AI Governance and Responsible AI Leadership

AIB-C01 · 120 questions

A city AI strategy office is under pressure to launch an automated benefits-eligibility screening tool by a publicized deadline, but disparate-impact fairness testing across demographic groups has not yet been completed. What should the office do?
A county CIO is finalizing the launch plan for a GenAI chatbot that answers resident questions about permit requirements. A product manager argues that displaying a confidence or uncertainty disclosure to residents is a nice-to-have UX polish item that can be deprioritized to hit the launch date. How should the CIO respond?
A public-health agency is setting explainability requirements for an AI model that prioritizes which neighborhoods receive door-to-door vaccine outreach. A data team proposes applying the same fixed explainability standard the agency uses for a low-stakes internal scheduling tool. What should the agency's leadership require instead?
A transit authority is deploying an AI dispatch tool that can reassign vehicle capacity in real time, including bumping a previously scheduled paratransit trip to accommodate higher system-wide demand. At what point should a human-in-the-loop escalation rule apply?
A school district is evaluating whether an AI-generated individualized learning plan should require teacher sign-off before being shared with parents. When should that human review occur?
A housing authority is deploying an AI tool that flags potential lease violations by combining utility usage data with resident complaint records, two data sources that were previously kept and used separately. What should the authority's leadership recognize about this design?
A courts and clerk's office is debating whether an AI system that drafts routine order language for judges to review needs a transparency notice for self-represented litigants who receive the resulting orders. What is the strongest argument for requiring the notice?
A municipal utility is weighing safety guardrails for an AI system that recommends water-main shutoff sequencing during an emergency, where an incorrect sequence could cause pressure loss to a hospital or fire-suppression system. How should the utility's leadership treat these guardrails?
A 311 program is deciding what counts as an adequate hallucination-detection safeguard for a GenAI assistant that answers resident questions about municipal services. A vendor argues that the underlying model's strong general accuracy reputation is sufficient assurance on its own. What should program leadership require instead?
An emergency management agency is preparing to rely on an AI evacuation-routing tool during a live wildfire event. The tool has performed well in routine traffic-modeling tests. What should the agency require before trusting it with a life-safety decision during an actual event?
A library system is deciding whether an AI content-recommendation tool that influences which titles are promoted on its public catalog homepage needs a transparency statement about how it filters or promotes titles. What consideration should most inform this decision?
A parks department is weighing an AI tool that triages resident-submitted maintenance requests, such as broken playground equipment or downed tree limbs, for faster routing to crews. Adding a human-review step before each AI-triaged request is dispatched would slow response times but reduce misrouting errors. How should department leadership balance this tradeoff?
A city AI strategy office is designing how to inform residents interacting with a benefits chatbot about AI's role in the conversation. A staff member argues that telling residents they're chatting with an AI system satisfies the office's full responsible-AI obligation. What distinction should the office's leadership raise in response?
A county human-services agency is configuring a GenAI tool intended to help caseworkers draft summaries and identify relevant policy sections during benefits-eligibility reviews. What guardrail should leadership set regarding the tool's role in the eligibility process?
A transit authority is establishing an escalation path for when an AI fare-fraud detection tool flags a rider's account for suspicious activity. What should that escalation path require before any penalty is applied to the rider?
A regional emergency dispatch consortium is weighing an AI-assisted call-triage system that could dispatch responders faster by skipping a mandatory human confirmation step for cases the model scores as high-confidence. What should the consortium's leadership decide?
A city has established a cross-functional AI governance board spanning legal, IT, and the equity office. Department heads are now asking who has the authority to approve a new AI use case before it launches. What should the city decide?
A county CIO office has designed a low, medium, and high risk classification framework for AI use cases to determine which ones require governance board review. A department head argues every AI system, regardless of tier, should go through the same full review process to be safe. How should the CIO office respond?
A public-health agency's new AI triage tool has drawn a public-records request from a resident seeking the underlying data used in its recommendations. What should agency leadership recognize about this situation?
A school district is defining an access-control policy for who may query a student-data GenAI assistant that can surface information like grades, attendance, and behavioral notes. What access-control approach should the district's leadership adopt?
A housing authority is establishing a data-sharing framework with health and social-service agencies feeding a shared AI risk model intended to identify residents at risk of housing instability. What should the authority require before the agencies begin pooling their data into the shared model?
A courts and clerk's office is rolling out an AI tool that drafts public-facing case-status summaries for the clerk's website. Which body should own final approval of the tool before it goes live?
A municipal utility is deploying an AI leak-detection tool and needs its incident reporting to satisfy state utility regulatory requirements. When should the leader address that regulatory-reporting alignment?
A 311 program is preparing to select a GenAI vendor for resident-facing chat. Where should the program set vendor AI transparency documentation requirements?
A transit authority is writing an AI governance charter and wants to prevent internal confusion the next time an AI output is disputed. What should the charter establish?
An emergency management agency uses an AI resource-allocation tool during a state emergency declaration. What is the correct view of the agency's regulatory compliance obligations for that tool during the declared emergency?
A city AI strategy office is setting requirements for AI-generated resident communications. How should accessibility compliance be treated in that governance process?
A county procurement office is writing RFP language for a new AI vendor contract and wants public-records obligations to actually be enforceable. What approach best achieves that?
A library system is establishing a governance structure for reviewing AI vendor tools before deployment. What should the structure include alongside the internal review step?
A parks and recreation department is preparing to renew an AI vendor contract. What should the department establish before renewal to keep performance accountability intact?
A city equity office is proposing an AI risk classification tier for facial-recognition-adjacent tools. What distinction should the risk framework draw between use cases?
A regional transit consortium is establishing data-security access controls for AI-flagged rider records. How should access to those records be structured?
A city AI strategy office is watching for bias drift in an automated code-enforcement prioritization tool as neighborhood demographics shift over time. How should the office treat bias monitoring for this tool?
A county child-welfare agency's AI risk-scoring tool shows disparate flagging rates across geographic areas. How should the agency's leadership direct mitigation?
A public-health agency's AI outbreak-prediction tool starts producing degraded predictions after case-report data patterns change. What risk is most likely responsible?
A transit authority audits an AI predictive-maintenance tool for reliability risk after several missed failure predictions in a row. How should leadership treat this pattern?
A school district is addressing intellectual-property risk from a GenAI tool used by students that may reproduce copyrighted material in its output. How should district leadership classify and respond to this risk?
A housing authority's AI eligibility tool is producing unreliable eligibility determinations traced back to stale income-verification data. How should leadership frame this problem?
A courts and clerk's office wants to mitigate hallucination risk in a GenAI legal-research summarization tool used by clerks. Which mitigation best addresses the risk?
A municipal utility's AI billing-anomaly detector shows rising false-positive rates disproportionate to certain rate classes. How should leadership recognize this pattern?
A 311 program is establishing a monitoring cadence for a GenAI assistant to catch harmful or inaccurate responses before they reach residents. What approach should the program adopt?
An emergency management agency's AI resource-dispatch model underperforms specifically during unusual event types, even though its aggregate accuracy metrics look strong. How should the agency mitigate this reliability risk?
A library system is addressing intellectual-property risk from a GenAI summarization tool that may reproduce copyrighted excerpts in resident-facing materials. Where should the mitigating review step sit in the workflow?
A parks department discovers staff have been using an unapproved GenAI tool for public communications. What mitigation approach should the department direct for this shadow AI use?
A city AI strategy office is classifying enterprise AI risk tiers across departments to decide where to focus monitoring resources. How should limited monitoring resources be allocated?
A county CIO office is directing bias-drift monitoring for an AI-based case-prioritization tool shared across multiple county departments. What monitoring cadence best fits a shared, multi-department system like this?
A regional transit authority's AI customer-service chatbot has started giving riders inaccurate answers about fare policy, including outdated senior-discount rules. Leadership convenes to decide how to mitigate the risk to riders. Which mitigation actually addresses the root cause of the chatbot's errors?
A housing authority's internal audit finds that an AI tool used to screen rental applications has been operating for months without ever completing its required access-control review. Enterprise risk leadership must decide how to respond. What is the appropriate response?
A regional hospital network deploys a GenAI tool built on Amazon Bedrock to flag patients for a cardiac-risk outreach program. An internal review finds the tool recommends outreach to White patients at twice the rate of Black patients who have clinically similar risk factors. Which responsible AI dimension is most directly at issue?
A state Medicaid agency uses an AI tool to flag claims for manual fraud review. Caseworkers can see which claims were flagged, but the tool gives no indication of which factors drove each flag, making it hard for caseworkers to justify escalation decisions to claimants who ask why they were selected. Which dimension does this gap primarily concern?
A county child protective services agency pilots a GenAI case-summary tool trained mostly on urban case data from other regions. When applied to the agency's largely rural caseload, the tool frequently omits risk indicators common in rural settings, such as isolation or distance from services, and its summaries are noticeably less reliable than in the vendor's original testing environment. Which responsible AI dimension does this decline in reliability across a different population best represent?
A life insurance company's underwriting team begins using a GenAI tool built on Amazon Bedrock to draft risk narratives that human underwriters review and approve before applicants are notified of results. Applicants are never told that AI had any role in preparing the analysis behind their decision. A compliance officer flags this as a governance gap. Which responsible AI dimension does the missing disclosure primarily concern?
A pediatric hospital system uses an Amazon SageMaker AI model to generate research cohort summaries from de-identified patient records. A data scientist discovers that combining the model's outputs across several individually de-identified summaries could let a sufficiently motivated analyst re-identify specific children by cross-referencing rare diagnosis combinations. Leadership is most concerned about which responsible AI dimension?
A state unemployment agency wants to launch a GenAI chatbot in two weeks to handle a surge in claims following a mass layoff event, cutting call center wait times from 45 minutes to near-instant. The responsible AI team says a full fairness audit across demographic groups would take six additional weeks. Leadership decides to launch with a lighter-weight bias spot-check now, complete the full audit within 60 days after launch, and monitor live outcomes for disparities in the interim. What is the strongest justification for this decision?
A health insurer's product team wants to expand a GenAI tool from drafting internal prior-authorization summaries to auto-approving low-dollar routine procedures without physician review, projecting a 30% reduction in reviewer costs. Clinical leadership warns that removing human review of medical necessity, even for low-dollar claims, risks improper denials or approvals that affect patient care and are hard to catch after the fact. What should the product team do?
After a wave of wildfire claims, a property insurer's fraud unit wants to use a GenAI model to auto-deny claims with suspicious patterns, potentially saving millions in payouts and investigator hours during a high-volume disaster response. The model cannot yet produce a case-specific explanation that policyholders can appeal against, and denials trigger legal appeal rights. Leadership must decide before the claims deadline. What is the most defensible path?
As a hurricane approaches, a state emergency management agency wants to use a GenAI tool to auto-generate and publish evacuation zone guidance to the public within minutes, rather than following the usual same-day human review and sign-off process. Speed could save lives, but an unreviewed error in evacuation zone boundaries could also endanger the public. What is the best approach?
A hospital network is scoping a new GenAI-powered clinical documentation assistant. The project team plans to build a working prototype first and bring in the responsible AI review board only once the tool is ready for a pilot with real patients. What is the primary risk with this sequencing?
A state agency is planning a multi-year rollout of an AI system to help determine eligibility for public benefits. Leadership initially planned to define data governance and human-oversight roles only in the final deployment phase, once functionality is complete. A CAF-aligned transformation advisor recommends defining governance structures earlier. At which point should governance-by-design practices ideally begin?
A community health clinic network's leadership wants to skip the standard governance-by-design intake for a new GenAI patient-intake summarization tool because the vendor describes it as "low-risk." The compliance lead argues intake review should still occur before build begins. What is the best justification for the compliance lead's position?
A federal benefits agency built and deployed an AI-assisted claims-processing tool without formal responsible AI review, prioritizing speed to market. Eighteen months later, an audit finds the tool lacks documented human-oversight points and cannot produce the audit trails required by a new regulation. Fixing this now requires significant rework of the tool's workflow. What does this scenario best illustrate about governance-by-design timing?
An insurance company is about to kick off a new project to build a GenAI tool that drafts renewal letters. At what stage should the team first define who is accountable for reviewing the tool's outputs and what human oversight will look like?
A hospital's radiology department is considering a GenAI tool that drafts a preliminary summary of imaging findings for radiologists to review before finalizing a report. In which circumstance is human oversight of the AI output most clearly required?
A state licensing board uses a GenAI tool to draft responses to applicant inquiries about license requirements. The board wants to define escalation criteria for when a case must go to a human reviewer instead of receiving an AI-drafted response automatically. Which situation should MOST clearly trigger escalation to a human?
A mental health treatment network is piloting a GenAI chat tool to answer patients' general questions about appointment scheduling and insurance coverage between therapy sessions. Leadership wants to define a guardrail for when the tool must stop responding and redirect the patient to a human. What is the most appropriate guardrail?
A veterans benefits administration office uses a GenAI tool to draft initial determinations on disability compensation claims, which a human adjudicator reviews before any decision is finalized. Leadership is now considering removing the human review step for claims where the AI's confidence score is very high, to reduce a growing case backlog. A policy advisor recommends against this change. What is the strongest reason to keep human review even for high-confidence AI determinations?
A homeowners insurer uses a GenAI tool to help draft settlement offer language for catastrophe claims after a major storm. Which factor should weigh MOST heavily in deciding whether a human must review and approve the AI-drafted settlement offer before it is sent to the policyholder?
A regional bank is running several GenAI pilots at once — a customer service chatbot, a loan-underwriting support tool, and a fraud-alert summarization tool — each run independently by its own department with no shared oversight. What should the bank do first to establish sound AI governance?
A pharmaceutical company's clinical operations, IT, legal/compliance, and commercial teams are each using GenAI tools to draft protocols, summarize trial data, and generate marketing content. Leadership wants clear accountability without slowing innovation. Which structure best achieves this?
An insurance company's AI governance committee has representation from underwriting, claims, legal, and IT, but decisions have stalled for months because no one has final sign-off authority when members disagree. What is the most important gap the company needs to close?
A telecom provider wants its AI governance committee to include perspectives beyond technology. Which combination of functions would best reflect appropriate cross-functional representation?
A biotech firm's AI governance committee has cross-functional representation, but each initiative's success or failure is never traced back to a specific owner, and no one is held responsible for outcomes. What should the committee change to fix this?
A bank is deploying a GenAI tool to help loan officers draft adverse-action notices to declined applicants. Which regulatory consideration is most important before launch?
A pharmaceutical company operating in the EU and US wants to use GenAI to help summarize adverse-event reports for regulatory submissions. Leadership is concerned about compliance risk. What is the most important first step?
A telecom company uses a GenAI tool to personalize marketing offers based on customer usage data. A regional regulator has recently issued guidance restricting automated decision-making that affects pricing without customer disclosure. What should the company's leadership do?
A telecom company's legal team flags that a new region where it plans to launch an AI-driven customer support assistant has a comprehensive data-protection law similar to GDPR. What is the most appropriate leadership response?
A pharmaceutical company plans to use a GenAI tool to draft patient-facing educational materials about a prescription drug. Which factor represents the greatest regulatory compliance risk?
A bank is deploying a GenAI assistant that customer-service representatives use to look up account information. Which access-control principle should the bank apply?
A pharmaceutical company is evaluating a third-party GenAI platform, built on a cloud provider's managed AI services, to process clinical trial data. The company's security lead wants to clarify who is responsible for which security controls. Which framework should guide this conversation?
A telecom company classifies customer call-transcript data used to train and prompt its AI systems as highly sensitive. Which data-security practice best reflects appropriate governance at a business-decision level?
A pharmaceutical company's business leaders want to understand what they are responsible for versus what their cloud AI vendor is responsible for when it comes to securing an AI system that processes research data. Which concept addresses this directly?
A telecom company grants its network operations team access to an AI system that summarizes customer complaint data, even though that team does not handle customer complaints. What governance principle was likely violated?
A bank's AI governance team is applying a risk classification framework to decide which oversight level to apply to three AI use cases: (1) an internal tool that summarizes meeting notes, (2) a customer-facing chatbot that answers general product questions, and (3) an AI system that determines credit-approval decisions. Which use case warrants the highest level of governance and oversight?
A pharmaceutical company is building a risk classification framework to prioritize its GenAI governance efforts. Which factor should most heavily influence how a given AI use case is classified?
A telecom company has classified an AI system that predicts network outages as "low risk" because it does not directly interact with customers. Leadership later learns the system's outputs are used to automatically prioritize which repair crews are dispatched first, affecting how quickly service is restored to hospitals and emergency responders. What should the company do?
A biotech company's AI risk classification framework assigns oversight levels based on potential impact and likelihood of harm. An internal HR chatbot that answers policy questions is classified as low risk, while a clinical-trial-recruitment matching tool is classified as high risk. What is the most likely reason for this difference?
A telecom company is beginning to build its first AI risk classification framework to prioritize governance across dozens of AI initiatives already in use. What is the most appropriate first step?
A media streaming company launched a generative AI system, built on Amazon Bedrock, that automatically writes episode summaries and moderates viewer comments. The system passed all acceptance tests before launch and has now been running in production for three months. What should the company's AI governance lead prioritize next?
A regional energy utility uses an AI system, built with Amazon SageMaker AI, to recommend which substations need maintenance based on sensor data. The system has been in production for a year with no formal process for checking its recommendations against what actually happens in the field. What is the most important risk control the utility is missing?
An oil and gas company's AI system prioritizes pipeline inspection schedules and has been in production for two years. Its only oversight mechanism is a quarterly performance review meeting; there is no monitoring in between. What is the most significant gap in this company's risk control approach?
An automotive parts supplier's AI tool drafts responses to warranty claims and has been live for six months. Which of the following is the strongest indicator that the current production risk controls are actually working?
A news publisher's AI tool drafts article summaries for editors before publication. Legal counsel has asked the governance committee to define an escalation path for the tool. What is the most appropriate first step?
A streaming service's AI recommendation system was trained on historical viewing data collected before the company expanded into several new international markets. Viewers in those new markets are now consistently shown less local-language content than viewers elsewhere, even though local content exists in the catalog. Which stage of the AI lifecycle introduced this bias?
A utility's AI system flags equipment as high risk for maintenance. It was trained on years of historical inspection records in which older facilities in lower-income neighborhoods had been inspected far more often due to past staffing patterns, producing a denser set of "high risk" labels for those areas. The system now consistently over-flags equipment in those same neighborhoods. Which stage of the AI lifecycle introduced this bias?
A broadcast network's AI-based ad-targeting tool passed a fairness review before launch. A year later, why does the company still need to monitor it for bias drift rather than treating the pre-launch review as sufficient?
A power company's AI tool approves commercial energy-efficiency financing applications and was validated as fair across business sizes at launch. Eighteen months later, an internal audit finds approval rates diverging by business size. In the same period, new sales representatives have been sourcing leads from a narrower set of industries than before. What best describes the situation, and where should the committee focus?
An auto dealership network's financing chatbot was piloted on a small dataset and showed no signs of bias. Nine months after a full rollout, it is found to favor applicants from certain zip codes. What ongoing control should the company have established to catch this kind of issue earlier?
A film studio uses a generative AI tool, built on Amazon Bedrock, to produce concept art for marketing campaigns. Before the studio uses the images commercially, legal counsel wants to confirm who owns the output. What should the governance lead confirm first?
An energy company is evaluating a third-party AI vendor to summarize regulatory filings. The vendor's model was trained on data collected from a mix of public and possibly proprietary industry sources. What IP-related question should the sourcing team prioritize before signing the contract?
An auto manufacturer is negotiating a contract with a generative AI vendor to produce AI-generated service manuals. Which contract term most directly protects the manufacturer if the AI-generated content later turns out to infringe a third party's copyright?
A utility's public-facing chatbot answers customer questions about outages and billing. During testing, someone found that it could be prompted into giving unsafe electrical safety advice. What should the company do before the chatbot goes live?
An automotive engineering firm's marketing team uses a generative AI tool to draft ad copy. An employee later reuses the AI-generated text nearly verbatim in a press release without review, and legal counsel raises a concern. What is the most important governance gap this reveals?
A news aggregator's generative AI tool summarizes wire stories. An editor discovers that a summary invented a quote that never appeared in the original article. What should the governance committee identify this as, and what is the appropriate response?
A pipeline company's AI forecasting tool has grown steadily less accurate over eight months. An investigation finds that a sensor firmware update changed how readings are formatted, and the AI was never told the format changed, so the data now feeding the model is increasingly malformed. How is this best described?
An electric vehicle maker's AI tool predicts the likelihood of battery warranty claims. It was accurate for the first year, but its predictions have grown less reliable as newer battery chemistries were introduced into the vehicle lineup. How is this best described?
A utility's AI assistant for customer service occasionally fabricates plausible-sounding but incorrect information about rate plans. What is the most important control to prioritize?
An auto manufacturer's steering committee has limited budget and must choose which reliability risk to address first among three flagged AI systems: a supplier-quality forecasting tool showing early signs of model drift as new suppliers onboard, a customer-facing chatbot that occasionally hallucinates minor details about vehicle trim options, and an internal HR tool used only for non-critical scheduling whose data quality has degraded since a recent system migration. Which should the committee prioritize first?
A national auto and home insurer's GenAI underwriting assistant, built on Amazon Bedrock, drafts premium adjustment recommendations. An audit finds the tool (1) sometimes fabricates policy clauses that do not exist in the underwriting manual, and (2) occasionally surfaces applicants' driving records to underwriters who are not authorized to view them. Select the TWO responsible AI dimensions most directly implicated. (Select TWO.)
A public housing authority wants to deploy a GenAI eligibility screening tool to cut application processing time in half amid a severe applicant backlog. A fairness review finds that the model, trained on historical approval data, would reproduce past discriminatory denial patterns against families using housing vouchers if deployed as-is. Select the TWO actions that represent an appropriate way to navigate this tradeoff. (Select TWO.)
A telehealth provider wants a GenAI assistant, built on Amazon Bedrock, to independently suggest likely diagnoses to patients in underserved rural areas who currently wait weeks for a physician appointment, arguing this expands access to care. Clinical and legal leadership are concerned that unsupervised AI-suggested diagnoses could lead to missed or incorrect care. Select the TWO approaches that would best resolve this tradeoff between access and safety. (Select TWO.)
An insurer is scoping a new GenAI tool to help adjusters triage catastrophe claims. Select the TWO activities the responsible AI team should complete during the initial planning phase, before the first line of the pilot is built. (Select TWO.)
A disability insurance carrier uses a GenAI assistant to help claims examiners summarize medical records referenced in a benefits determination. The carrier is designing safeguards against the tool fabricating details that never appeared in the source records. Select the TWO safeguards that would most directly address this hallucination risk. (Select TWO.)
A telecom carrier is standing up an enterprise AI governance committee to oversee its growing portfolio of AI initiatives, including a network-anomaly-summarization tool and a customer-churn-prediction dashboard. Select the TWO characteristics the committee should have to be effective. (Select TWO.)
A multinational bank's compliance team is assessing regulatory risk for a new GenAI-based investment-advice assistant that will operate in several countries. Select the TWO actions that appropriately address regulatory compliance risk. (Select TWO.)
An insurance company is designing access controls and data-security practices for a new GenAI claims-review assistant that references customer medical and financial records. Select the TWO practices that are appropriate business-level governance decisions. (Select TWO.)
An insurance company's governance team is applying a tiered risk classification framework across its AI portfolio. Select the TWO factors that should genuinely raise an AI use case's risk classification. (Select TWO.)
An automotive manufacturer's Amazon Bedrock-based chatbot handles customer service for dealerships nationwide. The AI governance steering committee wants to strengthen the production risk controls around it. Select TWO actions the committee should prioritize. (Select TWO.)
An auto manufacturer's AI tool screens technician applicants and initially validated as fair across training-program backgrounds. Eighteen months later, it shows a pattern skewing against candidates from certain training programs. Select TWO actions the governance committee should take. (Select TWO.)
A broadcaster is piloting a generative AI tool that auto-generates social media captions for live news clips. Select TWO risks the governance committee should treat as harmful-content concerns requiring mitigation before wider rollout. (Select TWO.)
A broadcast network's AI-generated highlight-reel captions have become increasingly inaccurate after ten months in production. Select TWO actions the steering committee should prioritize. (Select TWO.)