The correct answer isD.Emotion recognition in the workplaceis flagged asunacceptable or highly restrictedunder the EU AI Act due to its intrusive nature and potential for misuse.
From the AIGP ILT Guide - EU AI Act Training Module:
"AI systems that monitor individuals' emotions in the workplace or educational settings are listed among prohibited or strictly limited practices under Article 5." AI Governance in Practice Report2025supports this interpretation:
"Emotion recognition systems, especially in sensitive contexts such as employment or education, raise significant concerns under EU fundamental rights law and are likely to be restricted." Other uses listed-such as emergency response or emotion detection in healthcare-may fall underlawful and beneficial uses, especially whenjustified by public interest.

The correct answer is C because it follows a structured, risk-based AI governance approach aligned with best practices and regulatory expectations. AI governance frameworks emphasize identifying and assessing risks through probability and severity analysis before deployment. This allows organizations to prioritize the most critical risks, such as bias and discrimination in loan approvals. Applying a risk mitigation hierarchy ensures that controls are implemented proactively rather than reactively. Only after risks are assessed and mitigated should pilot testing occur to validate system performance in a controlled environment. Other options either delay risk assessment until after deployment or focus on limited aspects like benchmarking or explainability without addressing core risk management principles. A proactive, risk-first approach is essential for compliance, fairness, and responsible AI deployment.

The correct answeris.CThis action ties directly into principlesof dataminimization, purpose limitation,and lawfulnessof processing, which are central to privacy and AI governance.
From the AIGP Body of Knowledge, Section on Privacy Considerations:
"Personal data must only be processed for specified and lawful purposes. Organizations must consider whether they have a legal basis for processing such data under data protection laws like the GDPR or CCPA." Additionally, AI Governance in Practice Report2025emphasizes:
"One of the most significant challenges when designing and developing AI systems is ensuring the data used is appropriate for the intended purpose... Managing unnecessary data, especially data that may contain sensitive attributes, can increase risk."

The most comprehensive way to identify a full range of risks - legal, ethical, operational, and societal - for a new AI model is through aformal impact assessment, such as aData Protection Impact Assessment (DPIA) orAlgorithmic Impact Assessment.
From theAI Governance in Practice Report2025:
"Risk-based approaches are often distilled into organizational risk management efforts, which put impact assessments at the heart of deciding whether harm can be reduced." (p. 29)
"DPIAs... help organizations identify, analyze and minimize data-related risks and demonstrate accountability." (p. 30)
* A. Environmental scanis too general.
* B. Red teamingis useful for adversarial risk but not broad.
* C. Integration testingfocuses on technical/system compatibility, not overall risk.

When anew versionof a third-party model is released, the deployer must ensure it still meets safety, performance, and compliance requirements - which calls for aformal audit.
From theAI Governance in Practice Report2025:
"Any updates or changes to AI systems should trigger a re-evaluation to ensure continued compliance and performance." (p. 12)
"Post-market monitoring includes reassessing the impact of updated models or retraining." (p. 35)