Domain IV in one pass: governing deployment and use
Lesson 2 of 3 in AIGP Domains III–IV Recap: Governing Development and Deployment.
Domain IV — Understanding how to govern AI deployment and use — is the other 21–25-question heavyweight, and its internal skew is even sharper: IV.A (the deployment decision, 6–8 questions), IV.B (deployer-side assessments and vendor contracts, 5–7), and IV.C (post-deployment governance, 9–11) — the heaviest single competency on the entire exam.
Domain IV changes the camera angle. Domain III watched the builder; Domain IV watches the organisation that selects, procures, and runs an AI system — usually somebody else’s. The deployment decision comes first: business objectives, performance requirements, data availability, ethical considerations, and workforce readiness (the one candidates forget — a system nobody is trained to oversee is not ready to deploy, whatever its benchmarks say).
Then come three choices, each with governance consequences the exam tests directly: what kind of model (classic predictor or generative; proprietary or open source; small or large; language-only or multimodal), where it runs (cloud, on-premise, edge), and how you adapt it — which is where the tabs below earn their keep.
As-is
Use the model exactly as licensed. Fastest route, lowest engineering burden — and the heaviest dependence on the vendor’s documentation, testing, and instructions for use.
Governance profile: your duties concentrate in IV.B contract review and IV.C monitoring. You did not change the model, so your role stays cleanly on the deployer side — but you also inherit every limitation the provider disclosed, and the exam expects you to have read them.
Fine-tuned
Retrain the model’s weights on your own data. Best task fit — and the biggest role shift. Your training data now needs Domain III-style governance (lawful rights, quality, lineage), your organisation now owns behaviour the upstream provider never tested, and under regimes like the EU AI Act a substantial modification can make you the provider, with the full obligation stack that follows.
Governance profile: Domain III and Domain IV duties both apply. That dual burden is the tested point.
RAG
Retrieval-augmented generation: the model’s weights stay frozen; your documents are retrieved and injected into the prompt at answer time. Grounds outputs in your own sources and reduces hallucination — without retraining.
Governance profile: the risk moves from the model to the retrieval corpus and the pipeline: access controls on what can be retrieved, data-protection duties on what the corpus contains, and staleness of the indexed documents. Exam tell: an option claiming RAG ‘changes the model’ or ‘puts client data into the weights’ is describing fine-tuning, not RAG.
Agentic
The model plans and acts — calls tools, executes multi-step tasks, touches real systems. Highest capability, highest governance intensity: a wrong sentence becomes a wrong action.
Governance profile: everything from the other tabs plus action-level controls — scoped permissions on what tools the agent may call, human checkpoints for consequential actions, logging of every step, and a tested way to stop it (the IV.C deactivation duty arrives early here).
IV.B is the contracts competency. When you buy AI, your governance program runs partly on paper you negotiated. Six clause families recur in exam questions: usage rights (what you may use the system and its outputs for — and what the vendor may do with your data, including training on it), data handling (location, retention, deletion, sub-processors), liability (caps and carve-outs), indemnification (who defends whom — IP claims over training data are the live example), SLAs (uptime, accuracy floors, support response), and audit rights (your ability to inspect, test, or receive assurance reports). A deployer-side impact assessment on the selected system rounds out the competency — it is the deployer’s own duty, not something the vendor’s paperwork satisfies.
One asymmetry the BoK names explicitly: deploying your own proprietary model brings increased obligations and higher potential liability — there is no vendor to share documentation duties or absorb indemnities. ‘Build it ourselves to avoid vendor risk’ is a distractor, not a strategy.
Interactive sorting exercise: Exam-radar drill: which domain is a question testing when it asks about each of these? Drag to Domain III (governing development) or Domain IV (governing deployment and use).
Key terms: retrieval-augmented generation, fine-tuning, agentic AI, deployer, provider, impact assessment
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.