EU AI Act: Principles, Risk Framework, and Roles

5 minutes 5 Questions

Test mode:
Start practice test

CIPP/E - EU AI Act: Principles, Risk Framework, and Roles Example Questions

Test your knowledge of EU AI Act: Principles, Risk Framework, and Roles

Question 1

Under the EU AI Act's risk framework, what is the guiding logic used to determine which obligations apply to a given AI system?

Correct Answer: Obligations scale with the level of threat the system poses to health, safety and fundamental rights

The EU AI Act adopts a risk-based approach where the intensity of obligations corresponds to the level of danger a system poses to health, safety and fundamental rights, ranging from prohibited practices to high-risk, limited-risk and minimal-risk categories.

Revenue is a threshold concept for enforcement and fines under other frameworks, not the trigger for AI obligations. Volume of personal data governs GDPR applicability, not the AI Act's risk tiers. The number of member states affects market reach but does not change a system's risk classification.

The key concept tested is the risk-based tiering of AI obligations.

Question 2

A privacy officer reviews two competing proposals for governing a planned high-risk recruitment AI system. Both aim to satisfy the AI Act while respecting applicant rights under Article 22 GDPR. The officer must judge which proposal best aligns the AI Act's risk-based obligations with data protection principles. Which proposal represents the soundest choice?

Correct Answer: Combine logging, human oversight and a data protection impact assessment covering the profiling of candidates

The soundest proposal integrates automatic logging, meaningful human oversight and a DPIA covering candidate profiling, which jointly satisfy the AI Act's high-risk deployer obligations and GDPR Article 22 safeguards against solely automated decisions.

The legitimate-interests option fails because automated decisions with legal or similarly significant effects require Article 22-specific safeguards, not just a balancing test. Treating consent as the sole safeguard ignores mandatory oversight and DPIA duties and consent is rarely freely given in employment. Relying only on the provider's conformity assessment wrongly assumes deployers have no independent obligations under the AI Act.

Key concept: aligning high-risk AI deployer duties with Article 22 automated-decision safeguards.

Question 3

A company builds a general-purpose AI model and offers it to other firms. One firm integrates it into a service that scores loan applicants. During a review, the two organizations argue about who must ensure the loan-scoring system meets the high-risk conformity requirements. Which allocation of duties fits the risk framework's design?

Correct Answer: The firm placing the loan-scoring system on the market carries the high-risk provider duties for that use

Under the EU AI Act, the entity that places the high-risk AI system on the market or puts it into service under its own name becomes the provider bearing conformity obligations, so the firm building the loan-scoring system takes on those duties for that specific high-risk use.

The model builder does not retain all provider duties because it only supplies a general-purpose model, not the high-risk system itself. There is no automatic co-provider arrangement with identical shared duties. And conformity duties cannot vanish, since the firm integrating the model becomes the provider, not merely a deployer.

Key concept: allocation of provider versus deployer roles for high-risk AI systems.

More EU AI Act: Principles, Risk Framework, and Roles questions
27 questions (total)
Start 27 question test

Other Introduction to European Data Protection concepts

Convention 108 (Council of Europe)Council of the EU and European ParliamentCourt of Justice of the European Union (CJEU)Data Protection Directive 95/46/ECePrivacy Directive (2002/58/EC)EU Charter of Fundamental Rights (Articles 7 and 8)European Convention on Human Rights and Article 8Evolution of Data Protection in EuropeGDPR Overview and StructureInteraction Between Human Rights and Data ProtectionLaw Enforcement Directive (2016/680)National Data Protection Laws Pre-GDPRNIS and NIS2 Directives and Data ProtectionOECD Privacy GuidelinesRole of the European Commission in Data Protection
All Introduction to European Data Protection questions · CIPP/E practice test