The AIGP
Certification Playbook

Four Risk Tiers

Unacceptable (Prohibited): Social scoring, real-time biometric ID in public spaces, subliminal manipulation, emotion recognition in workplace/education (except medical/safety), predicting criminality solely from personality profiling, untargeted facial scraping.

High Risk: Biometric ID, critical infrastructure, education, employment, essential services, law enforcement, migration, administration of justice (Annex II/III).

Limited Risk: Transparency obligations apply regardless of risk tier - AI interaction disclosure, emotion recognition disclosure, AI-generated content labeling.

Minimal Risk: No specific obligations. Most AI systems fall here.

Roles

Provider: Creates compliance artifacts - CE marking, conformity assessment, technical documentation (Annex IV), risk management system, human oversight mechanisms, post-market monitoring.

Deployer: Verifies proper use - FRIA before deployment (public bodies/public service providers), logs/documentation retained 6+ months, human oversight during operation.

Importer: Verifies artifacts exist and are valid. Gatekeepers for non-EU providers.

Substantial modification of a system = becomes a provider and assumes all provider obligations.

GPAI & Systemic Risk

Tier 1 (all GPAI): Technical documentation + copyright compliance policy incl. text/data mining opt-outs.

Tier 2 (systemic risk): Training data summary, adversarial testing, cybersecurity, report incidents to EU AI Office, energy consumption reporting.

Systemic risk threshold: >10²⁵ FLOPs OR Commission designation. GPAI obligations are parallel to - not overlapping with - high-risk system obligations.

Penalties

Prohibited practices: €35M or 7% global turnover. Provider breaches (high-risk): €15M or 3%. Misleading info: €7.5M or 1%.

Seven Principles (Article 5)

Lawfulness/fairness/transparency · Purpose limitation · Data minimization · Accuracy · Storage limitation · Integrity & confidentiality · Accountability

Purpose Limitation - Most Tested GDPR Concept

Original consent for service delivery does NOT automatically cover AI model training. "Research & development" licenses may not cover commercial AI. Publicly available data ≠ blanket permission. Voluntary sharing in employment/insurance contexts ≠ valid GDPR consent.

Controller vs Processor

Controller determines purposes and means. Processor acts on behalf of controller. Roles are activity-specific, not entity-specific - same company can be both. When a processor uses data for its own purposes, it becomes a controller for that processing.

DPIA Triggers (2+ = generally required)

Profiling and prediction · Systematic/extensive evaluation · Sensitive data · Automated decision-making with significant effects · Large-scale processing · Combining datasets

Automated Decision-Making Transparency

Controllers must proactively disclose: (1) existence of ADM, (2) meaningful info about logic, (3) significance and envisaged consequences. This is distinct from Article 15 access rights (reactive, upon request).

Data Is the Root

Data attributes and variability are the most important factors for fairness. No amount of architectural sophistication can overcome fundamentally unfair training data.

What Counts as Bias

IS bias: Content of lower quality for a minority group · Stereotyped images of protected groups · Advertising that focuses on appearance over function for female audiences.

IS NOT bias: Directing ads to companies rather than individuals (business targeting decision) · Producing less content for a segment if determined by business scope, not demographics.

Prioritization Order

1. Discrimination against protected groups (fairness + legal compliance) → 2. Regulatory compliance gaps → 3. Technical performance issues → 4. Aggregate metrics (accuracy) - last.

Bias by Lifecycle Phase

Planning/Design: Stakeholder involvement, feature selection, data collection planning (proactive).

Operational: Human oversight, disparity testing, performance monitoring. Human oversight is a deployment activity, NOT a planning activity.

Four Core Functions

Govern: Organizational foundation - policies, accountability structures, risk tolerance, culture. Cross-cutting, underpins all others. "How is our org set up for AI risk?"

Map: System-specific risk identification - context, risks, stakeholders for a specific AI system. "What are the risks of THIS system?"

Measure: Quantitative/qualitative risk assessment. "How severe are these risks?"

Manage: Respond, mitigate, monitor. "What do we do about them?"

Risk tolerance and risk appetite = Govern decisions (organizational), not Map (system-specific).

Seven Trustworthy AI Characteristics

Valid & Reliable · Safe · Secure & Resilient · Accountable & Transparent · Explainable & Interpretable · Privacy Enhanced · Fair with Bias Managed

ARIA Program

Assessing Risks and Impacts of AI - NIST's primary program to provide organizational resources for managing AI-specific risks. ARIA ≠ standard-setting ≠ interoperability initiative ≠ regulatory sandbox ≠ red-teaming program.

Lifecycle Phases

Planning: Objectives, governance approach, operational context. Does NOT include architecture selection.

Design: Architecture choice, algorithm selection, risk estimation, data approach. Architecture belongs here - needs planning outputs as inputs.

Data Preparation: Collect, clean, label, augment, de-duplicate.

Development: Build and train.

Testing & Validation: Evaluate performance, explainability, bias testing, TEVV.

Deployment: Launch; conformity assessment happens BEFORE deployment.

Monitoring: Disparity testing, drift detection, champion/challenger testing.

Data Subsets

Training = textbook (learns patterns) · Validation = practice quiz (prevents overfitting during dev) · Testing = final exam (never seen before, robust evaluation)

Model Maintenance

Accuracy deterioration → champion/challenger testing first (diagnostic + solution-oriented). Retraining addresses data drift, concept drift, hyperparameter tuning. Retraining does NOT fix interpretability - that requires architecture changes.

Documentation Purpose by Phase

Development = preserves design decisions · Post-testing = verifiable audit trail · Post-deployment = captures current state · Post-incident = demonstrates due diligence

Key PETs

Federated Learning: Multi-party training without sharing raw data. Each party shares only model updates (gradients/weights). Best for multi-institution collaboration.

Differential Privacy: Adds calibrated mathematical noise. Mathematical guarantee against membership inference attacks and training data reconstruction. Homomorphic encryption protects during computation but doesn't prevent output identification.

Homomorphic Encryption: Computation on encrypted data without decryption. Powerful but computationally expensive.

Data Anonymization: Removes PII. Difficult to achieve truly, especially for health data. Residual re-identification risk remains.

Synthetic Data: Generated from scratch to preserve statistical properties without being derived from real personal data. No residual re-identification risk. Best when real data is insufficient, consent unavailable, or sensitive data (health records) cannot be used directly.

Core Principle

Accountability follows deployment, not development. Deploying a third-party AI system = accountable for outcomes regardless of who built it.

Policy Hierarchy (Operational Relevance)

1. Acceptable Use Policy (AUP) - defines what is permitted (most operationally relevant, review first) · 2. Privacy Policy - data handling · 3. Security Policy - access controls · 4. Code of Conduct - behavioral norms

The AUP comes first because it determines whether the intended use is even permissible. If AUP prohibits a use, privacy/security policies are irrelevant.

Procurement Governance

"Trust us, it's audited" is never sufficient. Review terms of use and license agreements before using external data - most important first step. Finance and Legal are the most critical additional procurement stakeholders.

IP indemnification = standard contractual mechanism for IP protection. Creates vendor obligation to defend against third-party IP claims.

Deployer Responsibilities

Deployers are responsible for: ethical testing (outputs for fairness), technical performance, regulatory compliance. NOT responsible for: ethical design (provider's domain), system documentation (provider's obligation).

Key Principles

AI cannot bear legal responsibility - liability flows to humans and organizations. Fair use for AI training is unsettled law, not a guaranteed defense. The entity that commercially benefits from AI-generated output bears responsibility for it.

Copyright for AI-Generated Content

Purely AI-generated content is generally NOT eligible for copyright protection in the US - human authorship required. However, when a human takes AI output and modifies it with sufficient creative expression, the resulting work may qualify. Key test: demonstrating human creative input. Prompts alone are generally insufficient to establish authorship.

Model Disgorgement

When a model was trained on improperly obtained data, disgorgement removes the effects of that data. Simply deleting the original data is insufficient - the model retains learned patterns. May require full model destruction + retraining, machine unlearning, or partial retraining from a checkpoint.

Open Source

Open-source licensing does NOT exempt high-risk AI systems from the EU AI Act. Risk profile determines regulatory treatment, not the licensing model.

OECD AI Principles

Self-regulation model - voluntary, not legally binding. Balances AI innovation with ethical considerations. Five principles: inclusive growth & sustainable development · human-centered values & fairness · transparency & explainability · robustness & security & safety · accountability.

OECD Assessment Tool Types: Procedural (codes of conduct, governance committees) · Technical (auditing software, bias tools) · Educational (training programs, guidelines) · Analytical (risk assessments, impact assessments). Codes of conduct = procedural, not technical.

US Regulatory Approach

Sectoral approach, not comprehensive legislation. Key laws: anti-discrimination (Title VII, ECOA, ADA, ADEA) · privacy (CCPA/CPRA) · consumer protection (FTC Act) · NYC Local Law 144 for AI hiring tools. Product liability applies to vendors/manufacturers - NOT deployers of third-party AI.

Canadian AIDA

Minister of Innovation must be notified when a high-impact AI system causes or is likely to cause material harm. Notification trigger is harm-based, not deployment-based.

Framework Comparison

EU AI Act: prescriptive, risk-based classification, legally binding · NIST AI RMF: structured methodology, voluntary · OECD: principles-based, balance-oriented, voluntary · IEEE 7000-21: system design methodology, voluntary · HUDERIA: impact assessment tool.

When to Use What

RAG: Frequently changing information in non-regulated, non-deterministic contexts.

Expert Systems: Regulated, rule-based decisions requiring accuracy, consistency, explainability, auditability (financial offers, insurance quotes, compliance decisions). Frequently changing data ≠ automatically use RAG - if rules are structured, expert system with updated rule base is better.

Classic ML models: When customization and vendor lock-in avoidance is the priority.

Content Responsibility

Organizations using generative AI to produce content are responsible for that content. Using AI as a tool doesn't transfer professional responsibility to the tool.

Deepfakes Risk

Most significant risk = downstream harms (disinformation, non-consensual deepfakes, erosion of media trust, societal destabilization). Downstream harms is the broadest concept, outweighing narrower risks like copyright infringement.

Paid vs Free GenAI

Paid tools: convenient, extra privacy/security controls, frequent updates. Do NOT provide transparency into model decision-making. Do NOT eliminate data concerns.

Critical Definitions

AI Model: Program trained on data to find patterns → then applies patterns to new inputs. NOT a rule-based system (explicitly programmed logic, no training).

Machine Learning: Systems automatically improve from experience through predictive patterns. Key signal: "automatically improve from experience."

Inference: Process of using a trained model on new data. A process, not a model type.

Taxonomy: XAI vs Trustworthy AI vs Responsible AI

Explainable AI (XAI): Processes allowing users to understand and trust AI outputs. When question asks about "making AI outputs understandable to humans" → answer is XAI.

Interpretable AI: Degree to which internal model mechanics can be understood. Narrower and technically-facing vs XAI which is user-facing.

Trustworthy AI: Full set of properties - valid, reliable, safe, secure, explainable, fair, privacy-preserving. Broader than XAI.

Responsible AI: Organizational commitment and culture. Broader than both. Aspirational, not a technical property.

Narrow vs Strong AI

Narrow AI: Specific well-defined task only. Self-driving cars, LLMs, image recognition - all narrow AI.

Strong AI / AGI: Full generalized human cognitive ability across all domains. Does not exist in any commercially deployed system.

Model Taxonomy

Discriminative: Classifies existing data (random forests, SVMs, logistic regression) → classifies inputs → discriminative.

Generative: Creates new data (GANs, VAEs, LLMs, diffusion models) → LLMs generate text → generative.

Symbolic: Explicit logic and rules (expert systems, knowledge graphs). NLP is a domain of application, not a model type.

System Properties

Robust = withstands adversarial conditions ("despite") · Reliable = consistent under normal conditions · Resilient = recovers after disruption · Brittle = opposite of robust

AI-Unique Characteristics

Unique to AI: Autonomy, Adaptability. NOT unique: Automation (decades old), Speed & scale (all modern computing - it's a risk amplifier).

What Impact Assessments Evaluate

Impact assessments are fundamentally people-centered. They evaluate:

• Fundamental rights (dignity, non-discrimination, privacy, freedom of expression)
• Data protection (lawful processing, purpose limitation, data minimization)
• Safety (physical, psychological, societal harm prevention)

What They Do NOT Focus On

Organizational risk categories (third-party risk, model risk, legal risk) · Technical components (datasets, behavior, tooling) · Model quality metrics (toxicity, accuracy, development).

FRIA (Fundamental Rights Impact Assessment)

A deployer obligation - only for public bodies or private entities providing public services (banks, schools, hospitals, insurers). Must be conducted before putting high-risk AI into use.

Opt-Out Rights Factors

Risk to users (primary driver) · Feasibility of opt-out mechanisms · Cost of alternative mechanisms. Industry practice = least relevant factor for rights decisions.