ISTQB® CT-GenAI syllabus chapter 3: managing the risks of generative AI in testing

In short

Chapter 3 of the ISTQB® CT-GenAI v1.1 syllabus deals with what can go wrong when a tester relies on generative AI, and how to guard against it. It covers four groups of risk: flaws in the output (hallucinations, reasoning errors, biases) and non-deterministic behavior; data privacy and security; energy consumption; and the regulatory and standards landscape. The syllabus allocates 160 minutes of training to it, second only to chapter 2.

This is the chapter that defines the tester's role as a safeguard: generative AI produces fast, but you are the one who checks what it produces and decides what you are allowed to share with it.

What the exam expects

Chapter 3 accounts for 10 of the 40 questions, worth 11 points: 3 K1 questions, 6 K2 questions and 1 K3 question worth 2 points.

Objective	Level	Questions	Points	What you need to be able to do
GenAI-3.1.1	K1	1	1	Recall what hallucinations, reasoning errors and biases are
GenAI-3.1.2	K3	1	2	Spot those three flaws in an LLM output
GenAI-3.1.3	K2	1	1	Summarize the techniques that reduce them
GenAI-3.1.4	K1	1	1	Recall how to limit non-deterministic behavior
GenAI-3.2.1	K2	1	1	Explain the data privacy and security risks
GenAI-3.2.2	K2	2	2	Give examples of vulnerabilities and attack vectors
GenAI-3.2.3	K2	1	1	Summarize the protective measures
GenAI-3.3.1	K2	1	1	Explain what drives energy consumption
GenAI-3.4.1	K1	1	1	Recall examples of regulations, standards and best practice frameworks

Section 3.2 (data privacy and security) carries 4 questions, making it the densest part of the chapter.

Key concepts

Three flaws to tell apart. A hallucination is content that is wrong or irrelevant: a test case that checks a rule missing from the specification, a script that calls a function that does not exist. A reasoning error is a logic failure: a prioritization that contradicts the rules you supplied, an effort estimate that does not add up. A bias comes from the training data and skews the output: test data that only represents one kind of user, non-functional tests that keep getting left out.

Detecting them. For hallucinations: cross-verification against documentation and known behavior, input from domain experts, consistency checks. For reasoning errors: logical validation during reviews, and actually running the generated test cases or scripts. For biases: checking that the generated testware reflects the test strategy and coverage requirements. How much detection effort you invest depends on the risk level of the task.

Reducing them. Provide complete context, break work down with prompt chaining, use clear data formats, pick a model suited to the task, compare results across models. For non-determinism: lower the temperature (more consistency, less diversity) and set a random seed where the tool allows it. None of these measures delivers full reproducibility.

Data privacy and security. On the data side: unintended exposure of sensitive information, loss of control over how data is used, and non-compliance with regulations such as the GDPR. On the security side, the syllabus lists four attack vectors: context manipulation (extracting training data), request manipulation (a crafted input that derails the output), data poisoning (corrupting training data) and malicious code generation (a script that opens a backdoor).

Protecting yourself. Data minimization, anonymization and pseudonymization, encryption and access control, staff training, systematic review of outputs, comparison across models, an operating environment matched to the confidentiality level, regular security audits, and keeping up with best practices. These measures work in combination and should involve security and legal stakeholders.

Energy and regulation. Consumption depends on task complexity and the computing resources involved: generating an image costs far more than generating text, and small uses add up across many users. Cutting unnecessary model interactions is the first good practice. For the regulatory side, the syllabus cites ISO/IEC 42001:2023, ISO/IEC 23053:2022, the EU AI Act and the NIST AI Risk Management Framework.

Common pitfalls

• Labeling every wrong answer a hallucination. If all the elements exist but are wrongly combined or ordered, it is a reasoning error. A hallucination involves something invented or off-topic.
• Treating non-determinism as a content defect. Two different answers to the same prompt is how the model normally works. Setting a seed makes an answer reproducible, not correct.
• Swapping the attack vectors. Ask what is being targeted: training data to extract (context manipulation), training data to corrupt (data poisoning), the request input (request manipulation), or the generated code (malicious code generation).
• Lumping standards, regulations and frameworks together. The EU AI Act is a regulation, the two ISO/IEC documents are standards, and the NIST AI RMF is a framework.

How to study it

Half a day is usually enough, as long as you practice the K3 objective. Ask a chatbot for test cases on a deliberately incomplete user story (a meeting-room booking form works well) and classify every problem you find: hallucination, reasoning error or bias. For section 3.2, build a one-line cheat sheet per attack vector stating what gets manipulated.

Begin with the free level check to measure what you already know. The certification guide gives the overview, the exam guide explains the scoring, and the full course covers every objective with detection exercises. For the change in terminology around "context manipulation", see what changed in syllabus v1.1. Two articles go further: hallucinations, reasoning errors and biases in practice, and shadow AI in QA teams for the data risks.

Frequently asked questions

What is the K3 question in chapter 3?

It targets objective GenAI-3.1.2: identifying a hallucination, a reasoning error or a bias in an LLM output. Like any K3 question, it is scenario-based: expect an excerpt of generated testware (test cases, test data, a plan) where you have to name the type of flaw. It is worth 2 points, close to a fifth of the chapter's total.

Do I need detailed knowledge of the EU AI Act or the GDPR?

No. GenAI-3.4.1 is a K1 objective: you need to recall the regulations, standards and frameworks the syllabus mentions and match each one to its type. For the GDPR, remember that it does not explicitly restrict generative AI, but it does set safeguards on the lawfulness and purposes of data processing.

Do the energy questions involve numbers?

No. Objective GenAI-3.3.1 is at K2 level: you need to understand that consumption depends on the type of task and how the model is used, and that the cumulative effect of many requests is significant. There are no figures to memorize; focus on the factors that drive consumption up or down.