The brand of computer used by employees<\/span><\/li>\n<\/ol>\nCorrect Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
The potential impact of an AI system is an important factor when determining its risk level. Systems that can significantly affect individuals, organizations, safety, rights, privacy, or access to important opportunities generally require greater scrutiny than systems used for low-impact activities. Risk evaluation may also consider the likelihood of harm, the sensitivity of the data involved, the system\u2019s level of autonomy, the affected population, and the ability to detect or correct errors. Cosmetic interface characteristics, office locations, or employee computer brands are generally not meaningful indicators of AI risk. A risk-based assessment helps organizations determine which governance controls and oversight measures should be proportionate to the system\u2019s circumstances.<\/span><\/p>\nQuestion 122<\/b><\/h3>\n
What is the primary purpose of establishing AI system approval criteria?<\/b><\/p>\n\n- To provide consistent requirements for determining whether a system may be deployed<\/span><\/li>\n
- To prevent all employees from accessing AI systems<\/span><\/li>\n
- To guarantee perfect model performance<\/span><\/li>\n
- To eliminate the need for monitoring<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI approval criteria provide a structured basis for determining whether an AI system is ready and appropriate for deployment. Criteria may address risk assessments, testing results, security and privacy requirements, documentation, human oversight, legal considerations, data governance, and defined limitations. Consistent criteria reduce the possibility that systems will be approved based solely on informal judgment or business pressure. Approval does not guarantee perfect performance, eliminate the need for monitoring, or require that employees be prevented from using AI altogether. Instead, it establishes a controlled decision point before deployment. Organizations can also define different approval requirements based on the risk level and intended use of each AI system.<\/span><\/p>\nQuestion 123<\/b><\/h3>\n
An AI system produces an unexpected result that could potentially harm users. What should the organization do?<\/b><\/p>\n\n- Suppress the result from all records<\/span><\/li>\n
- Follow the established AI incident response and escalation process<\/span><\/li>\n
- Automatically deploy a new model without investigation<\/span><\/li>\n
- Ignore the event if it happens only once<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
An unexpected AI result with potential harm should be handled through the organization\u2019s established incident management and escalation procedures. These processes help ensure that the event is documented, assessed, investigated, and communicated to the appropriate stakeholders. Depending on severity, the organization may temporarily restrict the system, preserve relevant evidence, identify affected parties, investigate root causes, and implement corrective actions. Automatically replacing the model without investigation could remove useful evidence and fail to address the underlying problem. Similarly, a single event should not automatically be ignored because frequency alone does not determine severity. A well-designed incident process enables timely and consistent responses to AI-related problems.<\/span><\/p>\nQuestion 124<\/b><\/h3>\n
Which practice best helps an organization identify unauthorized AI use?<\/b><\/p>\n\n- Maintaining visibility into AI systems and monitoring relevant usage<\/span><\/li>\n
- Removing all AI policies<\/span><\/li>\n
- Allowing employees to use any AI service without restrictions<\/span><\/li>\n
- Disabling all security controls<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Organizations need visibility into how AI is being used to identify unauthorized or unmanaged systems. Maintaining an AI inventory, establishing acceptable-use requirements, monitoring relevant activity, and providing approved alternatives can help governance teams identify systems operating outside established processes. Simply removing policies or allowing unrestricted use makes unauthorized activity harder to detect and increases potential privacy, security, legal, and operational risks. Disabling security controls would further reduce visibility and protection. Monitoring should be proportionate to the organization\u2019s risk environment and should respect applicable privacy and employment requirements. The objective is not merely to block AI usage, but to create controlled and accountable processes for appropriate adoption.<\/span><\/p>\nQuestion 125<\/b><\/h3>\n
Why is testing an AI system with representative data important?<\/b><\/p>\n\n- It guarantees that the system will never make mistakes<\/span><\/li>\n
- It can help determine whether system behavior remains appropriate under realistic conditions<\/span><\/li>\n
- It eliminates the need for production monitoring<\/span><\/li>\n
- It ensures that every user receives identical results<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Testing with representative data can help an organization understand how an AI system is likely to behave in realistic operating conditions. If testing data does not adequately reflect relevant users, scenarios, or populations, important weaknesses may remain undiscovered. Representative testing can help identify accuracy problems, unexpected behavior, performance differences, and potential risks before deployment. It does not guarantee error-free performance or eliminate the need for ongoing monitoring. AI systems may behave differently after deployment because data distributions, user behavior, integrations, and operating conditions can change. Therefore, representative pre-deployment testing should be combined with appropriate validation, monitoring, and periodic reassessment throughout the system lifecycle.<\/span><\/p>\nQuestion 126<\/b><\/h3>\n
Which governance activity helps ensure that an AI system continues to meet its approved requirements after deployment?<\/b><\/p>\n\n- Continuous or periodic monitoring<\/span><\/li>\n
- Deleting system documentation<\/span><\/li>\n
- Removing system owners<\/span><\/li>\n
- Preventing all system updates<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Monitoring allows an organization to evaluate whether an AI system continues to perform and operate within approved requirements after deployment. Depending on the system, monitoring may examine accuracy, reliability, security events, data changes, fairness indicators, user feedback, incidents, policy compliance, or other relevant metrics. AI systems can change in behavior as their operating environment changes, so initial approval does not necessarily remain sufficient forever. Removing ownership or documentation weakens accountability, while preventing all updates may create other operational problems. Effective monitoring provides evidence that governance controls remain appropriate and can identify when additional testing, remediation, escalation, or reassessment is necessary.<\/span><\/p>\nQuestion 127<\/b><\/h3>\n
What is the main purpose of documenting an AI system\u2019s intended use?<\/b><\/p>\n\n- To establish the boundaries within which the system has been evaluated and approved<\/span><\/li>\n
- To encourage unlimited use of the system<\/span><\/li>\n
- To prevent users from understanding system limitations<\/span><\/li>\n
- To eliminate the need for risk assessment<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Documenting intended use establishes the purpose and boundaries for which an AI system has been designed, assessed, tested, and approved. It helps users understand what the system is expected to do and provides governance teams with a reference point for identifying inappropriate or unauthorized uses. Intended-use documentation can also describe relevant limitations, target users, assumptions, and prohibited scenarios. Without a clear purpose, organizations may unintentionally extend a system into higher-risk contexts that were never evaluated. Intended use does not replace risk assessment; rather, it provides an important foundation for determining which risks and controls are relevant to the system\u2019s deployment.<\/span><\/p>\nQuestion 128<\/b><\/h3>\n
Which action best supports protection of sensitive information when employees use generative AI tools?<\/b><\/p>\n\n- Allowing employees to enter any confidential information<\/span><\/li>\n
- Establishing clear rules about what information may be submitted<\/span><\/li>\n
- Removing authentication requirements<\/span><\/li>\n
- Sharing confidential information with external tools by default<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Clear rules governing what information employees may submit to generative AI systems can significantly reduce the risk of unauthorized disclosure. Policies may identify confidential, personal, proprietary, regulated, or otherwise sensitive information that should not be entered into unapproved AI tools. Organizations may also provide approved tools with appropriate contractual, security, and privacy protections. Removing authentication or allowing confidential information to be shared by default increases risk. Effective guidance should be supported by employee training so users understand not only the rules but also why they exist. Organizations should periodically review these requirements because AI services, business needs, contractual arrangements, and data-handling practices can change over time.<\/span><\/p>\nQuestion 129<\/b><\/h3>\n
Which activity is most relevant to evaluating whether an AI model is robust?<\/b><\/p>\n\n- Testing how the model performs under variations and unexpected conditions<\/span><\/li>\n
- Measuring the size of the office<\/span><\/li>\n
- Counting the number of employees<\/span><\/li>\n
- Changing the company logo<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Robustness refers to an AI system\u2019s ability to continue operating appropriately when conditions vary or when it encounters inputs that differ from ideal testing circumstances. Robustness testing may involve changes in input quality, data distributions, environmental conditions, unusual cases, or other scenarios relevant to the system. The objective is to identify situations in which model performance could deteriorate or produce unsafe or unreliable outputs. Office size, employee counts, and branding do not directly measure model robustness. Testing should be designed around the system\u2019s intended use and risk profile. Findings can then inform mitigation measures, operating limitations, human oversight, monitoring thresholds, or decisions about whether deployment is appropriate.<\/span><\/p>\nQuestion 130<\/b><\/h3>\n
Why should AI governance include a process for handling policy exceptions?<\/b><\/p>\n\n- To allow unlimited bypassing of controls<\/span><\/li>\n
- To document and evaluate deviations from established requirements<\/span><\/li>\n
- To eliminate accountability<\/span><\/li>\n
- To ensure every policy is optional<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Organizations may occasionally encounter legitimate circumstances where an established AI governance requirement cannot be followed exactly as written. A formal exception process allows such deviations to be reviewed, justified, documented, approved by appropriate authorities, and monitored. This prevents exceptions from becoming informal workarounds that bypass accountability. A good process may require an explanation of the business need, assessment of additional risks, compensating controls, an expiration date, and appropriate approval. Exceptions should not make policies optional or permit unlimited bypassing of safeguards. Instead, controlled exceptions provide flexibility while preserving governance discipline and ensuring that deviations remain visible to the people responsible for managing organizational AI risk.<\/span><\/p>\nQuestion 131<\/b><\/h3>\n
Which factor is especially important when determining whether human review is meaningful?<\/b><\/p>\n\n- Whether the reviewer has enough information, authority, and competence to challenge the AI output<\/span><\/li>\n
- Whether the reviewer\u2019s job title sounds technical<\/span><\/li>\n
- Whether the AI system is expensive<\/span><\/li>\n
- Whether the interface contains many buttons<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Human oversight is most meaningful when reviewers have the knowledge, information, time, and authority necessary to evaluate AI outputs and take appropriate action. Simply placing a person into a workflow does not necessarily create effective oversight if that person cannot understand the output, lacks relevant context, or is unable to reject or modify an AI recommendation. Reviewers should also understand system limitations and circumstances that require escalation. The cost of the system or complexity of its interface does not determine whether human oversight is meaningful. Organizations should design human review processes based on the system\u2019s risk, the consequences of errors, the reviewer\u2019s responsibilities, and the practical ability to intervene.<\/span><\/p>\nQuestion 132<\/b><\/h3>\n
What is the purpose of maintaining records of AI governance decisions?<\/b><\/p>\n\n- To provide traceability for important decisions and demonstrate accountability<\/span><\/li>\n
- To prevent future audits<\/span><\/li>\n
- To remove responsibility from decision-makers<\/span><\/li>\n
- To ensure that decisions can never be changed<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Records of important AI governance decisions provide evidence of how and why an organization reached particular conclusions. Decision records may document approvals, risk acceptance, mitigation choices, exceptions, deployment decisions, or decisions to restrict or retire systems. Such records support accountability because they identify relevant decision-makers and provide context for later reviews. They can also assist auditors, incident investigators, compliance teams, and future project teams. Maintaining records does not mean decisions can never change. In fact, documenting decisions can make later reassessment more effective because stakeholders can understand the assumptions and evidence that supported the original decision and determine whether circumstances have changed.<\/span><\/p>\nQuestion 133<\/b><\/h3>\n
Which situation could indicate that an AI system requires reassessment?<\/b><\/p>\n\n- A significant change to the system\u2019s purpose or operating environment<\/span><\/li>\n
- An employee changing their desk<\/span><\/li>\n
- A company changing its office furniture<\/span><\/li>\n
- A user printing a document<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
A significant change in an AI system\u2019s purpose, data, model, users, operating environment, or integration can introduce risks that were not present during the original assessment. For example, using a model for a new high-impact purpose may require additional testing and governance review even if the model itself has not changed. Similarly, substantial changes in data or external dependencies can affect performance and risk. Routine office changes generally have no relevance to AI governance. Organizations should establish criteria that identify changes significant enough to trigger reassessment. This helps ensure that previously approved systems remain aligned with their intended purpose, risk classification, controls, and organizational requirements.<\/span><\/p>\nQuestion 134<\/b><\/h3>\n
What is a key benefit of involving multiple stakeholders in AI governance?<\/b><\/p>\n\n- It incorporates different perspectives and areas of expertise<\/span><\/li>\n
- It guarantees that no disagreement will occur<\/span><\/li>\n
- It eliminates the need for accountability<\/span><\/li>\n
- It ensures that every decision is made by the largest department<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI systems can create technical, legal, privacy, security, ethical, operational, and business considerations that may not be fully understood by a single function. Involving appropriate stakeholders allows organizations to incorporate different perspectives and expertise into governance decisions. For example, technical teams may understand model limitations, privacy teams may identify data concerns, security teams may assess threats, legal teams may consider obligations, and business owners may understand operational impacts. Multidisciplinary involvement does not guarantee agreement, but it creates a stronger foundation for informed decision-making. Clear roles and decision rights are still necessary so stakeholder participation results in accountable decisions rather than unclear responsibility.<\/span><\/p>\nQuestion 135<\/b><\/h3>\n
Which practice can help reduce the risk of excessive reliance on AI outputs?<\/b><\/p>\n\n- Requiring appropriate verification and human judgment for important decisions<\/span><\/li>\n
- Treating every AI output as fact<\/span><\/li>\n
- Removing user training<\/span><\/li>\n
- Disabling all review procedures<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI systems can generate inaccurate, incomplete, outdated, or misleading outputs. Requiring users to verify important outputs and apply appropriate human judgment can reduce the risk of excessive reliance. The level of verification should correspond to the consequences of the decision and the reliability characteristics of the system. User training can further help employees understand system limitations and recognize situations where additional review is necessary. Treating AI outputs as automatically correct or removing review procedures increases the possibility that errors will be accepted without sufficient scrutiny. Effective governance therefore encourages informed use of AI rather than either blindly trusting outputs or rejecting AI tools entirely.<\/span><\/p>\nQuestion 136<\/b><\/h3>\n
What should an organization do when monitoring identifies a control that is no longer effective?<\/b><\/p>\n\n- Investigate the weakness and implement appropriate corrective action<\/span><\/li>\n
- Ignore the finding until the next annual review<\/span><\/li>\n
- Delete the monitoring results<\/span><\/li>\n
- Remove the control without assessing the risk<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
When monitoring identifies that a governance or technical control is no longer effective, the organization should investigate the cause and determine an appropriate response. Corrective action could involve modifying the control, increasing monitoring, changing procedures, updating technology, retraining users, or reassessing the underlying risk. The appropriate response depends on the severity and context of the weakness. Ignoring the issue or deleting monitoring results undermines governance and may allow a known problem to continue. Removing a control without evaluating the associated risk can also create additional exposure. Effective governance treats monitoring findings as opportunities to identify weaknesses and improve the overall control environment.<\/span><\/p>\nQuestion 137<\/b><\/h3>\n
Which information would be most useful when evaluating an AI vendor\u2019s data-handling practices?<\/b><\/p>\n\n- How the vendor collects, uses, retains, protects, and deletes relevant data<\/span><\/li>\n
- The vendor\u2019s office decoration<\/span><\/li>\n
- The number of advertisements the vendor publishes<\/span><\/li>\n
- The color of the vendor\u2019s website<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Understanding how an AI vendor handles data is critical when evaluating third-party risk. Organizations should determine what information the vendor collects, why it is collected, how it is used, whether it is retained, where it may be processed, who can access it, how it is protected, and what happens when the relationship ends. Depending on the use case, organizations may also need to understand whether submitted information can be used for model improvement or other secondary purposes. Vendor marketing and cosmetic characteristics do not provide meaningful evidence of data governance. Proper due diligence helps organizations determine whether vendor practices align with their privacy, security, contractual, and risk requirements.<\/span><\/p>\nQuestion 138<\/b><\/h3>\n
Why should AI governance responsibilities be clearly defined?<\/b><\/p>\n\n- To ensure people know who is responsible for specific governance activities and decisions<\/span><\/li>\n
- To make every employee responsible for every decision<\/span><\/li>\n
- To remove the need for documentation<\/span><\/li>\n
- To prevent organizations from using AI<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Clearly defined responsibilities reduce ambiguity about who performs and approves important AI governance activities. Responsibilities may cover system ownership, risk assessment, testing, security, privacy review, procurement, monitoring, incident response, policy management, and final deployment approval. When responsibilities are unclear, important tasks may be overlooked or multiple teams may assume someone else is responsible. Defining roles does not mean every employee becomes responsible for every decision. Instead, organizations should establish appropriate accountability at different levels and ensure that decision rights match the relevant expertise and authority. Clear governance structures also make escalation easier because employees know where to report concerns and who has authority to act.<\/span><\/p>\nQuestion 139<\/b><\/h3>\n
Which action best supports secure retirement of an AI system?<\/b><\/p>\n\n- Removing unnecessary access and addressing data, dependencies, records, and security requirements<\/span><\/li>\n
- Leaving production credentials active indefinitely<\/span><\/li>\n
- Publishing confidential system information<\/span><\/li>\n
- Ignoring systems connected to the retired AI application<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Retiring an AI system requires more than simply stopping its primary process. Organizations should identify and address associated accounts, credentials, data, integrations, infrastructure, contracts, records, and dependencies. Unnecessary access should be removed so former users or services cannot continue interacting with the retired system. Relevant records may need to be retained according to organizational or legal requirements rather than deleted indiscriminately. Connected systems should also be evaluated to ensure that retirement does not create unexpected failures or security gaps. A structured retirement process helps prevent abandoned resources from becoming security vulnerabilities and provides evidence that the system was properly decommissioned.<\/span><\/p>\nQuestion 140<\/b><\/h3>\n
Which statement best describes effective AI governance?<\/b><\/p>\n\n