risk AI systems. They provide external verification where the framework requires it, complementing the provider's internal assessment. They do not legislate or act as the provider's own approval function.

Question 39AI compliance fundamentals

A deployer of a high-risk AI system finds that the system's instructions for use do not explain how to interpret its confidence scores. What is the most appropriate response?

  1. Ignore the gap because interpretation is the deployer's own responsibility
  2. Modify the model to add its own explanation layer without informing the provider
  3. Continue use unchanged and rely on staff intuition
  4. Raise the gap with the provider and document interim safeguards until clarified Correct answer.

Explanation

Deployers must use high-risk systems according to the instructions for use, and where those instructions are inadequate they should seek clarification from the provider while documenting interim safeguards. Unilateral model modification can shift roles and liabilities. Relying on intuition is not a controlled mitigation.

Question 40AI compliance fundamentals

Which practice best supports the data governance requirement for training, validation, and testing datasets?

  1. Removing all documentation about data processing to protect trade secrets
  2. Using data from any available source without recording its origin
  3. Maximising dataset size regardless of relevance or provenance
  4. Examining datasets for biases and errors and applying appropriate mitigation measures Correct answer.

Explanation

Data governance for high-risk AI requires that datasets be relevant, sufficiently representative, and examined for possible biases and errors, with mitigation applied. Provenance and processing must be documented. Volume alone does not ensure quality or lawfulness.

Question 41AI compliance fundamentals

A provider claims its high-risk AI system 'learns on the job' and therefore cannot have fixed accuracy metrics. How should a compliance professional respond?

  1. Demand that the system be frozen permanently with no updates
  2. Accept the claim and waive all performance documentation
  3. Rely solely on user satisfaction surveys as the accuracy evidence
  4. Require declared accuracy, robustness, and cybersecurity metrics with testing appropriate to the system's intended purpose Correct answer.

Explanation

Even adaptive systems must declare the metrics used to measure accuracy, robustness, and cybersecurity, and be tested against them for the intended purpose. Adaptability is a design choice that must be documented and controlled, not a reason to omit performance evidence. Surveys are not a substitute for technical metrics.

Question 42AI compliance fundamentals

Why does the AI compliance framework require logging capabilities for high-risk AI systems?

  1. To allow the provider to monitor competitors' systems
  2. To enable traceability of the system's operation and support post-market monitoring and incident investigation Correct answer.
  3. To replace the need for human oversight
  4. To collect marketing data about users' preferences

Explanation

Automatic logging supports traceability over the system's lifetime, which is essential for post-market monitoring, incident investigation, and demonstrating compliance. Logs are a technical record of operation, not a marketing tool. They support, but do not replace, human oversight.

Question 43AI compliance fundamentals

A public body plans to use an AI system to prioritise inspections of businesses. Which analysis is most relevant before deployment?

  1. An assessment of the aesthetic quality of the user interface
  2. A purely financial cost-benefit analysis of the software licence
  3. A review of the vendor's stock price and market share
  4. A fundamental rights impact assessment covering affected persons and mitigation measures Correct answer.

Explanation

Public bodies deploying high-risk AI in areas affecting people's rights should assess impacts on fundamental rights, including affected groups and mitigation measures. Financial or commercial analyses do not address rights impacts. The assessment should be documented and used to shape safeguards.

Question 44AI compliance fundamentals

An AI system's outputs are used to deny services, and affected persons cannot obtain an explanation of individual decisions. Which compliance concern is most directly engaged?

  1. The energy consumption of the data centre
  2. Cybersecurity of the model's training servers
  3. Transparency and the provision of meaningful information to affected persons about the system's role in decisions Correct answer.
  4. The choice of programming language used to build the interface

Explanation

When AI outputs affect individuals' access to services, transparency obligations require that affected persons receive meaningful information about the system's role and the logic involved, subject to applicable law. This supports contestability and accountability. Infrastructure and implementation details are separate matters.

Question 45AI compliance fundamentals

A provider discovers that a deployed high-risk AI system has a serious malfunction posing a risk to health. What is the appropriate immediate action?

  1. Continue operation and wait for the next scheduled conformity review
  2. Inform the relevant authorities and deployers, investigate, and take corrective action such as recall or withdrawal Correct answer.
  3. Blame the deployer publicly and take no further action
  4. Delete the logs to avoid reputational damage

Explanation

Serious incidents and malfunctions trigger obligations to inform the relevant authorities and affected deployers, investigate the cause, and take corrective measures, which may include withdrawal or recall. Logs must be preserved to support investigation. Inaction or concealment aggravates liability.

Question 46AI compliance fundamentals

How should a compliance professional treat the relationship between AI compliance and existing data protection rules?

  1. As fully interchangeable, so satisfying one automatically satisfies the other
  2. As mutually exclusive, so AI compliance overrides data protection
  3. As irrelevant to each other, so no coordination is needed
  4. As complementary regimes that both apply, with data protection governing personal data processing and AI rules adding system-level duties Correct answer.

Explanation

AI compliance and data protection are complementary: data protection law governs the processing of personal data, while AI rules add obligations such as risk management, documentation, and oversight. Compliance with one does not automatically satisfy the other. Coordinating both avoids gaps in accountability.

Question 47AI compliance fundamentals

An organisation is deciding whether to use remote biometric identification in a publicly accessible space for security. Which factor is most decisive under the AI compliance framework?

  1. Whether the vendor offers a discount for bulk licences
  2. Whether the specific use falls within a narrowly permitted purpose subject to strict legal conditions and authorisation Correct answer.
  3. Whether the security staff prefer the technology
  4. Whether the cameras are modern and high-resolution

Explanation

Remote biometric identification in publicly accessible spaces is heavily restricted and permitted only for narrowly defined purposes under strict conditions, often requiring prior authorisation. Technical quality, pricing, and staff preference do not determine legality. The decisive question is whether the use fits a permitted purpose and its conditions.

Question 48AI compliance fundamentals

A vendor asserts that its general-purpose AI model needs no documentation because it is not itself a high-risk system. How should a compliance professional assess this?

  1. The assertion is correct because models are not covered by AI rules at all
  2. The assertion is correct because only high-risk systems ever have duties
  3. The assertion is correct provided the model is offered for free
  4. General-purpose models carry their own transparency and documentation duties, and downstream high-risk integration adds further obligations Correct answer.

Explanation

General-purpose AI models have dedicated obligations, including technical documentation, information for downstream providers, and, for models with systemic risk, additional assessment and reporting duties. The fact that a model is not itself a high-risk system does not remove these duties. When integrated into high-risk systems, further obligations apply downstream.

Question 49AI compliance fundamentals

A provider relies on a harmonised standard to demonstrate conformity of a high-risk AI system. What is the correct understanding of that reliance?

  1. Compliance with a harmonised standard creates a presumption of conformity with the requirements it covers, while the provider retains overall responsibility Correct answer.
  2. Any standard, harmonised or not, automatically guarantees full legal compliance
  3. The standard replaces the need for any risk management or documentation
  4. Using the standard transfers legal responsibility for conformity to the standards body

Explanation

Compliance with a harmonised standard gives a presumption of conformity with the requirements it covers, but the provider remains responsible for the system's overall conformity. Standards do not shift liability to the standards body. Risk management and documentation remain necessary regardless.

Question 50AI compliance fundamentals

A deployer learns that a high-risk AI system it uses is being operated outside the conditions described in its instructions for use. What is the most defensible course of action?

  1. Continue because the deployer did not design the system
  2. Quietly adjust the outputs to hide the deviation
  3. Stop the out-of-scope use, notify the provider, and reassess whether the deployment now requires different compliance treatment Correct answer.
  4. Assume the provider will absorb any liability for the deviation

Explanation

Deployers must use high-risk systems in line with the instructions for use, so operating outside them should be halted and raised with the provider. Such deviation may also change the compliance analysis, for example by altering the intended purpose. Concealment or reliance on the provider does not remove the deployer's own responsibility.