Discuss IAPP AIGP Exam Topic 3 Question 36

Scenario:

An enterprise is evaluating multiple third-party generative AI tools to integrate into its platform. As part of its AI governance policy, it is assessing themost effective methodsto reduce risks related to bias, data misuse, and liability when using third-party solutions.

All of the following are commonly adopted processes and policies in reducing potential risks introduced by third-party AI tools or applications EXCEPT:

AIncluding clauses in the procurement agreement for buyers of generative AI tools to put certain liabilities on the tool supplier

BAllowing publicly available information and personally identifiable information (PII) to be incorporated into the prompt

CRequiring an independent third-party bias audit for third-party generative AI tools

DRequiring new use cases of the generative AI tools or applications to be reviewed and approved by the generative AI governance body

Suggested Answer: B

The correct answer isB. AllowingPIIto be freely entered into prompts without safeguards is considered amajor privacy and security riskand is not a responsible governance practice.

From the AIGP ILT Guide -- Generative AI & Third-Party Risk Management:

''Use of personal or sensitive information in AI prompts can result in unintended exposure, regulatory breaches, and downstream liability.''

The AI Governance in Practice Report 2024 highlights:

''PII should be minimized or protected by design. Prompt engineering should prevent entry of personally identifiable data unless legally and technically safeguarded.''

A, C, and D are established best practices under responsible AI procurement and use.

===========

Get Premium AIGP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

28 comments · newest first

Brett 7 months ago

Yes, B should never be allowed. It opens too many doors for misuse.

Katheryn 7 months ago

B is definitely the worst option. We need to protect privacy!

Sang 7 months ago

I feel like A is also a concern, but not as much as B.

Mari 7 months ago

Definitely B. It contradicts data protection principles.

Walker 8 months ago

Agreed! Allowing PII in prompts is risky.

Celestina 8 months ago

D is essential for keeping everything in check!

Leonor 8 months ago

Wait, are we really okay with using public info like that?

Leoma 9 months ago

A and C are must-haves for responsible AI use!

Alease 9 months ago

B seems risky. Why allow PII in prompts?

Shonda 9 months ago

Definitely need those liability clauses in contracts!

Sherita 9 months ago

Haha, B? Seriously? That's like inviting hackers to come and steal your data. Not a chance!

Kirk 9 months ago

I'd go with B as the exception. The rest seem like pretty standard AI risk mitigation practices.

Dick 9 months ago

Definitely B. Incorporating PII is a huge no-no for any responsible AI governance policy.

Lilli 10 months ago

Reviewing new use cases by a governance body sounds familiar, but I can't recall if that's always done. Maybe D is the exception?

Juan 10 months ago

I think requiring a bias audit is a good practice, like we practiced in our case studies. So, C seems correct to me.

Natalie 10 months ago

This is a good one. I'm going to make sure I understand the context first - an enterprise evaluating third-party AI tools and wanting to reduce risks. Then I'll carefully analyze each option to find the one that doesn't fit.

Lauran 10 months ago

Okay, I think I've got this. The question is asking about the process or policy that is NOT commonly adopted to reduce risks from third-party AI tools. I'll need to evaluate each option and identify the one that's the outlier.

Lorrie 11 months ago

B is a terrible idea. Letting PII into the prompts? That's just asking for trouble.

Caprice 11 months ago

This question is tricky! I think B is the odd one out.

Willetta 11 months ago

I remember discussing how important it is to have liability clauses in contracts, so I think A is definitely a common practice.

Chauncey 11 months ago

I'm not entirely sure, but allowing PII in prompts seems risky. I feel like that could lead to data misuse, which we studied in class.

Jamey 11 months ago

Hmm, I'm a bit confused by the wording here. Are they asking about the processes and policies that are commonly adopted, or the ones that are not commonly adopted? I need to read this carefully to make sure I don't miss anything.

Roxanne 12 months ago

This seems like a pretty straightforward governance question. I'm going to focus on understanding the key risks the enterprise is trying to mitigate and then identify the option that doesn't align with those.

Winfred 6 months ago

↳ replying to Roxanne

Right! B stands out as the odd one out here.

Denny 6 months ago

↳ replying to Roxanne

I agree. Options A, C, and D all focus on governance.

Dorothy 7 months ago

↳ replying to Roxanne

Definitely. It goes against the idea of reducing data misuse.

Rashida 7 months ago

↳ replying to Roxanne

Yeah, incorporating PII seems risky.

Desmond 10 months ago

↳ replying to Roxanne

Sounds like a tricky situation. What do you think about option B?

IAPP AIGP Exam - Topic 3 Question 36 Discussion