The programming language used to build the model<\/span><\/li>\n<\/ol>\nCorrect Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
Determining AI risk requires an organization to consider both the potential impact of a harmful event and the likelihood that the event could occur. A system that can significantly affect individuals may require stronger governance controls than a system with limited consequences. Risk assessment can consider factors such as the system’s purpose, affected individuals, data involved, potential harms, level of automation, and operating environment. Evaluating both impact and likelihood helps an organization prioritize risks and determine appropriate safeguards. This may include additional testing, human oversight, monitoring, documentation, access controls, or restrictions on use. Therefore, potential impact and likelihood are important elements of AI risk assessment.<\/span><\/p>\nQuestion 22<\/b><\/p>\n
Why should an organization assign clear ownership to an AI system?<\/b><\/p>\n\n- To eliminate the need for human involvement<\/span><\/li>\n
- To establish accountability for the system<\/span><\/li>\n
- To guarantee that the AI system never fails<\/span><\/li>\n
- To avoid documenting the system<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Clear ownership helps establish accountability for an AI system throughout its lifecycle. An assigned owner can coordinate activities such as risk assessment, documentation, monitoring, testing, incident management, and periodic reviews. Ownership does not necessarily mean that one person performs every governance activity. Instead, it provides a clear point of responsibility for ensuring that appropriate teams complete their assigned tasks. Legal, privacy, security, technical, business, and compliance teams may all contribute to AI governance. Without clear ownership, responsibilities can become unclear and important controls may be overlooked. Assigning ownership therefore helps an organization maintain accountability and ensures that important governance decisions have responsible individuals or teams behind them.<\/span><\/p>\nQuestion 23<\/b><\/p>\n
Which practice best supports transparency for an AI system?<\/b><\/p>\n\n- Hiding information about system limitations<\/span><\/li>\n
- Providing relevant information about the system and its use<\/span><\/li>\n
- Preventing users from questioning AI outputs<\/span><\/li>\n
- Removing system documentation<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Transparency involves providing appropriate and meaningful information about an AI system to relevant stakeholders. Depending on the circumstances, this information may include the system’s purpose, capabilities, limitations, data sources, significant risks, and how its outputs are used. Transparency helps users and affected individuals develop a more accurate understanding of the system rather than assuming that AI outputs are always correct. The level of information provided should be appropriate for the audience and risk involved. Transparency does not necessarily require disclosure of proprietary source code or confidential technical information. Instead, organizations should communicate information that allows stakeholders to understand the system and make informed decisions about its outputs and use.<\/span><\/p>\nQuestion 24<\/b><\/p>\n
Why should an AI system’s intended purpose be documented?<\/b><\/p>\n\n- To define how the system is expected to be used<\/span><\/li>\n
- To guarantee perfect accuracy<\/span><\/li>\n
- To eliminate the need for testing<\/span><\/li>\n
- To prevent all future system changes<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Documenting the intended purpose of an AI system establishes the specific objective and context for which the system was designed. This information is important because an AI system may perform appropriately within its intended scope but produce unreliable or inappropriate results when used for another purpose. A documented purpose supports risk assessment, testing, monitoring, user guidance, and governance decisions. It also helps organizations identify uses that fall outside the system’s approved scope. Developers, business owners, users, compliance teams, and reviewers can use the documented purpose as a reference when evaluating whether the system continues to operate appropriately. Clearly defining intended use therefore provides an important foundation for effective AI governance.<\/span><\/p>\nQuestion 25<\/b><\/p>\n
What is a key purpose of monitoring an AI system after deployment?<\/b><\/p>\n\n- To prevent users from accessing the system<\/span><\/li>\n
- To identify changes in performance or risk<\/span><\/li>\n
- To eliminate the need for governance<\/span><\/li>\n
- To guarantee identical outputs<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Post-deployment monitoring helps an organization determine whether an AI system continues to perform as expected in its real-world environment. Conditions may change after deployment, including data patterns, user behavior, system integrations, business processes, or external requirements. These changes can affect performance and create new risks. Monitoring may involve tracking accuracy, reliability, security events, unexpected outputs, complaints, fairness indicators, or other relevant metrics. Organizations can establish thresholds that trigger investigation or corrective action when problems occur. Monitoring is especially important for higher-risk systems because pre-deployment testing cannot predict every situation that may arise during actual operation. Continuous oversight helps organizations identify and address emerging issues.<\/span><\/p>\nQuestion 26<\/b><\/p>\n
What is a potential consequence of using poor-quality training data?<\/b><\/p>\n\n- Automatically improved accuracy<\/span><\/li>\n
- Elimination of model bias<\/span><\/li>\n
- Unreliable or biased AI outputs<\/span><\/li>\n
- Automatic compliance with governance requirements<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
The quality of training data can directly affect the performance and behavior of an AI system. If training data contains inaccurate, incomplete, outdated, irrelevant, or systematically biased information, the resulting model may reproduce or amplify those problems. Poor-quality data can therefore contribute to inaccurate predictions, unfair outcomes, unreliable classifications, or other undesirable behavior. Organizations should evaluate data for factors such as accuracy, completeness, relevance, representativeness, provenance, and suitability for the intended purpose. Data governance controls can help identify problems before data is used to train or operate an AI system. Proper data management is therefore an important component of responsible AI development and ongoing risk management.<\/span><\/p>\nQuestion 27<\/b><\/p>\n
Why can human oversight be important for higher-risk AI systems?<\/b><\/p>\n\n- It guarantees that AI outputs are always correct<\/span><\/li>\n
- It allows qualified people to review and intervene when necessary<\/span><\/li>\n
- It eliminates the need for testing<\/span><\/li>\n
- It prevents the system from processing data<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Human oversight can provide an important safeguard when an AI system may produce significant consequences for individuals or organizations. A qualified person can review outputs, recognize unusual circumstances, challenge recommendations, and intervene when the system produces an inappropriate or unreliable result. Effective human oversight requires more than simply having a person somewhere in the process. The person should have sufficient knowledge, information, authority, and time to meaningfully evaluate the AI output. The appropriate level of oversight depends on the system’s risk and intended purpose. Human review can therefore complement technical controls and provide an additional layer of accountability when automated outputs may have important consequences.<\/span><\/p>\nQuestion 28<\/b><\/p>\n
Why should organizations periodically reassess AI system risks?<\/b><\/p>\n\n- AI risks and operating conditions can change over time<\/span><\/li>\n
- AI systems never change after deployment<\/span><\/li>\n
- Reassessment eliminates documentation requirements<\/span><\/li>\n
- Risk assessment is only necessary during development<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI risks should be periodically reassessed because the environment surrounding an AI system can change significantly after deployment. Changes may involve training data, model functionality, system integrations, user populations, business processes, regulations, or emerging threats. These changes can introduce risks that were not identified during the original assessment. Periodic reassessment allows organizations to determine whether existing controls remain appropriate and whether additional safeguards are needed. Reviews can consider performance information, incidents, complaints, changes in intended use, and new external requirements. The frequency of reassessment should be appropriate to the system’s risk and rate of change. This helps ensure that governance remains effective throughout the system lifecycle.<\/span><\/p>\nQuestion 29<\/b><\/p>\n
What should an organization establish to support effective AI incident management?<\/b><\/p>\n\n- A process for identifying, reporting, and responding to incidents<\/span><\/li>\n
- A rule that incidents should never be documented<\/span><\/li>\n
- A requirement to disable all monitoring<\/span><\/li>\n
- A rule allowing only developers to report incidents<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An effective AI incident management process provides a structured method for identifying, documenting, investigating, escalating, and resolving problems involving AI systems. Incidents may include serious model errors, unexpected behavior, privacy events, security problems, harmful outputs, or failures of important controls. Organizations should establish clear reporting channels and define responsibilities for evaluating and responding to incidents. Severity classifications and escalation procedures can help ensure that significant events receive appropriate attention. Incident records can also provide valuable information for identifying recurring problems and improving controls. Restricting incident reporting or failing to document events can prevent organizations from learning from failures. A structured incident process therefore supports accountability and continuous improvement.<\/span><\/p>\nQuestion 30<\/b><\/p>\n
What does lifecycle-based AI risk management emphasize?<\/b><\/p>\n\n- Managing risk only after an AI system fails<\/span><\/li>\n
- Addressing risks throughout the AI system lifecycle<\/span><\/li>\n
- Focusing only on model development<\/span><\/li>\n
- Eliminating all human decisions<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Lifecycle-based AI risk management recognizes that risks can arise during every stage of an AI system’s existence. Relevant stages may include planning, data collection, development, testing, deployment, operation, modification, monitoring, and retirement. Addressing risks only during development may leave important operational problems unresolved. A lifecycle approach allows organizations to establish appropriate controls at different stages. For example, an organization may conduct an impact assessment before deployment, validate the system before production use, monitor performance after deployment, and review the system when significant changes occur. This approach also supports continuous improvement because information obtained during operation can be used to strengthen future governance activities and risk controls.<\/span><\/p>\nQuestion 31<\/b><\/p>\n
What is the primary purpose of an AI impact assessment?<\/b><\/p>\n\n- To determine the potential effects of an AI system<\/span><\/li>\n
- To calculate the system’s purchase price<\/span><\/li>\n
- To replace all technical testing<\/span><\/li>\n
- To prove that the system has no risks<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI impact assessment is used to systematically consider how an AI system may affect individuals, groups, organizations, or society. Depending on the context, an assessment may examine potential privacy, fairness, safety, security, transparency, accountability, and other risks. The purpose is not to demonstrate that an AI system has zero risk. Instead, the assessment helps identify foreseeable impacts and determine whether appropriate mitigation measures are required. It can document affected stakeholders, potential harms, assumptions, safeguards, and remaining risks. Conducting an assessment before or during deployment can help organizations make more informed decisions about whether a system is appropriate for its intended purpose and what governance controls should be implemented.<\/span><\/p>\nQuestion 32<\/b><\/p>\n
What does the principle of data minimization generally require?<\/b><\/p>\n\n- Collecting the maximum amount of available data<\/span><\/li>\n
- Limiting data to what is necessary and appropriate for the purpose<\/span><\/li>\n
- Avoiding every type of data processing<\/span><\/li>\n
- Retaining all information indefinitely<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Data minimization generally means that organizations should limit the collection, use, or retention of data to what is necessary and appropriate for a defined purpose. This principle is particularly relevant to AI systems because models may process large quantities of information, including information that could be sensitive or personal. Collecting unnecessary data can increase privacy, security, and governance risks without providing meaningful benefits. Organizations should therefore consider whether each category of information is relevant to the intended purpose and whether the same objective could be achieved with less data. Applying data minimization during system design can reduce unnecessary exposure and support more responsible AI data practices.<\/span><\/p>\nQuestion 33<\/b><\/p>\n
Why should privacy considerations be incorporated into AI system development?<\/b><\/p>\n\n- AI systems may process personal information<\/span><\/li>\n
- Privacy only matters after an incident<\/span><\/li>\n
- Privacy reviews eliminate every AI risk<\/span><\/li>\n
- AI systems cannot process personal information<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Privacy considerations are important because AI systems may collect, analyze, infer, store, or generate information relating to individuals. Privacy risks can arise from excessive collection, inappropriate use, unauthorized access, excessive retention, re-identification, or unexpected inferences. Considering privacy during development allows organizations to identify these issues earlier and design appropriate safeguards. Depending on the circumstances, safeguards may include data minimization, access controls, retention limits, privacy assessments, and restrictions on sensitive information. Privacy should not be treated only as an incident-response activity. Incorporating privacy considerations into the AI lifecycle can help organizations reduce foreseeable risks and ensure that data processing is appropriate for the system’s intended purpose.<\/span><\/p>\nQuestion 34<\/b><\/p>\n
Why is it important to document the limitations of an AI system?<\/b><\/p>\n\n- To help users understand when outputs may be unreliable<\/span><\/li>\n
- To make the system appear perfect<\/span><\/li>\n
- To eliminate user training<\/span><\/li>\n
- To prevent system updates<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Documenting AI system limitations helps users and stakeholders understand situations in which the system may not perform reliably. Limitations may relate to accuracy, training data, supported inputs, model capabilities, known failure conditions, or situations outside the intended purpose. Without clear information about limitations, users may place excessive confidence in AI-generated outputs and make inappropriate decisions. Documentation can help users apply appropriate judgment and understand when human review is necessary. It can also support testing, monitoring, and governance activities. As the system changes, limitations should be reviewed and updated where appropriate. Clear limitation documentation therefore contributes to transparency, responsible use, and better-informed decision-making.<\/span><\/p>\nQuestion 35<\/b><\/p>\n
Which practice best supports controlled changes to an AI system?<\/b><\/p>\n\n- Allowing anyone to modify the production system<\/span><\/li>\n
- Maintaining documented change-management procedures<\/span><\/li>\n
- Removing records of system changes<\/span><\/li>\n
- Making changes without testing<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Change management helps organizations control modifications to AI systems and understand their potential consequences. Changes may involve models, training data, prompts, configurations, infrastructure, integrations, or intended use. A documented change-management process can require appropriate review, testing, approval, version control, and deployment procedures. This creates traceability and makes it easier to determine which version of a system was operating when an issue occurred. Uncontrolled changes can introduce new risks or cause unexpected behavior without adequate review. Change management is therefore important for maintaining reliability, security, accountability, and governance. The level of control should be proportional to the significance and risk associated with the proposed change.<\/span><\/p>\nQuestion 36<\/b><\/p>\n
What does explainability generally seek to provide?<\/b><\/p>\n\n- Meaningful information about how or why an AI output was produced<\/span><\/li>\n
- A guarantee that every AI model is simple<\/span><\/li>\n
- Complete disclosure of proprietary source code<\/span><\/li>\n
- Removal of human oversight<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Explainability generally involves providing meaningful information that helps relevant stakeholders understand an AI system’s outputs or behavior. The appropriate level of explanation depends on the system, its purpose, the audience, and the potential consequences of its outputs. Explainability does not necessarily require revealing proprietary source code or every technical detail of a model. Instead, an organization may explain important factors, limitations, processes, or reasons relevant to an output or decision. Meaningful explanations can support accountability and allow users or reviewers to better understand when an AI result should be questioned. For higher-impact applications, explainability can be particularly valuable for supporting informed human review and oversight.<\/span><\/p>\nQuestion 37<\/b><\/p>\n
What is an important governance consideration when employees use generative AI tools?<\/b><\/p>\n\n- Employees should enter confidential information whenever possible<\/span><\/li>\n
- Organizations should establish rules for handling sensitive information<\/span><\/li>\n
- Security controls are unnecessary<\/span><\/li>\n
- All generated information is automatically confidential<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Generative AI tools can create privacy and security risks when employees enter confidential, proprietary, personal, or sensitive information into them. Organizations should establish clear policies describing which AI tools are approved and what categories of information may be submitted. Depending on the environment, technical controls may also help restrict unauthorized use or prevent sensitive information from being entered into inappropriate services. Employees should understand that AI providers can have different data-handling practices and configurations. Governance should therefore address approved tools, data classification, access controls, vendor requirements, and employee responsibilities. Clear rules help organizations gain the benefits of generative AI while reducing unnecessary privacy, confidentiality, and security risks.<\/span><\/p>\nQuestion 38<\/b><\/p>\n
Why should AI governance policies be reviewed periodically?<\/b><\/p>\n\n- Regulations, risks, technologies, and organizational practices can change<\/span><\/li>\n
- Governance policies should never change<\/span><\/li>\n
- Policy reviews eliminate the need for implementation<\/span><\/li>\n
- Policies are only relevant during development<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI governance policies should be reviewed periodically to ensure that they continue to address the organization’s current risks and operating environment. AI capabilities can evolve rapidly, new risks may emerge, regulations may change, and organizations may adopt new business processes or AI applications. A policy that was appropriate when created may therefore become incomplete or outdated. Periodic reviews provide an opportunity to evaluate whether responsibilities remain clear, controls are still appropriate, and requirements are practical for employees to follow. Organizations can also incorporate lessons learned from incidents, assessments, audits, and system changes. Regular policy review supports continuous improvement and helps maintain an effective AI governance framework.<\/span><\/p>\nQuestion 39<\/b><\/p>\n
What should an organization consider when procuring an AI system from a third-party provider?<\/b><\/p>\n\n- Only the visual appearance of the system<\/span><\/li>\n
- The provider’s risk, security, privacy, and governance practices<\/span><\/li>\n
- Whether the system has the lowest possible price<\/span><\/li>\n
- Whether the provider avoids all documentation<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Third-party AI systems can introduce risks that an organization may not fully control internally. During procurement, organizations should therefore evaluate relevant aspects of the provider and the service, including security practices, privacy protections, data handling, system limitations, performance, incident processes, and contractual responsibilities. Depending on the use case, organizations may also need information about training data, model updates, monitoring, audit rights, and how the provider handles customer information. Procurement requirements should be proportionate to the AI system’s risk and intended use. Evaluating these factors before adoption helps organizations understand third-party dependencies and establish appropriate contractual and operational safeguards.<\/span><\/p>\nQuestion 40<\/b><\/p>\n
What is an important objective of post-incident review for an AI system?<\/b><\/p>\n\n