Task 1.1: Understand responsible AI principles

• APseudonymize personal data before it is used to train or evaluate the model

  Incorrect

  Pseudonymization and aggregation are practices of the privacy and security principle.

• BDocument how the system operates and be honest about what it can and cannot do

  Correct

  Explaining how the system works and being honest about capabilities and limitations is how the transparency principle is described.

• CTest the model with balanced demographic samples and monitor results per user segment

  Incorrect

  Balanced testing and per-segment monitoring are techniques of the fairness principle.

• DEnable logging, reporting and auditing so the system's behavior can be reviewed

  Correct

  Enabling auditability through logging, reporting and auditing is part of the transparency principle.

• EOffer screen-reader support and captions so that people with disabilities can use the tool

  Incorrect

  Alternative modes of interaction for people with disabilities belong to the inclusiveness principle.

Transparency is one of the six responsible AI principles that GitHub follows. It means AI systems should be understandable: creators explain how the systems operate, justify design choices, are honest about capabilities and limitations, and enable auditability with logging, reporting and auditing.

• AOverreliance, because an incorrect output was accepted as if it were correct

  Correct

  The card defines overreliance as users accepting incorrect or incomplete AI outputs, mainly because the mistakes are hard to detect.

• BData exfiltration, because scheduling data left the hospital network through chat

  Incorrect

  Nothing in the scenario involves data leaving the network; the harm came from unchecked output.

• CPrompt injection, because the request was altered on its way to the model

  Incorrect

  Prompt injection is hidden or malicious instructions entering the prompt; nothing like that happened here.

• DModel drift, because the model's quality degraded after deployment

  Incorrect

  Drift is not the cause here: the problem is that the output was trusted without verification.

The Copilot Chat application card warns about overreliance: users accept incorrect or incomplete AI outputs, mainly because mistakes in AI outputs may be hard to detect. In consequential or sensitive domains such as healthcare, the card asks users to exercise caution, keep human oversight and verify responses before relying on them.

• ASuggestion quality depends on the volume and diversity of training data for each language

  Correct

  The card states that quality varies by language with the volume and diversity of training data, and that less-represented languages can be harder to assist with.

• BCopilot disables code completion for languages that have no official IDE plugin from GitHub

  Incorrect

  No such rule exists; suggestions work across a broad range of languages.

• CContent filters remove most suggestions in languages that the filters cannot parse

  Incorrect

  Content filters target harmful, offensive or insecure output, not unfamiliar languages.

• DCopilot needs a custom instructions file before it can suggest code in a less common language

  Incorrect

  Custom instructions add context, but the card attributes the gap to training data coverage.

The application card lists limited scope as a limitation: inline suggestions are trained on a large body of code, and for each language the quality depends on the volume and diversity of training data. JavaScript is well represented and one of the best supported languages; languages with less representation in public repositories may be more challenging.

• ASuggestions use the code being written, so they may miss larger design or architectural problems

  Correct

  The card says inline suggestions can only suggest code based on the context being written, so they may not identify larger design or architectural issues.

• BSuggestions are compiled and type-checked before they appear, so syntax errors cannot be shown

  Incorrect

  The card warns that generated code may not be syntactically or semantically correct.

• CAlthough the probability is low, a suggestion can match code that was in the training set

  Correct

  The card lists matches with public code as a limitation: the probability is low but it can happen.

• DWhen the public code filter is set to allow, Copilot stops generating new code and only copies existing code

  Incorrect

  The filter setting only decides whether matches are blocked or shown with references; generation itself is probabilistic.

• EContent filters guarantee that no insecure code pattern is ever suggested to a developer

  Incorrect

  Filters reduce harmful or insecure output, but the card still tells users to review and test generated code.

The inline suggestions card lists limited scope (including not identifying larger design or architectural issues), potential biases, security risks, matches with public code (low probability), and inaccurate code that may not be correct. Users are responsible for reviewing and validating suggestions before accepting them.

• AISO/IEC 27001 controls for planning, doing, checking and acting

  Incorrect

  The Trust Center does not tie the six principles to ISO/IEC 27001.

• BThe OWASP Top 10 for large language model applications

  Incorrect

  OWASP's list is a catalog of vulnerabilities, not the framework named in the Trust Center.

• CSOC 2 trust services criteria for security and availability

  Incorrect

  SOC 2 is an audit report standard, not the framework the Trust Center maps the principles to.

• DThe NIST AI Risk Management Framework: govern, map, measure and manage

  Correct

  The Trust Center says the six principles align with the NIST AI RMF functions govern, map, measure and manage.

GitHub follows Microsoft's Responsible AI Standard in designing, building and testing its AI systems. The GitHub Trust Center says the implementation of these principles aligns with the NIST AI Risk Management Framework functions: govern, map, measure and manage.

• AInclusiveness

  Incorrect

  Inclusiveness is one of the six principles.

• BAccountability

  Incorrect

  Accountability is one of the six principles.

• CProfitability

  Correct

  The six are fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability; profitability is not among them.

• DFairness

  Incorrect

  Fairness is one of the six principles.

As part of its commitment to responsible AI, GitHub adheres to Microsoft's six core principles: fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. They are embedded in the Responsible AI Standard that guides how AI applications are designed, built and tested.

• ATransparency

  Incorrect

  Transparency is about systems being understandable; the problem here is unequal treatment.

• BFairness

  Correct

  Fairness asks AI systems to treat everyone fairly and give consistent recommendations to people in similar situations, such as loan applicants.

• CInclusiveness

  Incorrect

  Inclusiveness concerns accessibility and empowering everyone, not consistent decisions between similar applicants.

• DReliability and safety

  Incorrect

  Reliability and safety concern consistent, safe operation; the issue described is discriminatory outcomes.

The fairness principle says AI systems should treat all people fairly and avoid different impacts on similarly situated groups; in contexts such as loan applications, they should give consistent recommendations to people with similar financial situations. Techniques include reviewing training data, testing with balanced demographic samples and monitoring results across segments.

• AUse a premium model, because premium models are certified for consequential decisions

  Incorrect

  No model is certified for this; the guidance is about how affected people are treated.

• BTurn off public code matching, because sensitive domains require only original code

  Incorrect

  Public code matching is unrelated to the guidance on consequential decisions.

• CAvoid writing automated tests, because test data could expose applicants' personal information

  Incorrect

  Testing is still expected; the guidance concerns decision transparency and appeal.

• DLet affected people understand the decisions, appeal them and update their input data

  Correct

  For consequential decisions in sensitive domains such as housing, the cards ask that impacted stakeholders can understand, appeal and update relevant input data.

Consequential decisions are those that can significantly affect a person's access to things such as housing, healthcare, employment or financial services. Copilot's application cards ask users to exercise caution in these sensitive domains and to make sure impacted stakeholders can understand how decisions are made, appeal decisions and update relevant input data.

• AThe user who accepts and uses the generated code

  Correct

  The card states that users assume all risks associated with generated code, including security vulnerabilities, bugs and IP infringement.

• BGitHub, because the content filters approved the suggestion

  Incorrect

  Content filters reduce risk, but the card places the risk of generated code on users.

• CThe provider of the model that produced the suggestion

  Incorrect

  The card does not shift the risk to model providers.

• DNobody, because AI-generated code is not covered by any license

  Incorrect

  The card explicitly assigns the risks to users.

The inline suggestions application card ends its best practices with an important note: users assume all risks associated with generated code, including security vulnerabilities, bugs and IP infringement. That is why the card asks users to review, test and validate suggestions and to follow secure coding practices.