Data aggregators are third parties that collect and license data from various sources. They are responsible for ensuring thelawful collectionandproper usage rightsof the data they distribute - especially when such data is used to train foundational AI models.
From theAI Governance in Practice Report2025:
"As organizations have neither proximity to how third-party data was first collected nor direct control over the data governance practices of third parties, an organization can benefit from carrying out its own legal due diligence and third-party risk management." (p. 19)
"Legal due diligence may include verification of the personal data's lawful collection by the databroker..." (p.
19)
This confirms thatdata aggregatorsbear the legal and ethical burden to verify that data has been lawfully collected and is appropriately licensed for use, including in AI training.
* A. The marketing agencyandD. its clientmay use data, but they rely on upstream providers for its lawful origin.
* B. The tech companymay train the model but depends on lawful sourcing by data aggregators.

Post-deployment AI maintenance typically includes ensuring that all model components are subject to a control framework, dedicating experts to continually monitor the model output, and evaluating the need for audits under certain standards. However, defining thresholds to conduct new impact assessments is usually part of the initial deployment and ongoing governance processes rather than a maintenance activity.
Maintenance focuses more on the operational aspects of the AI system rather than setting new thresholds for impact assessments.
Reference: AIGP BODY OF KNOWLEDGE, sections discussing AI lifecycle management and post-deployment activities.

The acceptable use policy defines how the model is permitted to be operated, including restrictions, prohibited behaviors, and required safeguards. It is the most important policy for assessing whether the AI model is being used appropriately and within operational boundaries.

The White House Blueprint for an AI Bill of Rights focuses on protecting civil rights, privacy, and ensuring AI systems are safe and effective. It includes principles like data privacy (D), human alternatives (A), and safe and effective systems (C). However, it does not specifically address high-risk mitigation standards as a distinct category (B).

The correct answer is D - Privacy impact assessments (PIAs). These are directly adaptable for identifying risks in AI systems, particularly around data usage, bias, and individual impacts.
From the AIGP ILT Guide - Risk Management Module:
"PIAs and DPIAs are existing tools used in privacy compliance that can be extended to evaluate the risks of AI, including fairness, explainability, and legality." AI Governance in Practice Report 2024 further explains:
"Organizations can adapt privacy impact assessments to evaluate the ethical, legal, and technical risks posed by AI systems. They provide a structured and recognized method." PIAs are preferable over general security practices (like pen testing) which do not address algorithmic bias or legal compliance directly.