To prevent employees from using any automated tools<\/span><\/li>\n<\/ol>\nCorrect Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI governance framework provides an organized structure for managing AI systems throughout their lifecycle. It establishes responsibilities, decision-making authority, oversight mechanisms, policies, and controls that help an organization use AI responsibly. Governance can address areas such as risk management, privacy, security, transparency, accountability, documentation, monitoring, and human oversight. The framework does not mean every AI system must use the same technology or that organizations must prohibit AI completely. Instead, it provides a consistent approach for determining how AI should be evaluated, approved, monitored, and changed. A strong framework also helps ensure that responsibilities are clearly assigned so that important AI-related decisions are not left without an accountable owner.<\/span><\/p>\nQuestion 162<\/b><\/p>\n
Which activity is most appropriate before deploying a high-risk AI system?<\/b><\/p>\n\n- Removing all documentation to simplify operations<\/span><\/li>\n
- Disabling monitoring controls<\/span><\/li>\n
- Conducting appropriate risk and impact assessments<\/span><\/li>\n
- Allowing unrestricted production access<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
Before deploying a high-risk AI system, an organization should conduct appropriate assessments to understand potential risks and impacts. Depending on the use case, this may include evaluating privacy, security, fairness, reliability, safety, transparency, and potential effects on individuals or groups. The organization can then identify mitigation measures and determine whether the system satisfies its approval requirements. High-risk systems generally require more extensive review than low-risk applications because failures or harmful outcomes may have significant consequences. Removing documentation, disabling monitoring, or granting unrestricted access would weaken governance rather than improve it. A structured pre-deployment assessment helps decision-makers understand whether the system is suitable for its intended purpose and whether sufficient controls are in place.<\/span><\/p>\nQuestion 163<\/b><\/p>\n
Why should an organization maintain an inventory of AI systems?<\/b><\/p>\n\n- To identify and track AI systems that require governance and oversight<\/span><\/li>\n
- To ensure all AI systems are developed by the same team<\/span><\/li>\n
- To prevent employees from documenting AI use<\/span><\/li>\n
- To replace all AI risk assessments<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI inventory gives an organization visibility into the AI systems it owns, develops, purchases, or uses. Without an inventory, governance teams may not know which systems are operating, who is responsible for them, what data they process, or what risks they create. An effective inventory can contain information such as the system owner, purpose, provider, data types, deployment environment, risk classification, lifecycle status, and relevant controls. This information supports risk assessments, audits, monitoring, incident response, and periodic reviews. An inventory does not replace risk assessments. Instead, it provides the foundational visibility needed to determine which systems require additional governance activities and helps prevent unmanaged or unauthorized AI applications from remaining unnoticed.<\/span><\/p>\nQuestion 164<\/b><\/p>\n
What is an important reason for assigning a clear owner to an AI system?<\/b><\/p>\n\n- To make the system independent of organizational policies<\/span><\/li>\n
- To eliminate the need for user training<\/span><\/li>\n
- To ensure accountability for governance and lifecycle decisions<\/span><\/li>\n
- To guarantee that the AI system will never fail<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
Assigning a clear owner establishes accountability for important decisions concerning an AI system. The owner may be responsible for ensuring that the system has an appropriate purpose, follows organizational policies, undergoes required assessments, and receives appropriate monitoring throughout its lifecycle. Ownership also helps determine who should respond when problems occur or when changes require reassessment. Clear accountability does not guarantee that an AI system will never fail because technical and operational failures can still happen. Instead, ownership ensures that someone has responsibility for managing those risks and coordinating appropriate responses. Without clear ownership, governance tasks can be overlooked because different teams may assume that another person or department is responsible.<\/span><\/p>\nQuestion 165<\/b><\/p>\n
Which practice best supports transparency about an AI system’s capabilities and limitations?<\/b><\/p>\n\n- Documenting relevant system characteristics and known limitations<\/span><\/li>\n
- Hiding known performance weaknesses from users<\/span><\/li>\n
- Removing records after deployment<\/span><\/li>\n
- Preventing stakeholders from asking questions<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Transparency requires organizations to provide appropriate information about how an AI system is intended to function, what it can and cannot reliably do, and what limitations may affect its outputs. Documentation of known weaknesses, operating conditions, assumptions, and limitations helps users and stakeholders develop realistic expectations. Transparency does not necessarily require revealing every technical detail, proprietary component, or security-sensitive implementation detail. Instead, organizations should provide meaningful information appropriate to the system and its context. Concealing known weaknesses can increase the risk of misuse and overreliance. Good documentation can also support training, audits, incident investigations, and future system improvements because teams can understand the conditions under which the system was evaluated.<\/span><\/p>\nQuestion 166<\/b><\/p>\n
An organization discovers that an AI model performs poorly for a particular user group. What should it do first?<\/b><\/p>\n\n- Ignore the issue if the overall accuracy is high<\/span><\/li>\n
- Investigate the cause and assess the potential impact<\/span><\/li>\n
- Immediately delete all training data<\/span><\/li>\n
- Increase access to the model without review<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
When an AI system performs poorly for a particular group, the organization should investigate the issue and assess its potential impact before deciding on corrective action. The investigation may examine training data, evaluation methods, model design, deployment conditions, and differences in how the system interacts with various populations. Overall accuracy can hide significant performance differences, so aggregate metrics alone may not provide an adequate assessment. Depending on the findings, mitigation could involve improving data quality, modifying the model, adjusting thresholds, adding human review, limiting the system’s use, or conducting additional testing. The organization should also document the issue and its response. Ignoring subgroup performance problems can create significant fairness, reliability, and operational risks.<\/span><\/p>\nQuestion 167<\/b><\/p>\n
What is the main purpose of AI system testing before production deployment?<\/b><\/p>\n\n- To verify whether the system performs as expected under relevant conditions<\/span><\/li>\n
- To guarantee that the model will never produce an incorrect result<\/span><\/li>\n
- To eliminate all human involvement<\/span><\/li>\n
- To avoid documenting system behavior<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Pre-production testing helps an organization determine whether an AI system behaves as expected under conditions relevant to its intended use. Testing may evaluate accuracy, reliability, robustness, security, fairness, privacy, and other characteristics depending on the system’s risk profile. Testing cannot guarantee that an AI system will never make an incorrect prediction or generate an undesirable output. Instead, it provides evidence about how the system performs and helps identify weaknesses before deployment. Appropriate testing should use representative scenarios and datasets where possible. Findings should be documented and reviewed against established acceptance criteria. If significant problems are identified, the organization can address them before the system reaches production or restrict the system’s intended use.<\/span><\/p>\nQuestion 168<\/b><\/p>\n
Why is documentation important when an AI system undergoes a significant change?<\/b><\/p>\n\n- It makes the system impossible to modify again<\/span><\/li>\n
- It provides a record of what changed and supports future governance decisions<\/span><\/li>\n
- It eliminates the need for testing after the change<\/span><\/li>\n
- It allows organizations to avoid assigning ownership<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Documenting significant changes creates an auditable record of how an AI system has evolved over time. A change record can identify what was modified, why the change was made, who approved it, when it occurred, and whether additional testing or risk assessment was performed. This information is valuable when investigating incidents, reviewing system performance, conducting audits, or determining whether a previous approval remains appropriate. Significant changes can affect model behavior, data processing, security, privacy, or intended use, so organizations should determine whether reassessment is necessary. Documentation does not eliminate testing. Instead, it helps teams understand the relationship between changes and required governance activities and provides evidence that change management procedures were followed.<\/span><\/p>\nQuestion 169<\/b><\/p>\n
Which factor should most strongly influence the level of AI governance applied to a system?<\/b><\/p>\n\n- The color of the system interface<\/span><\/li>\n
- The number of employees who developed it<\/span><\/li>\n
- The potential risk and impact associated with its use<\/span><\/li>\n
- The programming language used to build it<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
A risk-based approach means governance requirements should be proportionate to the potential risks and impacts associated with an AI system. A system used for a low-impact internal task may require fewer controls than an AI system that influences important decisions affecting individuals. Risk considerations can include the sensitivity of processed data, potential harm from incorrect outputs, affected populations, system autonomy, security threats, and the consequences of failure. Factors such as programming language or interface design generally do not determine governance requirements by themselves. A risk-based approach helps organizations focus resources on systems where stronger controls, testing, monitoring, documentation, and human oversight are most necessary while avoiding unnecessary burdens for lower-risk applications.<\/span><\/p>\nQuestion 170<\/b><\/p>\n
What is the purpose of defining an AI system’s intended use?<\/b><\/p>\n\n- To establish the context and boundaries in which the system is expected to operate<\/span><\/li>\n
- To guarantee that users cannot make mistakes<\/span><\/li>\n
- To remove all restrictions from the system<\/span><\/li>\n
- To prevent the organization from monitoring performance<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Defining intended use establishes the context, purpose, and boundaries for an AI system. It helps organizations determine what the system is designed to do, who should use it, what data it may process, and under which conditions its outputs should be relied upon. Intended use is also important for risk assessment and testing because performance should be evaluated against realistic operational requirements. If users apply a system outside its intended purpose, the risks may differ significantly from those evaluated during development. Clear documentation of intended use can therefore help prevent misuse and overreliance. It also gives governance teams a reference point for determining whether changes to the system or its application require additional review.<\/span><\/p>\nQuestion 171<\/b><\/p>\n
Which control is most effective for reducing unauthorized access to sensitive AI systems?<\/b><\/p>\n\n- Removing authentication requirements<\/span><\/li>\n
- Applying role-based access controls and appropriate authentication<\/span><\/li>\n
- Giving every employee administrator privileges<\/span><\/li>\n
- Publishing credentials in internal documentation<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Role-based access control combined with appropriate authentication helps ensure that only authorized individuals can access sensitive AI systems and associated resources. Access should generally be based on legitimate job responsibilities and should follow the principle of least privilege, meaning users receive only the permissions necessary to perform their duties. Strong authentication can provide an additional layer of protection against unauthorized account use. Access permissions should also be reviewed periodically because employees change roles and responsibilities over time. Granting administrator privileges to everyone or publishing credentials creates unnecessary security exposure. Effective access controls are especially important for AI systems that process confidential information, influence important decisions, or provide access to sensitive models, datasets, or production environments.<\/span><\/p>\nQuestion 172<\/b><\/p>\n
Why should AI systems be monitored after deployment?<\/b><\/p>\n\n- Because real-world conditions and system performance can change over time<\/span><\/li>\n
- Because monitoring guarantees perfect accuracy<\/span><\/li>\n
- Because monitoring eliminates the need for incident response<\/span><\/li>\n
- Because deployed systems never require maintenance<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Post-deployment monitoring is important because AI systems operate in environments that can change over time. Data distributions may shift, user behavior may change, external conditions may evolve, and model performance may deteriorate. Monitoring can help identify unusual behavior, declining accuracy, emerging risks, security events, or differences in performance across relevant groups. Organizations can establish thresholds and escalation procedures so that significant changes trigger investigation or corrective action. Monitoring does not guarantee perfect performance and does not eliminate the need for incident response. Instead, it provides ongoing visibility into system behavior and helps organizations determine when a deployed system may no longer operate within the assumptions or performance expectations established during earlier evaluations.<\/span><\/p>\nQuestion 173<\/b><\/p>\n
What should an organization do when an AI incident creates a significant potential impact?<\/b><\/p>\n\n- Hide the incident to protect the system’s reputation<\/span><\/li>\n
- Wait indefinitely to determine whether the issue disappears<\/span><\/li>\n
- Follow established incident response and escalation procedures<\/span><\/li>\n
- Disable all governance documentation<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
Significant AI incidents should be handled according to established incident response and escalation procedures. These procedures should define how incidents are detected, documented, investigated, contained, communicated, and resolved. Depending on the circumstances, the organization may need to restrict or suspend the affected system while investigating the problem. Appropriate stakeholders should be notified according to predefined escalation criteria, and corrective actions should be recorded. After resolution, the organization can conduct a post-incident review to identify root causes and opportunities for improvement. Hiding an incident or waiting indefinitely can allow the impact to grow and can make later investigation more difficult. Effective incident management helps organizations respond consistently and learn from failures.<\/span><\/p>\nQuestion 174<\/b><\/p>\n
Which practice best reduces the risk of employees entering confidential information into an unauthorized generative AI service?<\/b><\/p>\n\n- Providing clear policies, approved tools, training, and appropriate technical controls<\/span><\/li>\n
- Allowing unrestricted use of every public AI service<\/span><\/li>\n
- Removing all employee security training<\/span><\/li>\n
- Assuming employees automatically understand data-handling requirements<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Organizations can reduce the risk of sensitive information being entered into unauthorized AI services by combining clear policies, employee education, approved tools, and appropriate technical controls. Employees should understand which information may be entered into AI systems and which categories of data require additional protection or are prohibited from being shared with external services. Providing approved alternatives can also make it easier for employees to follow organizational requirements. Technical controls may help identify or prevent inappropriate data transfers where appropriate. Simply telling employees not to use AI may be insufficient if they do not understand the risks or have no approved alternative. A coordinated governance approach addresses both human behavior and technical risk.<\/span><\/p>\nQuestion 175<\/b><\/p>\n
Why is AI literacy important for employees who interact with AI systems?<\/b><\/p>\n\n- It ensures every employee becomes an AI developer<\/span><\/li>\n
- It helps users understand capabilities, limitations, risks, and appropriate use<\/span><\/li>\n
- It removes the need for organizational policies<\/span><\/li>\n
- It guarantees that AI outputs are always correct<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI literacy helps employees understand how AI systems should be used responsibly. Users should recognize that AI outputs can contain errors, reflect limitations in training or evaluation data, and sometimes require human verification. Employees should also understand relevant organizational policies, data-handling requirements, security considerations, and escalation procedures. AI literacy does not require every employee to become a model developer. Instead, training should be appropriate to each person’s role and level of interaction with AI. For example, ordinary users may need guidance on evaluating outputs and protecting confidential information, while technical teams may require deeper knowledge of model behavior and testing. Effective literacy programs reduce misuse, overreliance, and avoidable governance failures.<\/span><\/p>\nQuestion 176<\/b><\/p>\n
What is a key benefit of keeping records of AI governance decisions?<\/b><\/p>\n\n- They provide evidence of how and why important decisions were made<\/span><\/li>\n
- They prevent the organization from changing AI systems<\/span><\/li>\n
- They eliminate all regulatory obligations<\/span><\/li>\n
- They guarantee that governance decisions are always correct<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Records of AI governance decisions provide evidence about how important decisions were reached and who participated in them. Documentation may capture risk assessments, approval decisions, identified concerns, mitigation measures, exceptions, testing results, and review outcomes. These records can support accountability and help future teams understand the reasoning behind previous decisions. They may also be valuable during audits, investigations, or internal reviews. Governance records do not guarantee that every decision was correct, nor do they prevent future changes. Their purpose is to create traceability and organizational memory. When circumstances change, decision records can help governance teams determine whether earlier assumptions remain valid or whether a new assessment is necessary.<\/span><\/p>\nQuestion 177<\/b><\/p>\n
When should an AI system’s risk assessment generally be revisited?<\/b><\/p>\n\n- Only when the system is permanently deleted<\/span><\/li>\n
- When significant changes or new risk information could affect the original assessment<\/span><\/li>\n
- Never after initial approval<\/span><\/li>\n
- Only when an employee requests it informally<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI risk assessment should be revisited when circumstances change in ways that could affect the system’s risk profile. Examples include major model or data changes, a new intended purpose, deployment in a different environment, significant changes in affected users, newly discovered vulnerabilities, serious incidents, or evidence that previous assumptions are no longer valid. Periodic review may also be appropriate depending on the organization’s governance requirements. Reassessment helps ensure that controls remain appropriate as the system evolves. Initial approval should not be treated as permanent because AI systems and their operating environments can change. A trigger-based reassessment process provides a practical way to identify when additional evaluation is necessary.<\/span><\/p>\nQuestion 178<\/b><\/p>\n
Which approach best supports responsible procurement of a third-party AI system?<\/b><\/p>\n\n- Selecting the provider solely because it has the lowest price<\/span><\/li>\n
- Evaluating the provider’s risks, controls, data practices, and contractual commitments<\/span><\/li>\n
- Avoiding all questions about how the provider handles data<\/span><\/li>\n
- Allowing the provider unrestricted access to organizational information<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Responsible procurement requires organizations to evaluate third-party AI providers before adopting their systems. Due diligence can examine security controls, privacy and data-handling practices, model limitations, incident response capabilities, governance processes, subcontractors, performance commitments, and relevant contractual terms. Organizations should also understand what information may be collected, retained, reused, or shared by the provider. Contracts can establish important requirements concerning confidentiality, security, data use, audit rights, notification of incidents, and termination. Price alone is not an adequate basis for selecting an AI provider because a low-cost solution may introduce significant operational, privacy, security, or compliance risks. Appropriate vendor assessment helps organizations manage risks that extend beyond their own internal systems.<\/span><\/p>\nQuestion 179<\/b><\/p>\n
What is the main purpose of human oversight for a high-impact AI decision?<\/b><\/p>\n\n- To ensure a person can appropriately review, challenge, or intervene when necessary<\/span><\/li>\n
- To guarantee that the AI system never makes an error<\/span><\/li>\n
- To allow users to ignore organizational policies<\/span><\/li>\n
- To eliminate all documentation requirements<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Human oversight provides an opportunity for an appropriately qualified person to review AI outputs, identify potential problems, and intervene when necessary. This is particularly important when an AI system may significantly affect individuals or organizations. Effective oversight should be meaningful rather than merely symbolic. Reviewers should have sufficient authority, information, training, and time to evaluate outputs and take appropriate action. Human involvement does not guarantee that every AI error will be detected, but it can provide an important safeguard against inappropriate automated decisions. Organizations should define when human review is required, what reviewers should consider, and what escalation options are available when the AI output appears unreliable, harmful, or inconsistent with policy.<\/span><\/p>\nQuestion 180<\/b><\/p>\n
Which statement best describes continuous improvement in AI governance?<\/b><\/p>\n\n