To eliminate organizational accountability<\/span><\/li>\n<\/ol>\nCorrect Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI governance committee can provide coordinated oversight of AI activities across an organization. AI systems often involve multiple functions, including business operations, legal, privacy, security, risk management, compliance, and technical teams. A governance committee can help establish consistent policies, review significant AI initiatives, discuss emerging risks, and coordinate decisions between these groups. Its responsibilities should be clearly defined and appropriate to the organization’s size and AI environment. The committee does not replace specialized teams or guarantee that AI systems will never fail. Instead, it provides a mechanism for bringing relevant expertise together and ensuring that important AI governance issues receive appropriate organizational attention.<\/span><\/p>\nQuestion 82<\/b><\/p>\n
Which activity can help determine whether an AI system is appropriate for a specific use case?<\/b><\/p>\n\n- Evaluating the system against its intended purpose and risks<\/span><\/li>\n
- Selecting the system based only on its popularity<\/span><\/li>\n
- Ignoring known limitations<\/span><\/li>\n
- Allowing unlimited use without assessment<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Determining whether an AI system is appropriate for a particular use case requires evaluating its capabilities, limitations, risks, and intended purpose. A system may perform effectively in one context but be unsuitable for another because the data, users, operating environment, or consequences differ. Organizations should consider whether the system has been adequately tested for the proposed use and whether appropriate safeguards are available. The evaluation may include privacy, security, fairness, reliability, and other relevant considerations. Selecting an AI tool solely because it is popular or inexpensive does not establish suitability. A risk-based evaluation helps organizations make more informed decisions before adopting an AI system.<\/span><\/p>\nQuestion 83<\/b><\/p>\n
What is a key benefit of maintaining AI system records throughout the lifecycle?<\/b><\/p>\n\n- Supporting accountability, traceability, and informed oversight<\/span><\/li>\n
- Preventing every possible system error<\/span><\/li>\n
- Eliminating the need for risk assessments<\/span><\/li>\n
- Guaranteeing that regulations never change<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Maintaining appropriate records throughout an AI system’s lifecycle supports accountability and traceability. Records may include information about system ownership, purpose, data, testing, approvals, changes, incidents, monitoring results, and risk assessments. These records help organizations understand how a system was developed and operated and provide evidence that governance processes were performed. They can also support audits, investigations, reassessments, and future system modifications. Recordkeeping does not eliminate AI risks or guarantee perfect compliance. However, without reliable records, it can be difficult to determine who made important decisions, what controls were applied, or how a system changed over time. Good records therefore support effective oversight.<\/span><\/p>\nQuestion 84<\/b><\/p>\n
What should an organization consider when determining the level of human oversight for an AI system?<\/b><\/p>\n\n- The potential consequences and risks of the system’s outputs<\/span><\/li>\n
- Only the model’s name<\/span><\/li>\n
- Only the number of users<\/span><\/li>\n
- The application’s font size<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
The appropriate level of human oversight should be based on the risks and potential consequences associated with an AI system. Systems that support low-impact activities may require limited review, while systems that influence significant decisions may require stronger human involvement. Organizations should consider factors such as the system’s reliability, intended purpose, affected individuals, degree of automation, and potential harm if the system produces an incorrect output. Effective oversight should also ensure that reviewers have enough information and authority to intervene when necessary. A risk-based approach helps avoid both insufficient oversight for high-impact systems and unnecessarily burdensome controls for low-risk applications.<\/span><\/p>\nQuestion 85<\/b><\/p>\n
Why is AI literacy important for employees who use AI systems?<\/b><\/p>\n\n- It helps employees understand appropriate use, limitations, and risks<\/span><\/li>\n
- It guarantees that employees will never make mistakes<\/span><\/li>\n
- It eliminates the need for organizational policies<\/span><\/li>\n
- It prevents employees from using any AI tools<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI literacy helps employees understand how AI systems work at an appropriate level and how to use them responsibly. Employees should recognize that AI outputs may contain errors, biases, or limitations and should understand when human verification is necessary. Training can also explain organizational policies concerning confidential information, approved tools, security, privacy, and acceptable use. AI literacy does not require every employee to become a technical expert. Instead, training should be appropriate to the employee’s responsibilities and the systems they use. A workforce with suitable AI knowledge is better prepared to recognize risks, avoid inappropriate uses, and make informed decisions when interacting with AI systems.<\/span><\/p>\nQuestion 86<\/b><\/p>\n
What is a potential concern when AI systems rely on data from external sources?<\/b><\/p>\n\n- The organization may have limited visibility into the data’s quality or provenance<\/span><\/li>\n
- External data is always inaccurate<\/span><\/li>\n
- External data automatically creates compliance<\/span><\/li>\n
- External data eliminates all privacy risks<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
External data can introduce governance concerns when an organization does not have complete visibility into how the information was collected, processed, validated, or maintained. The organization may need to evaluate the data’s quality, relevance, provenance, licensing, privacy implications, and suitability for the intended AI purpose. Depending on the provider and use case, contractual requirements may also be relevant. External data is not inherently unreliable, but organizations should not assume that it is automatically appropriate simply because it comes from a third party. Performing suitable due diligence helps identify potential problems before the data is incorporated into an AI system or used to influence important outputs.<\/span><\/p>\nQuestion 87<\/b><\/p>\n
What is the purpose of defining AI governance metrics?<\/b><\/p>\n\n- To help evaluate whether governance objectives and controls are working<\/span><\/li>\n
- To guarantee that AI risks disappear<\/span><\/li>\n
- To replace all governance policies<\/span><\/li>\n
- To prevent organizations from monitoring systems<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI governance metrics provide measurable indicators that can help organizations evaluate the effectiveness of their governance activities. Depending on the organization and AI systems involved, metrics might track completion of risk assessments, incident trends, monitoring results, training completion, policy compliance, system reviews, or remediation activities. Useful metrics should be relevant to governance objectives and provide information that can support decision-making. Metrics are not intended to prove that an organization has eliminated every AI risk. Instead, they provide visibility into whether important processes are being performed and whether controls appear to be operating as intended. Appropriate metrics can therefore support oversight, reporting, and continuous improvement.<\/span><\/p>\nQuestion 88<\/b><\/p>\n
What should happen when an AI system undergoes a significant change in purpose?<\/b><\/p>\n\n- The organization should evaluate whether additional risk assessment is necessary<\/span><\/li>\n
- The change should always be ignored<\/span><\/li>\n
- Existing documentation should automatically be deleted<\/span><\/li>\n
- The system should be used without further testing<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
A significant change in an AI system’s purpose can alter its risk profile and may require additional assessment before the new use is approved. A system that was originally designed for a low-impact task could create substantially greater risks if it is later used for a more consequential purpose. The organization should determine whether the new use is within the validated scope and whether additional testing, impact assessment, privacy review, security evaluation, or human oversight is required. Documentation should also be updated to reflect the new purpose and associated controls. Treating significant changes as ordinary operational modifications can result in governance gaps and inappropriate deployment.<\/span><\/p>\nQuestion 89<\/b><\/p>\n
What is an important reason to document AI risk mitigation measures?<\/b><\/p>\n\n- To show how identified risks are being addressed<\/span><\/li>\n
- To guarantee that no risk remains<\/span><\/li>\n
- To eliminate the need for monitoring<\/span><\/li>\n
- To prevent all future system changes<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Documenting risk mitigation measures helps organizations demonstrate how identified AI risks are being addressed and who is responsible for implementing relevant controls. Documentation may describe the risk, selected mitigation, responsible owner, implementation status, and any remaining residual risk. This information supports accountability and allows governance teams to determine whether planned controls have actually been implemented. It can also help during reassessments, audits, and incident investigations. Mitigation measures cannot guarantee that every risk will disappear, and residual risk may remain even after controls are applied. Recording the measures and their effectiveness therefore helps organizations make informed decisions about whether the remaining risk is acceptable.<\/span><\/p>\nQuestion 90<\/b><\/p>\n
Which approach can help reduce overreliance on AI-generated recommendations?<\/b><\/p>\n\n- Providing appropriate human review and communicating system limitations<\/span><\/li>\n
- Presenting every AI output as certain<\/span><\/li>\n
- Removing all information about system weaknesses<\/span><\/li>\n
- Preventing users from questioning outputs<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Overreliance can occur when users assume that AI-generated recommendations are always correct or more reliable than they actually are. Organizations can reduce this risk by communicating relevant system limitations, providing appropriate human oversight, and training users to evaluate AI outputs critically. The level of review should correspond to the potential consequences of an incorrect result. Users should understand when independent verification is necessary and when an AI output should not be treated as a final decision. Interface design and organizational procedures can also support responsible use. These measures encourage informed human judgment rather than automatic acceptance of AI-generated recommendations.<\/span><\/p>\nQuestion 91<\/b><\/p>\n
What is the purpose of establishing an AI approval process?<\/b><\/p>\n\n- To determine whether proposed AI uses meet defined governance requirements<\/span><\/li>\n
- To prevent every employee from using computers<\/span><\/li>\n
- To guarantee perfect model accuracy<\/span><\/li>\n
- To eliminate all organizational policies<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI approval process provides a structured method for evaluating proposed AI systems or uses before they are introduced into an organization. Depending on the risk level, the process may review intended purpose, data use, privacy, security, fairness, testing, contractual requirements, human oversight, and monitoring plans. The process can help ensure that significant risks are identified before deployment and that appropriate stakeholders have an opportunity to review the proposal. Approval requirements should be proportional to risk rather than treating every AI application identically. A well-designed process supports accountability and consistent decision-making while allowing lower-risk uses to move through governance more efficiently.<\/span><\/p>\nQuestion 92<\/b><\/p>\n
Why should AI vendors be subject to appropriate due diligence?<\/b><\/p>\n\n- Third-party services can introduce risks outside the organization’s direct control<\/span><\/li>\n
- Vendors never create risks<\/span><\/li>\n
- Vendor assessments guarantee perfect performance<\/span><\/li>\n
- Due diligence is only relevant after an incident<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Third-party AI vendors may provide models, platforms, data, infrastructure, or other services that become important parts of an organization’s AI environment. Because the organization may not directly control all aspects of a vendor’s operations, appropriate due diligence can help identify risks before a service is adopted. Depending on the use case, due diligence may examine security controls, privacy practices, data handling, performance, incident response, system updates, subcontractors, and contractual obligations. The depth of review should reflect the potential impact of the service. Vendor due diligence does not guarantee that a provider will never experience a problem, but it helps organizations understand dependencies and establish suitable safeguards.<\/span><\/p>\nQuestion 93<\/b><\/p>\n
What is an important purpose of AI system version control?<\/b><\/p>\n\n- To track different versions and support reproducibility and accountability<\/span><\/li>\n
- To prevent all system updates<\/span><\/li>\n
- To eliminate testing requirements<\/span><\/li>\n
- To allow unauthorized modifications<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Version control allows organizations to identify and distinguish different versions of an AI system, model, configuration, or related components. This can be important when investigating unexpected outputs because teams need to know which version was operating at a particular time. Version records can also support controlled deployment, testing, rollback, auditing, and change management. Without version control, it may be difficult to reproduce results or determine whether a change introduced a new problem. Version control does not mean that systems cannot be updated. Instead, it provides traceability and helps ensure that updates are properly identified, reviewed, tested, and documented before or after deployment as appropriate.<\/span><\/p>\nQuestion 94<\/b><\/p>\n
Which practice can support responsible AI procurement?<\/b><\/p>\n\n- Including relevant AI governance requirements in vendor agreements<\/span><\/li>\n
- Ignoring vendor responsibilities<\/span><\/li>\n
- Accepting all vendor claims without review<\/span><\/li>\n
- Avoiding security and privacy requirements<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Including relevant governance requirements in vendor agreements can help establish clear expectations between an organization and an AI provider. Depending on the service and risk, contracts may address data handling, confidentiality, security controls, incident notification, system changes, service availability, audit or assessment rights, and responsibilities for compliance. Contractual requirements should be supported by appropriate due diligence and ongoing oversight rather than relying solely on written promises. Clear agreements can reduce ambiguity about responsibilities if an incident or significant system change occurs. Responsible procurement therefore considers not only the technical capabilities and price of an AI service but also the governance, risk, and accountability requirements associated with its use.<\/span><\/p>\nQuestion 95<\/b><\/p>\n
What is a key reason to establish clear AI system retirement procedures?<\/b><\/p>\n\n- To ensure systems and associated data are appropriately decommissioned<\/span><\/li>\n
- To guarantee that the system can operate forever<\/span><\/li>\n
- To eliminate the need for documentation<\/span><\/li>\n
- To prevent organizations from replacing outdated systems<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI governance should address the retirement of systems as well as their development and operation. When an AI system is no longer needed, has become unsuitable, or presents unacceptable risks, organizations may need to decommission it in a controlled manner. Retirement procedures can address access removal, data retention or deletion, infrastructure changes, records, contractual obligations, and communication with affected stakeholders. Organizations should also consider whether dependent processes or systems need to be updated when an AI service is retired. Proper retirement reduces the possibility that outdated or unsupported systems remain active unnecessarily. It also helps ensure that data and system resources are handled consistently with organizational requirements.<\/span><\/p>\nQuestion 96<\/b><\/p>\n
What should an organization do if monitoring identifies significant deterioration in AI system performance?<\/b><\/p>\n\n- Investigate the cause and determine appropriate corrective action<\/span><\/li>\n
- Ignore the results<\/span><\/li>\n
- Delete the monitoring records<\/span><\/li>\n
- Automatically expand the system’s use<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Significant deterioration in AI system performance should trigger an appropriate investigation rather than being ignored. The organization may need to determine whether the problem is related to changes in data, model behavior, infrastructure, system integrations, user behavior, or other environmental factors. Depending on the severity, corrective actions could include retraining, configuration changes, additional testing, restricting system use, increasing human oversight, or temporarily suspending the system. Monitoring records should be retained as appropriate because they can help investigators understand when and how the deterioration occurred. Responding to performance changes demonstrates that monitoring is connected to meaningful governance actions rather than being performed only for documentation purposes.<\/span><\/p>\nQuestion 97<\/b><\/p>\n
What is the role of an AI risk owner?<\/b><\/p>\n\n- To take responsibility for managing a specific identified AI risk<\/span><\/li>\n
- To guarantee that the risk will never occur<\/span><\/li>\n
- To eliminate all other governance roles<\/span><\/li>\n
- To approve every AI system regardless of risk<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI risk owner is generally responsible for ensuring that a particular identified risk is appropriately evaluated, managed, and monitored. The owner may coordinate mitigation activities, track the status of controls, review residual risk, and escalate concerns when necessary. Risk ownership helps prevent identified risks from becoming unassigned issues that no one is responsible for addressing. The risk owner may rely on other specialists to implement technical, privacy, security, or operational controls. Ownership does not mean the individual can guarantee that a risk will never occur. Instead, it establishes accountability for ensuring that the risk receives appropriate attention and that mitigation activities are tracked and reviewed.<\/span><\/p>\nQuestion 98<\/b><\/p>\n
Why should AI governance include mechanisms for stakeholder feedback?<\/b><\/p>\n\n- Feedback can reveal problems or impacts that formal testing may not identify<\/span><\/li>\n
- Stakeholder feedback always proves that an AI system is safe<\/span><\/li>\n
- Feedback eliminates the need for monitoring<\/span><\/li>\n
- Only technical employees can provide useful feedback<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Stakeholder feedback can provide valuable information about how an AI system performs and affects people in real-world situations. Users, employees, customers, or other affected stakeholders may identify unexpected behaviors, usability problems, inaccurate outputs, unfair outcomes, or other concerns that were not apparent during development testing. Organizations can establish appropriate channels for receiving, documenting, evaluating, and responding to feedback. Feedback should be considered alongside other governance information such as monitoring results, incidents, assessments, and testing. It does not automatically prove that an AI system is safe or compliant. However, incorporating meaningful stakeholder feedback can strengthen oversight and help organizations identify opportunities for improvement.<\/span><\/p>\nQuestion 99<\/b><\/p>\n
What is an important characteristic of an effective AI governance policy?<\/b><\/p>\n\n- It clearly defines applicable responsibilities and expectations<\/span><\/li>\n
- It contains requirements that employees cannot understand<\/span><\/li>\n
- It prohibits all future policy updates<\/span><\/li>\n
- It ignores the organization’s actual AI practices<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An effective AI governance policy should provide clear and practical expectations for how AI systems are developed, acquired, deployed, and used. Depending on the organization, it may define responsibilities, approval requirements, risk management processes, data-handling expectations, human oversight, monitoring, incident reporting, and acceptable use. Policies should be understandable to the people who are expected to follow them and should reflect the organization’s actual AI environment. A policy that is overly vague or disconnected from operational practices may not provide effective governance. Policies should also be reviewed and updated when significant changes occur. Clear responsibilities and practical requirements help translate governance objectives into consistent organizational behavior.<\/span><\/p>\nQuestion 100<\/b><\/p>\n
What is the overall objective of a risk-based approach to AI governance?<\/b><\/p>\n\n