Allowing every employee to register systems independently<\/span><\/li>\n<\/ol>\nCorrect Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI system inventory provides an organization with visibility into where and how AI is being used. It should identify relevant AI systems, their business purposes, owners, data sources, vendors, deployment environments, and risk characteristics. Recording only revenue-generating systems can overlook important internal or experimental systems. Likewise, immediately removing legacy systems is not an inventory activity, and unrestricted employee registration may produce incomplete or inconsistent information. A centralized inventory process helps governance teams understand the organization\u2019s AI landscape and determine which systems require additional assessments, controls, monitoring, or approval. Maintaining accurate inventory information also supports accountability and makes it easier to respond to audits, incidents, regulatory inquiries, and changes in organizational risk.<\/span><\/p>\nQuestion 102<\/b><\/h3>\n
What is the primary benefit of conducting an AI impact assessment before deployment?<\/b><\/p>\n\n- To eliminate the need for human oversight<\/span><\/li>\n
- To guarantee that an AI model will never fail<\/span><\/li>\n
- To identify potential impacts and risks before the system is used<\/span><\/li>\n
- To increase the amount of data collected<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI impact assessment is designed to identify and evaluate potential effects of an AI system before deployment or during significant changes. It can consider issues involving privacy, fairness, safety, security, transparency, affected individuals, and organizational responsibilities. The assessment cannot guarantee that a system will never fail, nor does it eliminate the need for human oversight. Increasing data collection is also not its purpose. Instead, the assessment gives decision-makers structured information about possible harms and helps determine whether mitigation measures are necessary. Conducting this work early can allow an organization to modify the system, restrict its use, improve controls, or decide that deployment should not proceed under the proposed conditions.<\/span><\/p>\nQuestion 103<\/b><\/h3>\n
Which control best supports accountability for an AI system?<\/b><\/p>\n\n- Assigning a clearly identified owner responsible for the system<\/span><\/li>\n
- Allowing anonymous changes to production models<\/span><\/li>\n
- Removing documentation after deployment<\/span><\/li>\n
- Giving all employees unrestricted administrative access<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Clear ownership is a fundamental accountability control for AI governance. An identified system owner or responsible business function can coordinate risk assessments, approvals, monitoring, documentation, incident response, and periodic reviews. Without ownership, it can be difficult to determine who is responsible for decisions made about the AI system or who should respond when problems occur. Anonymous production changes, removal of documentation, and unrestricted administrative access weaken accountability and increase operational risk. Ownership does not mean that one person performs every governance activity; instead, it establishes responsibility and helps coordinate relevant technical, legal, compliance, security, privacy, and business stakeholders throughout the AI system lifecycle.<\/span><\/p>\nQuestion 104<\/b><\/h3>\n
An organization discovers that an AI system is being used for a purpose that was not included in its original approval. What should happen first?<\/b><\/p>\n\n- Ignore the change if the system is performing well<\/span><\/li>\n
- Expand access to additional employees<\/span><\/li>\n
- Remove all historical records<\/span><\/li>\n
- Review the changed use against governance and risk requirements<\/span><\/li>\n<\/ol>\n
Correct Answer: 4<\/b><\/p>\n
Explanation<\/b><\/p>\n
A change in an AI system\u2019s purpose can introduce new risks even when the underlying model has not changed. The organization should therefore review the new use against its governance requirements, approved scope, risk assessment, data practices, and applicable controls. Performance alone does not demonstrate that the new purpose is appropriate. Expanding access could increase exposure, while removing historical records would make governance and accountability more difficult. A proper review may determine that additional testing, impact assessment, privacy analysis, stakeholder approval, or documentation is necessary. Organizations should treat material changes in intended use as lifecycle events requiring appropriate governance rather than assuming that the original approval automatically covers every future application.<\/span><\/p>\nQuestion 105<\/b><\/h3>\n
Why is data provenance important in AI governance?<\/b><\/p>\n\n- It identifies where data originated and how it was handled<\/span><\/li>\n
- It guarantees that every prediction is correct<\/span><\/li>\n
- It eliminates the need for data quality testing<\/span><\/li>\n
- It prevents all cybersecurity incidents<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Data provenance provides information about the origin, history, transformations, and handling of data used by an AI system. This information can help organizations evaluate whether data was obtained appropriately, understand how it changed over time, investigate quality problems, and support accountability. Provenance does not guarantee prediction accuracy, eliminate the need for data quality testing, or prevent cybersecurity incidents. However, it can make those areas easier to investigate and manage. When an unexpected model behavior occurs, knowing which datasets were used and how they were processed can help teams identify potential causes. Strong provenance practices therefore contribute to transparency, reproducibility, governance, and responsible lifecycle management.<\/span><\/p>\nQuestion 106<\/b><\/h3>\n
Which situation is most likely to require additional human oversight of an AI system?<\/b><\/p>\n\n- An AI tool generating internal formatting suggestions<\/span><\/li>\n
- An AI system making recommendations that could significantly affect individuals<\/span><\/li>\n
- A calculator performing basic arithmetic<\/span><\/li>\n
- A program sorting files alphabetically<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
The need for human oversight generally increases when an AI system can produce decisions or recommendations with significant consequences for individuals. Examples may include employment, financial access, education, healthcare, safety, or other high-impact contexts. Human review can provide an opportunity to challenge outputs, identify errors, consider context that the system may not understand, and prevent inappropriate reliance on automated recommendations. Low-impact tasks such as formatting suggestions, basic arithmetic, or alphabetical sorting generally present much lower consequences. The appropriate level of oversight should be based on factors such as potential harm, system capability, uncertainty, affected populations, and the importance of the decisions being supported.<\/span><\/p>\nQuestion 107<\/b><\/h3>\n
What is the purpose of maintaining an AI system change log?<\/b><\/p>\n\n- To prevent employees from using AI<\/span><\/li>\n
- To replace all system documentation<\/span><\/li>\n
- To record significant modifications made to the system<\/span><\/li>\n
- To guarantee regulatory approval<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI system change log records meaningful modifications made during the system lifecycle. Depending on the organization and system, this may include model updates, data changes, configuration changes, new integrations, changes to intended use, security modifications, or updates to governance controls. A change log supports traceability by allowing teams to understand what changed, when it changed, who authorized it, and potentially why the change was made. It does not replace broader documentation or guarantee regulatory approval. Instead, it complements other governance processes by helping organizations investigate incidents, compare system versions, perform audits, and determine whether a change should trigger additional testing or risk assessment.<\/span><\/p>\nQuestion 108<\/b><\/h3>\n
Which practice is most appropriate when an organization uses an external AI provider?<\/b><\/p>\n\n- Assume the provider manages every organizational risk<\/span><\/li>\n
- Avoid documenting the provider relationship<\/span><\/li>\n
- Perform appropriate vendor and AI risk due diligence<\/span><\/li>\n
- Give the provider unrestricted access to internal information<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
Using an external AI provider does not automatically transfer all governance responsibilities away from the organization. Appropriate vendor due diligence can help evaluate the provider\u2019s security practices, data handling, model governance, reliability, privacy commitments, incident response capabilities, contractual terms, and relevant controls. Organizations should understand what the provider does with submitted data, how information is retained, and what responsibilities each party has. Assuming the provider manages every risk can create significant gaps. Similarly, undocumented relationships and unrestricted access can increase exposure. Contracts and ongoing monitoring should reflect the organization\u2019s risk requirements. Vendor governance should therefore be treated as an important component of the AI system lifecycle.<\/span><\/p>\nQuestion 109<\/b><\/h3>\n
What is the best reason to establish criteria for AI system retirement?<\/b><\/p>\n\n- To ensure outdated or unsuitable systems are appropriately decommissioned<\/span><\/li>\n
- To prevent all future AI development<\/span><\/li>\n
- To avoid keeping any documentation<\/span><\/li>\n
- To increase the number of active AI systems<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI systems may eventually become outdated, unreliable, unnecessary, too costly, incompatible with new requirements, or inappropriate for continued use. Retirement criteria help an organization determine when a system should be decommissioned rather than allowing it to remain active indefinitely. A retirement process should address issues such as data retention, access removal, dependencies, contractual obligations, records, security, and communication with affected stakeholders. Retiring a system does not mean stopping future AI development, and it should not involve simply deleting documentation without considering recordkeeping requirements. Effective retirement governance reduces risks associated with abandoned systems and ensures that decommissioning is deliberate, documented, and appropriately controlled.<\/span><\/p>\nQuestion 110<\/b><\/h3>\n
Which metric would be most useful for monitoring AI governance effectiveness?<\/b><\/p>\n\n- Number of office meetings held<\/span><\/li>\n
- Number of governance reviews completed on schedule<\/span><\/li>\n
- Number of employees with personal smartphones<\/span><\/li>\n
- Amount of office space occupied<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Governance metrics should provide meaningful evidence about whether governance processes are operating as intended. Tracking the number of AI governance reviews completed on schedule can help determine whether required assessments and oversight activities are being performed consistently. Other useful metrics might include unresolved AI incidents, completion of required training, overdue risk assessments, policy exceptions, monitoring coverage, or remediation timelines. Office meetings, smartphone ownership, and office space do not directly demonstrate AI governance effectiveness. Well-designed metrics should be connected to defined governance objectives and should help leadership identify weaknesses, trends, and areas requiring corrective action. Metrics are most valuable when they support decisions rather than simply measuring activity.<\/span><\/p>\nQuestion 111<\/b><\/h3>\n
What should an organization consider when defining AI system access controls?<\/b><\/p>\n\n- Whether access is appropriate for each user\u2019s role and responsibilities<\/span><\/li>\n
- Whether every employee should receive administrator privileges<\/span><\/li>\n
- Whether authentication can be eliminated<\/span><\/li>\n
- Whether sensitive information can be shared without restrictions<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI system access should generally follow principles such as least privilege, role-based access, authentication, authorization, and appropriate segregation of duties. Users should receive the level of access necessary to perform their responsibilities, rather than broad administrative privileges by default. This is particularly important when AI systems process confidential information, influence important decisions, or connect to other organizational resources. Eliminating authentication or allowing unrestricted sharing of sensitive information can create significant security and privacy risks. Access controls should also be reviewed periodically because employee roles, system functions, and organizational requirements can change. Effective access governance helps reduce unauthorized use, inappropriate disclosure, and accidental or malicious modifications.<\/span><\/p>\nQuestion 112<\/b><\/h3>\n
Which approach best supports trustworthy AI system documentation?<\/b><\/p>\n\n- Document only successful test results<\/span><\/li>\n
- Keep documentation limited to technical model specifications<\/span><\/li>\n
- Maintain relevant information about purpose, data, risks, controls, and lifecycle decisions<\/span><\/li>\n
- Delete documentation after deployment<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
Useful AI documentation should provide enough information for appropriate stakeholders to understand how a system is intended to operate and how it is governed. Depending on the system, documentation may cover its purpose, scope, users, data sources, model characteristics, limitations, testing, risks, mitigations, approvals, monitoring, changes, incidents, and retirement decisions. Documenting only successful tests creates an incomplete picture and may hide known weaknesses. Technical specifications alone may not address governance concerns, while deleting documentation after deployment undermines traceability. Documentation should be maintained throughout the lifecycle and updated when meaningful changes occur. Good records support accountability, audits, troubleshooting, oversight, and informed decision-making.<\/span><\/p>\nQuestion 113<\/b><\/h3>\n
An AI model begins producing less accurate results after a significant change in its operating environment. What is the most appropriate response?<\/b><\/p>\n\n- Ignore the change because the model was previously approved<\/span><\/li>\n
- Investigate performance deterioration and determine whether remediation is required<\/span><\/li>\n
- Delete all monitoring records<\/span><\/li>\n
- Automatically increase the model\u2019s access privileges<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI performance can change when data distributions, user behavior, operational conditions, integrations, or other environmental factors change. A decline in performance should therefore trigger investigation rather than being ignored because the model was previously approved. The organization may need to examine monitoring results, compare current performance with established thresholds, identify possible causes, test the system, and implement remediation. Depending on the severity, it may also be necessary to restrict use or escalate the issue through incident or governance procedures. Deleting monitoring records would reduce visibility, while increasing access privileges does not address the underlying performance problem. Continuous monitoring helps organizations identify these issues before they become more serious.<\/span><\/p>\nQuestion 114<\/b><\/h3>\n
Why should AI governance policies define escalation procedures?<\/b><\/p>\n\n- To ensure significant risks or incidents reach appropriate decision-makers<\/span><\/li>\n
- To prevent employees from reporting problems<\/span><\/li>\n
- To eliminate the need for monitoring<\/span><\/li>\n
- To guarantee that every issue is handled by one person<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Escalation procedures help ensure that important AI risks, incidents, policy violations, or unexpected system behaviors are communicated to the appropriate people or functions. A clear escalation path can define when an issue should be reported, who should receive it, what information should be included, and what actions may be required. This is particularly valuable for high-impact systems where delays can increase potential harm. Escalation does not prevent reporting or eliminate monitoring. It also does not require every issue to be handled by one person. Instead, it connects operational teams with appropriate governance, legal, privacy, security, risk, compliance, or executive stakeholders when an issue exceeds predefined thresholds.<\/span><\/p>\nQuestion 115<\/b><\/h3>\n
Which activity is most useful for evaluating an AI vendor before entering into a contract?<\/b><\/p>\n\n- Reviewing only the vendor\u2019s marketing materials<\/span><\/li>\n
- Asking whether the vendor has any competitors<\/span><\/li>\n
- Assessing relevant security, privacy, governance, and contractual practices<\/span><\/li>\n
- Allowing unrestricted testing with production data<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
Vendor evaluation should provide evidence about whether an external provider can meet the organization\u2019s requirements. Depending on the AI service, due diligence may examine security controls, privacy and data-use practices, model governance, reliability, incident response, subcontractors, data retention, intellectual property terms, audit rights, regulatory responsibilities, and business continuity. Marketing materials may be useful background information but are not sufficient evidence for a meaningful risk assessment. Giving a vendor unrestricted access to production data before appropriate safeguards are established can create unnecessary risk. A structured evaluation helps the organization identify weaknesses, negotiate appropriate contractual protections, and determine whether the provider is suitable for the intended use case.<\/span><\/p>\nQuestion 116<\/b><\/h3>\n
What is the primary purpose of AI literacy training for employees?<\/b><\/p>\n\n- To make every employee an AI engineer<\/span><\/li>\n
- To help employees understand appropriate AI use, limitations, and risks<\/span><\/li>\n
- To eliminate organizational AI policies<\/span><\/li>\n
- To ensure employees never question AI outputs<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI literacy helps employees understand how AI systems are used, what their capabilities and limitations are, and what risks may arise from inappropriate use. Employees do not need to become AI engineers to benefit from appropriate training. Depending on their roles, training may address responsible use, confidentiality, privacy, security, bias, human oversight, verification of outputs, reporting procedures, and organizational policies. Effective AI literacy should encourage employees to recognize uncertainty and question outputs when appropriate rather than blindly trusting automated results. Training can therefore support responsible adoption by giving employees practical knowledge for making informed decisions when interacting with or relying on AI systems.<\/span><\/p>\nQuestion 117<\/b><\/h3>\n
What should an organization do when an AI system has a known limitation that could affect important decisions?<\/b><\/p>\n\n- Hide the limitation from users<\/span><\/li>\n
- Document the limitation and establish appropriate controls or warnings<\/span><\/li>\n
- Increase reliance on the system<\/span><\/li>\n
- Remove all human review<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Known limitations should be documented and communicated to the stakeholders who need that information to use the system responsibly. Appropriate controls may include human review, warnings, restricted use cases, additional testing, confidence thresholds, user training, or requirements to verify outputs independently. Hiding a known limitation can lead users to develop an inaccurate understanding of system capabilities and increase the chance of harmful reliance. Increasing reliance or removing human review would generally make the situation worse when the limitation is relevant to important decisions. Transparent documentation helps organizations and users understand where an AI system should and should not be relied upon.<\/span><\/p>\nQuestion 118<\/b><\/h3>\n
Which principle is most relevant when an organization collects only the information necessary for a defined AI purpose?<\/b><\/p>\n\n- Data minimization<\/span><\/li>\n
- Unlimited data retention<\/span><\/li>\n
- Maximum data collection<\/span><\/li>\n
- Unrestricted secondary use<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Data minimization refers to limiting the collection or use of data to what is necessary and appropriate for a defined purpose. In AI governance, this principle can reduce privacy, security, compliance, and operational risks associated with collecting unnecessary information. Collecting as much data as possible is not automatically beneficial, particularly when additional information introduces greater exposure without improving the system\u2019s legitimate purpose. Data minimization should be considered alongside purpose definition, retention, access controls, data quality, and applicable legal or organizational requirements. Applying it consistently can help organizations avoid unnecessary data accumulation while encouraging more disciplined decisions about what information an AI system actually needs.<\/span><\/p>\nQuestion 119<\/b><\/h3>\n
Which practice best supports continuous improvement in AI governance?<\/b><\/p>\n\n- Conducting periodic reviews and updating controls based on lessons learned<\/span><\/li>\n
- Freezing governance processes permanently<\/span><\/li>\n
- Ignoring incident findings after resolution<\/span><\/li>\n
- Preventing stakeholders from providing feedback<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI governance should evolve as systems, risks, regulations, organizational practices, and stakeholder expectations change. Periodic reviews can help organizations evaluate whether policies and controls remain effective. Lessons from incidents, audits, monitoring results, user feedback, testing, and new risks can then be used to improve governance processes. Permanently freezing policies can leave organizations unprepared for changing conditions. Similarly, ignoring incident findings or preventing stakeholder feedback removes valuable information that could reveal weaknesses. Continuous improvement does not necessarily mean changing every control frequently; rather, it means using evidence to determine when changes are appropriate and ensuring that governance remains aligned with the organization\u2019s AI risk environment.<\/span><\/p>\nQuestion 120<\/b><\/h3>\n
Which statement best describes a risk-based approach to AI governance?<\/b><\/p>\n\n