Everything that can go wrong when a test team adopts generative AI is collected here. Hallucinated output that reads as authoritative. Confidential code, customer records or unreleased requirements pasted into a third-party service. Uncertain ownership and licensing of whatever the model produces. Prompt injection arriving through content the system was asked to process. Over-reliance, where review quietly stops happening because the output looks finished. The chapter also covers how an organisation evaluates a provider, and where recognised governance frameworks fit into that decision.
Ten of the 40 questions come from this chapter, worth 11 points, and the mix of levels is the broadest on the paper: three K1, six K2 and one K3. That makes it the one chapter where a recall question and an applied question can sit side by side, so read each stem for what it is actually asking before reaching for a familiar term.
Two habits keep candidates out of trouble here. The first is to remember whose risk is being discussed: this syllabus is about the risks of a tester using generative AI, not about the risks of shipping an AI product, which belongs to a different certification. The second is that the expected answer is almost always proportionate mitigation rather than prohibition — a review step, a redaction rule, a classification policy, a verification pass against a primary source — because an option that bans the technology outright tends to be the distractor.
This chapter is covered most heavily (10 questions) in CT-GenAI — Mock Exam 1 (Prompting for Test Analysis, Test Data and Pilot Governance), CT-GenAI — Mock Exam 2 (Model Behaviour, Technique-Driven Prompting and Operational Risk), CT-GenAI — Mock Exam 3 (Checkable Output, Retrieval Operations and Governance)