To increase the system’s processing speed<\/span><\/li>\n<\/ol>\nCorrect Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Identifying AI risks before deployment allows an organization to understand potential problems before the system begins affecting real users or making operational decisions. Risk identification may consider privacy, security, fairness, reliability, safety, transparency, and other concerns relevant to the system’s intended purpose. Early identification gives organizations an opportunity to implement appropriate safeguards, modify the system, restrict certain uses, or reconsider deployment when risks are unacceptable. It can also help determine the level of testing, human oversight, documentation, and monitoring required. Although pre-deployment assessment cannot eliminate every possible risk, it provides an important foundation for responsible AI governance and informed deployment decisions.<\/span><\/p>\nQuestion 42<\/b><\/p>\n
Who should generally be responsible for ensuring that an AI system is appropriately governed?<\/b><\/p>\n\n- Only the software developer<\/span><\/li>\n
- Only the end user<\/span><\/li>\n
- A clearly designated owner supported by relevant teams<\/span><\/li>\n
- No specific person or team<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI governance typically requires clear accountability rather than relying on a single technical team or leaving responsibility undefined. A designated system owner can coordinate governance activities while relevant teams contribute specialized expertise. For example, privacy professionals may evaluate privacy concerns, security teams may address cybersecurity risks, legal teams may assess applicable requirements, and technical teams may evaluate model performance. The system owner helps ensure that these responsibilities are coordinated and that decisions are documented. Clear accountability also makes it easier to respond to incidents, conduct reviews, and determine who has authority to approve changes. Effective AI governance is therefore usually a shared organizational responsibility with clearly defined ownership.<\/span><\/p>\nQuestion 43<\/b><\/p>\n
Which action can improve transparency about an AI system?<\/b><\/p>\n\n- Providing information about its purpose, capabilities, and limitations<\/span><\/li>\n
- Hiding known system weaknesses<\/span><\/li>\n
- Preventing users from receiving relevant information<\/span><\/li>\n
- Removing all records about the system<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Transparency can be improved by providing stakeholders with relevant information about an AI system, including its purpose, capabilities, limitations, and appropriate use. The exact information required depends on the context, audience, and level of risk. Users may need to understand when AI is involved, what role it plays in a process, and when human review may be appropriate. Transparency does not mean that organizations must disclose every technical detail or proprietary component. Instead, the goal is to provide meaningful information that supports informed understanding and responsible use. Appropriate transparency can also strengthen accountability because stakeholders are better able to evaluate how an AI system is being used.<\/span><\/p>\nQuestion 44<\/b><\/p>\n
What should an organization establish when defining the intended use of an AI system?<\/b><\/p>\n\n- A clear description of the system’s approved purpose and scope<\/span><\/li>\n
- A rule allowing unlimited uses<\/span><\/li>\n
- A requirement to avoid all documentation<\/span><\/li>\n
- A guarantee that users will never make mistakes<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Defining the intended use and scope of an AI system establishes clear boundaries around how the system is expected to operate. A system developed and validated for one purpose may not be suitable for another purpose, even if its technical capabilities make additional uses possible. Organizations should therefore document the intended purpose, relevant users, operating conditions, and significant restrictions where appropriate. These boundaries can support risk assessments, testing, monitoring, user training, and governance decisions. They can also help prevent function creep, where an AI system gradually begins to be used in situations that were never evaluated. Clearly defining scope helps ensure that system use remains aligned with its validated purpose.<\/span><\/p>\nQuestion 45<\/b><\/p>\n
What should organizations monitor after deploying a higher-risk AI system?<\/b><\/p>\n\n- Only the system’s purchase price<\/span><\/li>\n
- Relevant performance and risk indicators<\/span><\/li>\n
- Only the number of employees using it<\/span><\/li>\n
- Nothing unless the system completely stops working<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Post-deployment monitoring should focus on indicators that help an organization determine whether the AI system continues to perform appropriately and whether new risks are emerging. Depending on the system, relevant indicators may include accuracy, reliability, security events, unexpected outputs, fairness-related measures, user complaints, or other operational metrics. Monitoring should be aligned with the system’s intended purpose and risk level. Organizations can establish thresholds that trigger investigation or corrective action. Monitoring is especially important because real-world conditions may differ from development and testing environments. Effective monitoring therefore provides ongoing visibility into system behavior and helps organizations identify problems before they become more significant.<\/span><\/p>\nQuestion 46<\/b><\/p>\n
What is one potential risk associated with incomplete or inaccurate AI training data?<\/b><\/p>\n\n- Improved fairness in every situation<\/span><\/li>\n
- Guaranteed system reliability<\/span><\/li>\n
- Incorrect or misleading model outputs<\/span><\/li>\n
- Automatic compliance with all applicable requirements<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
Incomplete or inaccurate training data can negatively affect how an AI system learns patterns and generates outputs. Missing information may prevent the system from adequately representing important situations, while incorrect information can cause the model to learn relationships that do not reflect reality. If certain groups or circumstances are poorly represented, the system may also perform differently across populations or contexts. Organizations should therefore evaluate data quality, relevance, completeness, accuracy, and representativeness where appropriate. Data validation and governance practices can help identify problems before they significantly affect model performance. The quality of training data is an important consideration when evaluating the reliability and potential risks of an AI system.<\/span><\/p>\nQuestion 47<\/b><\/p>\n
What is an important characteristic of effective human oversight?<\/b><\/p>\n\n- The reviewer has authority and sufficient information to intervene<\/span><\/li>\n
- The reviewer automatically approves every AI output<\/span><\/li>\n
- The reviewer is never allowed to question the AI<\/span><\/li>\n
- The reviewer has no understanding of the system<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Effective human oversight requires more than simply placing a person into an AI-assisted process. The individual responsible for oversight should have sufficient knowledge, information, authority, and opportunity to meaningfully review the AI system’s output. Where appropriate, the person should be able to reject, modify, or escalate an AI-generated recommendation. If a reviewer is required to approve every output without sufficient time or information, human oversight may become merely symbolic. The design of oversight should therefore reflect the level of risk and the consequences of incorrect decisions. Strong human oversight can provide an important safeguard by allowing qualified individuals to identify errors and intervene when necessary.<\/span><\/p>\nQuestion 48<\/b><\/p>\n
Why should organizations periodically review an AI system’s risk assessment?<\/b><\/p>\n\n- The system’s environment and risk profile may change<\/span><\/li>\n
- Risk assessments are only useful before development<\/span><\/li>\n
- Reviews guarantee that risks disappear<\/span><\/li>\n
- AI risks always remain exactly the same<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI system’s risk profile can change as its technology, data, users, purpose, or operating environment changes. For example, a model may be updated, new data may become available, the system may be integrated with another application, or users may begin relying on it for decisions that were not originally considered. External requirements and emerging risks can also change. Periodic reassessment allows organizations to determine whether existing safeguards remain adequate. The review may consider incidents, performance results, complaints, system changes, new uses, and other relevant information. Regular reassessment supports a lifecycle-based governance approach and helps ensure that risk controls remain appropriate rather than becoming outdated.<\/span><\/p>\nQuestion 49<\/b><\/p>\n
What is an important element of an AI incident reporting process?<\/b><\/p>\n\n- A clearly defined method for escalating significant incidents<\/span><\/li>\n
- A rule preventing employees from reporting problems<\/span><\/li>\n
- Deleting incident information immediately<\/span><\/li>\n
- Allowing only external users to report incidents<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
A well-designed AI incident reporting process should provide clear methods for identifying and escalating problems. Employees and other relevant stakeholders should understand what types of events should be reported, where reports should be submitted, and when escalation is required. Significant incidents may require prompt attention from security, privacy, legal, technical, or executive teams depending on their nature. Organizations can also establish severity levels and response timelines to help prioritize incidents. Maintaining records of incidents allows organizations to identify patterns and evaluate whether corrective measures were effective. Clear reporting and escalation procedures strengthen accountability and help organizations respond consistently when AI-related problems occur.<\/span><\/p>\nQuestion 50<\/b><\/p>\n
Which approach best supports AI risk management throughout the system lifecycle?<\/b><\/p>\n\n- Assessing risk only after an incident<\/span><\/li>\n
- Integrating risk management into planning, development, deployment, and operation<\/span><\/li>\n
- Performing risk assessment only once<\/span><\/li>\n
- Ignoring operational risks<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Effective AI risk management should be integrated throughout the AI system lifecycle rather than treated as a single activity. Risks can emerge during planning, data preparation, development, validation, deployment, operation, modification, and retirement. Each stage can therefore require different governance activities. For example, organizations may conduct impact assessments during planning, data reviews during development, validation before deployment, and ongoing monitoring during operation. Significant changes may also trigger additional assessments. A lifecycle approach allows organizations to respond to new information and changing conditions. It supports continuous improvement and reduces the possibility that important risks will be overlooked simply because they were not apparent at the beginning of the project.<\/span><\/p>\nQuestion 51<\/b><\/p>\n
What can an AI impact assessment help an organization identify?<\/b><\/p>\n\n- Potential effects and harms associated with an AI system<\/span><\/li>\n
- The exact future revenue of the system<\/span><\/li>\n
- The system’s guaranteed accuracy<\/span><\/li>\n
- The number of computers required by every user<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI impact assessment can help an organization identify and evaluate potential effects associated with deploying and using an AI system. Depending on the context, this may include impacts involving individuals, groups, privacy, fairness, security, safety, access, or other relevant interests. The assessment can help organizations determine whether safeguards are necessary and whether the proposed use is appropriate. It may also document affected stakeholders, foreseeable harms, mitigation measures, and remaining risks. An impact assessment does not guarantee that a system will have no negative consequences. Instead, it provides a structured method for understanding potential impacts and supporting better-informed governance and deployment decisions.<\/span><\/p>\nQuestion 52<\/b><\/p>\n
Which practice is most consistent with data minimization?<\/b><\/p>\n\n- Collecting every available piece of information<\/span><\/li>\n
- Collecting only information necessary for the defined purpose<\/span><\/li>\n
- Retaining information indefinitely<\/span><\/li>\n
- Sharing all collected information with every department<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Data minimization involves limiting data collection and processing to information that is necessary and appropriate for a defined purpose. Collecting excessive information can create additional privacy, security, and governance risks without providing corresponding benefits. When designing an AI system, organizations should consider what information is genuinely needed to accomplish the intended objective. They may also evaluate whether less sensitive or less detailed information could achieve the same result. Data minimization can apply to collection, use, access, and retention. Applying this principle helps reduce unnecessary exposure of information and supports more responsible data practices. It should be considered during system design rather than only after problems occur.<\/span><\/p>\nQuestion 53<\/b><\/p>\n
Why can a privacy review be important before deploying an AI system?<\/b><\/p>\n\n- It can help identify potential privacy risks associated with data processing<\/span><\/li>\n
- It guarantees that no privacy risk exists<\/span><\/li>\n
- It eliminates all security responsibilities<\/span><\/li>\n
- It makes data protection unnecessary<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
A privacy review can help organizations identify how an AI system collects, uses, stores, shares, or otherwise processes information relating to individuals. AI systems may create privacy risks through excessive data collection, inappropriate use, unauthorized access, prolonged retention, or unexpected inferences. Reviewing these activities before deployment provides an opportunity to identify risks and implement appropriate safeguards. Depending on the circumstances, controls may include data minimization, access restrictions, retention limits, transparency measures, or other privacy protections. A privacy review cannot guarantee that every future risk will be eliminated, but it can provide an important governance checkpoint before the system begins operating in a real-world environment.<\/span><\/p>\nQuestion 54<\/b><\/p>\n
Why should known AI system limitations be communicated to relevant users?<\/b><\/p>\n\n- To help users make informed decisions about AI outputs<\/span><\/li>\n
- To encourage users to trust every output<\/span><\/li>\n
- To eliminate the need for human judgment<\/span><\/li>\n
- To prevent users from understanding the system<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Communicating known limitations helps users understand when AI-generated outputs may be uncertain, incomplete, or inappropriate. Users who understand the boundaries of a system are better positioned to evaluate its outputs and determine when additional verification or human review is needed. Limitations may involve the types of data the system was trained on, supported use cases, accuracy constraints, known failure conditions, or situations outside its intended scope. Clear communication can reduce overreliance on AI and support responsible use. Organizations should update limitation information when significant changes occur. Providing this information is therefore an important component of transparency, accountability, and effective human oversight.<\/span><\/p>\nQuestion 55<\/b><\/p>\n
Which practice helps protect an AI system from unauthorized production changes?<\/b><\/p>\n\n- Allowing unrestricted administrator access<\/span><\/li>\n
- Implementing access controls and change-management procedures<\/span><\/li>\n
- Sharing production credentials with all users<\/span><\/li>\n
- Removing system logs<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Access controls and change-management procedures help prevent unauthorized modifications to production AI systems. Access should generally be granted according to defined responsibilities, and sensitive administrative privileges should be restricted to authorized personnel. Change-management procedures can require review, approval, testing, documentation, and version tracking before modifications are introduced into production. These controls help organizations maintain system integrity and make it easier to investigate unexpected behavior. Logging can also provide evidence about who made changes and when they occurred. Without appropriate controls, unauthorized or poorly tested modifications could affect system performance, security, reliability, or compliance. Production environments therefore require stronger governance than unrestricted access would provide.<\/span><\/p>\nQuestion 56<\/b><\/p>\n
What is one reason explainability can be valuable for AI governance?<\/b><\/p>\n\n- It can help stakeholders understand and evaluate AI outputs<\/span><\/li>\n
- It guarantees that AI outputs are always correct<\/span><\/li>\n
- It requires every model to be completely simple<\/span><\/li>\n
- It eliminates the need for documentation<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Explainability can support AI governance by helping relevant stakeholders understand why an AI system produced a particular output or how important factors influenced its behavior. This can be useful when users need to evaluate an output, identify potential errors, or determine whether additional human review is necessary. The level and form of explanation should be appropriate to the system and its audience. Explainability does not mean that every model must be completely simple or that proprietary source code must always be disclosed. Instead, organizations should provide meaningful information that supports understanding and accountability. In higher-impact applications, explainability can contribute to responsible decision-making and effective oversight.<\/span><\/p>\nQuestion 57<\/b><\/p>\n
What should employees generally do before entering confidential information into a generative AI tool?<\/b><\/p>\n\n- Confirm that the tool and use are authorized under organizational policies<\/span><\/li>\n
- Assume that every AI tool is secure<\/span><\/li>\n
- Enter the information without checking any requirements<\/span><\/li>\n
- Share the information publicly first<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Employees should verify that a generative AI tool is approved for the intended use and that submitting confidential or sensitive information is permitted. Different AI services may have different data-handling practices, security controls, retention policies, and contractual terms. Organizational policies may restrict the submission of confidential, personal, proprietary, or regulated information to certain tools. Employees should therefore understand the applicable data classification rules and use only authorized services for sensitive workloads. Organizations can support this process through training, approved-tool lists, technical controls, and clear policies. Checking authorization before entering sensitive information reduces the likelihood of accidental disclosure and supports responsible use of generative AI.<\/span><\/p>\nQuestion 58<\/b><\/p>\n
What is a benefit of regularly reviewing AI governance policies?<\/b><\/p>\n\n- It helps ensure policies remain aligned with changing risks and requirements<\/span><\/li>\n
- It guarantees that no AI incidents will occur<\/span><\/li>\n
- It eliminates the need for employee training<\/span><\/li>\n
- It prevents organizations from improving their controls<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Regular policy reviews help organizations determine whether their AI governance framework continues to address current risks, technologies, business practices, and applicable requirements. AI systems and their uses can change rapidly, and new risks may emerge after policies have been established. Reviews can consider lessons from incidents, audits, risk assessments, system changes, regulatory developments, and feedback from employees. Organizations can then update policies, responsibilities, procedures, or controls when necessary. A policy review does not guarantee that incidents will never occur, but it helps maintain a governance framework that is relevant and practical. Continuous policy improvement is therefore an important part of effective AI governance.<\/span><\/p>\nQuestion 59<\/b><\/p>\n
What should organizations evaluate when selecting a third-party AI provider?<\/b><\/p>\n\n- Only the provider’s marketing materials<\/span><\/li>\n
- Relevant security, privacy, performance, and governance practices<\/span><\/li>\n
- Only the appearance of the provider’s website<\/span><\/li>\n
- Whether the provider avoids contractual requirements<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Third-party AI providers can introduce risks because organizations may have limited direct control over the provider’s models, infrastructure, data practices, and update processes. Before adopting a third-party AI service, organizations should evaluate relevant factors such as security controls, privacy practices, data handling, system performance, limitations, incident response, contractual responsibilities, and service changes. The depth of the evaluation should reflect the risk and intended purpose of the AI system. Contracts may also establish responsibilities related to security, confidentiality, data use, and incident notification. Careful vendor assessment helps an organization understand third-party dependencies and determine whether appropriate safeguards are available before the AI system is incorporated into business operations.<\/span><\/p>\nQuestion 60<\/b><\/p>\n
What should an organization do after identifying a significant AI incident?<\/b><\/p>\n\n