EXIN BCS Gen AI Award cheat sheet

Generative AI is a subset of machine learning that produces new content (text, images, audio, code) by modelling the probability distribution of training data rather than classifying or ranking existing records.

Transformer architecture underpins most modern generative models; self-attention lets each token weigh every other token in context, enabling long-range dependencies that recurrent networks handled poorly.

Large language models are trained in stages: self-supervised pre-training on large corpora, then supervised fine-tuning, then preference alignment such as RLHF or DPO.

A token is the model's atomic unit, roughly 3-4 English characters; context window size is measured in tokens and bounds how much input plus output the model can hold at once.

Sampling controls: temperature scales logits (low = deterministic, high = diverse); top-p (nucleus) truncates to a cumulative probability mass; top-k keeps the k most likely tokens.

Embeddings map tokens or documents to dense vectors; semantic similarity is measured by cosine distance, which is the basis of retrieval-augmented generation.

Parameters are learned weights; model scale (parameter count), training data quality and compute are the main determinants of capability, not architecture alone.

Hallucination is fluent output that is not grounded in fact; it arises because the model optimises plausibility of the next token, not truth.

Reliable strengths: summarisation, reformatting, translation, drafting, classification, extraction from supplied text, and code scaffolding.

Unreliable without external checking: arithmetic, current events, citations, legal or medical specifics, and anything absent from training data.

Knowledge cutoff: the model has no awareness of events after training; any time-sensitive claim needs retrieval or tool access.

Context window limits cause truncation or 'lost in the middle' recall failures; place critical instructions at the start and end of long prompts.

Determinism is not guaranteed: identical prompts can yield different outputs because of sampling; set temperature to 0 for maximum repeatability, not guaranteed identity.

Sycophancy: models tend to agree with a user's stated position, so leading questions bias answers; neutral phrasing improves accuracy.

Data leakage risk: pasting confidential material into a public consumer tool may expose it, since inputs can be retained or used for training.

Multimodal models accept images or audio but can misread charts, small text and spatial relations; verify extracted figures against the source.

Core prompt components: role, task, context, input data, constraints, output format, and examples; missing format specification is the most common cause of unusable output.

Few-shot prompting supplies 2-5 worked examples; examples must be consistent in format, since the model copies their pattern including any errors.

Chain-of-thought ('reason step by step') improves multi-step reasoning on reasoning-capable models; on some newer models explicit CoT can be redundant or harmful.

Retrieval-augmented generation grounds answers in supplied documents and reduces hallucination; instruct the model to answer only from the provided context and to say when the answer is absent.

Decomposition splits a complex task into sequential prompts, each verified before the next; it beats one giant prompt for multi-stage workflows.

Output schemas (JSON with named fields, or a table) make responses machine-parseable and easier to validate programmatically.

Iterate empirically: change one variable at a time, keep a test set of representative inputs, and compare outputs against a rubric rather than judging single samples.

Prompt injection: untrusted text inside retrieved or pasted content can override instructions; treat model output as untrusted input and sandbox tool permissions.

EU AI Act risk tiers: unacceptable (banned), high-risk (conformity assessment, documentation), limited-risk (transparency duties such as disclosing AI interaction), minimal-risk (no added obligations).

GDPR applies to personal data in prompts and outputs: lawful basis, data minimisation, purpose limitation, and the right to erasure all apply to model inputs.

Copyright: outputs may reproduce training text; purely AI-generated works may lack human authorship protection in several jurisdictions, including the US.

Bias originates in training data and is amplified by optimisation; mitigation includes diverse data, evaluation across subgroups, and human review of high-impact decisions.

Security threats: prompt injection, training-data poisoning, model inversion and membership inference, plus insecure output handling (e.g. executing model-generated code).

Human oversight is required for consequential decisions; the model is a decision-support tool and accountability stays with the deploying organisation.

Transparency duties: disclose AI-generated content where required, label synthetic media, and maintain records of model purpose, data sources and evaluation.

Data protection by design: redact or pseudonymise personal data before sending to third-party models, and check whether the provider trains on submitted data.

Value cases cluster into cost reduction (drafting, summarisation, support triage), revenue (personalisation, faster product discovery) and quality (consistency, 24/7 availability).

Build-vs-buy decision: hosted API for speed and low fixed cost; fine-tuned or self-hosted open models for data residency, latency or unit-cost at high volume.

ROI is estimated as (time saved x loaded hourly cost x adoption rate) minus inference, integration and review costs; adoption rate is usually the dominant uncertainty.

Use-case screening: high volume, language-heavy, tolerant of review, low error cost, and available ground-truth data for evaluation. Avoid irreversible or regulated decisions without human sign-off.

Total cost includes prompt engineering, integration, evaluation harness, monitoring, and human review, not just per-token pricing.

Evaluation before deployment: a golden test set, task-specific metrics (accuracy, faithfulness, hallucination rate), and A/B comparison against the current process.

Vendor due diligence: data retention and training use, subprocessors, security certifications, SLA, model versioning and deprecation policy.

Change management determines realised value: workflow redesign, staff training and clear escalation paths matter more than model choice.