Understand what AI is and why it needs governance.
- ✓AI = a machine-based system that infers how to produce outputs that influence environments.
- ✓AI ⊃ machine learning ⊃ deep learning ⊃ generative AI.
- ✓RPA and rules defined solely by people are automation, not AI; expert systems that infer from encoded knowledge can be AI.
- ✓Supervised, unsupervised, semi-supervised, reinforcement and self-supervised learning are the main ways machines learn.
- ✓Agentic AI acts autonomously toward goals, so it raises the governance stakes.
- AI system (OECD / EU AI Act):
- A machine-based system that infers from inputs how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.
- Machine learning:
- AI that learns patterns from data rather than being explicitly programmed with rules.
- Robotic process automation (RPA):
- Software that mimics repetitive human steps using fixed rules. It automates tasks but does not learn or infer.
- Expert system:
- A knowledge-based system that reasons over facts and if-then rules supplied by human experts to reach new conclusions; it can count as AI because it infers from encoded knowledge.
- Foundation model:
- A large model trained on broad data that can be adapted to many downstream tasks.
- Agentic AI:
- AI that plans and takes multi-step actions, often using tools, to pursue a goal with limited human intervention.
Exam tips: If an option says RPA 'learns', 'relies on human judgment' or 'increases human involvement', it's a trap. RPA follows fixed rules to REDUCE human effort. · When asked what makes something AI, look for inference (learning from data, or reasoning from encoded knowledge), not automation, speed or data volume. · Rules don't automatically mean 'not AI'. An expert system that infers from a knowledge base can be AI (EU AI Act Recital 12); software that only executes rules defined solely by people is not. Real systems are judged case by case. · Labeled data means supervised; no labels means unsupervised; a few labels plus lots of unlabeled data means semi-supervised; rewards mean reinforcement. The exam loves these one-word tells.
- ✓AI harms land on individuals, groups, organizations and society. Classify by who absorbs them.
- ✓The BoK's named risk patterns: misalignment with objectives, ethics and bias risk, complexity and scalability.
- ✓Scale turns one flaw into thousands of harms before anyone notices.
- ✓AI sharpens privacy harms like inference and aggregation; subjective and objective privacy harms both count.
- Individual harm:
- Damage to a specific person's rights, safety, civil liberties or economic opportunity.
- Group harm:
- Damage to a community or population sub-group, such as systematic discrimination or targeted surveillance.
- Organizational harm:
- Damage the organization itself absorbs: disruption, breaches, fines, lost business, reputational or cultural damage, and acceleration risk from rushing AI out untested.
- Societal harm:
- Damage to shared goods like democratic participation, trust in information, access to education or the environment.
- Misalignment:
- When an AI system pursues a measurable proxy or purpose that diverges from what its owners actually intended.
- Inference harm:
- A privacy harm in which an AI derives sensitive traits a person never disclosed.
Exam tips: Classify harm by WHO absorbs it, not by the technology. Surveillance 'feels' societal, but if it targets one community, the IAPP answer is group harm. · When asked which harm is MOST directly raised, pick the first and biggest hit. Organizational harm (fines, reputation) is usually a consequence, not the primary harm. · 'Each decision is individual' is a classic distractor when the facts describe a pattern across a community. · Misalignment means optimizing the proxy, not the goal. Look for clicks, watch time or 'tickets closed' rising while the real outcome gets worse.
- ✓CAPS POD: complexity, autonomy, probabilistic outputs, speed and scale, potential for harm or misuse, opacity, data dependency.
- ✓AI gives likelihoods, not guarantees, so governance sets thresholds and keeps humans involved where stakes are high.
- ✓Data dependency means models drift as the world changes; monitoring never ends.
- ✓Speed and scale multiply ordinary errors into mass harms.
- Opacity (black box):
- When an AI system's internal reasoning can't readily be inspected or explained, even by its builders.
- Probabilistic output:
- A likelihood or best guess that can vary and can be wrong, rather than a guaranteed result.
- Deterministic output:
- A result that is always the same for the same input, as with conventional rule-based software.
- Data drift:
- A change in the input data a deployed model receives compared with its training data.
- Concept drift:
- A change in the relationship between inputs and the correct output, so old patterns stop holding.
- Hallucination:
- Fluent, confident output from a generative model that is false or fabricated.
Exam tips: 'Configure it to be right every time' signals a probabilistic-vs-deterministic question. The IAPP answer adds thresholds, human escalation and monitoring. · Drift is a monitoring problem (decay after deployment); overfitting is a training problem (fails on new data from day one). · On LEAST/NOT questions about AI's unique traits, the trap is a true statement that applies to ALL software, such as patching or uptime. · Reusing existing controls is good; reusing them 'unchanged' or 'as-is' for AI is the trap.
- ✓Fair Ships Pass Through Any Harbor: fairness, safety & reliability, privacy & security, transparency & explainability, accountability, human-centricity.
- ✓Transparency (what, and that AI is in use) and explainability (how a specific result came out) are related but distinct.
- ✓Accountability can't be outsourced to a vendor or a model.
- ✓OECD, NIST and others use different labels for the same core values.
- Fairness:
- Ensuring AI outcomes don't unjustly disadvantage individuals or groups, with harmful bias identified and managed.
- Transparency:
- Disclosing what an AI system is, what it does and that AI is in use; NIST frames it as answering 'what happened'.
- Explainability:
- The ability to describe how an AI system produced a particular output or decision.
- Interpretability:
- In NIST's terms, understanding why a system produced an output and what it means in context for the user.
- Accountability:
- Identifiable people and organizations answer for an AI system's outcomes and have the authority to act.
- Human-centric AI:
- AI designed to augment people, respect their rights and keep meaningful human control over consequential decisions.
Exam tips: Transparency answers WHAT (and that AI is in use); explainability answers HOW a specific output came about. An option treating them as the same is wrong. · Accountability stays with the organization. 'The vendor is responsible' or 'the algorithm decided' are trap answers. · Profit, speed, efficiency and innovation are never responsible-AI principles, however nicely an option dresses them up. · Human review that starts only after a complaint is remediation, not meaningful human control.
- ✓Principles become real through policy, procedure, control and evidence.
- ✓Common collisions: fairness vs. privacy, accuracy vs. explainability, transparency vs. security, accuracy vs. fairness, efficiency vs. human control.
- ✓Resolve collisions explicitly: legal floor, quantify, decide cross-functionally, document, monitor.
- ✓Match oversight (in, on or out of the loop) to stakes and reversibility, and guard against automation bias.
- Principle trade-off:
- A situation where advancing one responsible-AI principle, such as accuracy, costs another, such as fairness or privacy.
- Human-in-the-loop:
- A person must review and approve each decision before it takes effect.
- Human-on-the-loop:
- The system acts autonomously while a person monitors it and can intervene or halt it.
- Automation bias:
- The tendency of people to over-rely on automated outputs and stop exercising their own judgment.
- Operationalize:
- Turning a principle into concrete policies, procedures, controls and evidence.
Exam tips: When principles conflict, the IAPP answer is a documented, cross-functional balance with the law as the floor. Options that maximize one principle 'whatever it costs' are traps. · 'A human is somewhere in the workflow' isn't meaningful oversight. Look for competence, information, time and authority to override. · Leaving an ethical trade-off to the data science team alone is the technical-only trap. · Accountability = named owner + authority + records. Disclaimers and indemnities don't create it.
Independent study aid, not affiliated with the IAPP. Written with AI from primary sources; laws change, so check the sources. Last updated 7 Nov 2026.
