IAPP Artificial Intelligence Governance Professional (AIGP) — Question 125

A company that deploys AI but is not currently a provider or developer intends to develop and market its own AI system.

Which obligation would then be likely to apply?

Answer options

• A. Implementing a risk management framework.
• B. Conducting an impact assessment including a post-deployment monitoring plan.
• C. Developing documentation on the system, the potential risks and the safeguards applied.
• D. Developing a reporting plan for any observed algorithmic discrimination or harms to individuals’ rights and freedoms.

Correct answer: A

Explanation

The correct answer is A because establishing a risk management framework is essential for any organization developing AI systems to identify and mitigate potential risks. While options B, C, and D are important considerations, they are more specific actions that may fall under the broader category of risk management, rather than foundational obligations at the outset.