AIF-C01 practice question: Governance and compliance (2 of 2)

Correct order: B, E, A, D, C

1. B. Use a public consumer generative AI app under the provider's terms First: the company owns neither the app nor the model and works under the provider's terms.
2. E. Use a third-party enterprise app that has generative AI features built in Second: there is a business agreement with the vendor, but the company still does not build anything.
3. A. Build an application on a third-party pre-trained model through an API Third: the company builds its own application but uses an existing model as is.
4. D. Fine-tune an existing foundation model with its own business data Fourth: the company creates a specialised model from an existing one, using its own data.
5. C. Train a new generative AI model from scratch on data it owns Fifth: the company owns the model and its training data, so it carries the most responsibility.

Explanation

The Scoping Matrix has five scopes: consumer app, enterprise app, pre-trained models, fine-tuned models and self-trained models. Moving up the scopes, the organisation owns more of the model and data, so it takes on more responsibility for governance, legal and privacy, risk management, controls and resilience.

Study

• Generative AI Security Scoping Matrix