Allowing the system to change its purpose without review<\/span><\/li>\n<\/ol>\nCorrect Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI system should be periodically evaluated against the requirements and assumptions established for its approved purpose. Reviewing current performance, operating conditions, data characteristics, and user behavior can help determine whether the system continues to operate as expected. A system that was appropriate when initially approved may become unsuitable if its environment, data, functionality, or intended use changes. Governance teams should establish criteria for determining when reassessment is necessary and document the results of those reviews. Development cost does not determine whether an AI system remains appropriate. Similarly, allowing a system to change its purpose without review can introduce unmanaged risks. Ongoing suitability reviews support responsible lifecycle management.<\/span><\/p>\nQuestion 182<\/b><\/p>\n
What is a key purpose of establishing AI governance policies?<\/b><\/p>\n\n- To provide consistent organizational requirements for managing AI-related risks<\/span><\/li>\n
- To ensure employees can bypass approval processes<\/span><\/li>\n
- To prevent all AI innovation<\/span><\/li>\n
- To eliminate the need for technical controls<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI governance policies establish consistent expectations for how AI systems should be developed, acquired, deployed, monitored, and retired. They can define responsibilities, approval requirements, data-handling rules, risk assessment expectations, documentation standards, human oversight requirements, and incident reporting procedures. Clear policies help employees and management understand what is permitted and what controls are required for different types of AI use. Policies do not necessarily prevent innovation; instead, they provide boundaries within which AI can be adopted responsibly. They also do not replace technical safeguards. Effective governance combines policies with appropriate processes, technical controls, training, monitoring, and accountability mechanisms to address risks throughout the AI lifecycle.<\/span><\/p>\nQuestion 183<\/b><\/p>\n
Which approach is most appropriate when an AI system’s actual use expands beyond its originally approved purpose?<\/b><\/p>\n\n- Continue using it without additional review<\/span><\/li>\n
- Delete all historical documentation<\/span><\/li>\n
- Reassess the system against the new intended use and associated risks<\/span><\/li>\n
- Automatically classify the system as low risk<\/span><\/li>\n<\/ol>\n
Correct Answer: 3<\/b><\/p>\n
Explanation<\/b><\/p>\n
When the use of an AI system expands beyond its original approved purpose, the organization should reassess whether the existing controls and approval remain appropriate. A new use case may involve different users, data, decisions, or potential impacts. For example, an AI system originally approved for internal analysis may create significantly greater risks if later used to make decisions affecting customers or employees. The organization should document the new intended use, identify changes in risk, conduct any required assessments, and determine whether additional controls or approvals are necessary. Continuing without review can leave important risks unmanaged. Governance should therefore treat material changes in purpose as potential reassessment triggers.<\/span><\/p>\nQuestion 184<\/b><\/p>\n
What is the primary purpose of maintaining AI-related audit trails?<\/b><\/p>\n\n- To prevent any future changes to the AI system<\/span><\/li>\n
- To provide traceability of important actions, decisions, and events<\/span><\/li>\n
- To eliminate the need for system monitoring<\/span><\/li>\n
- To guarantee that every AI output is accurate<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Audit trails provide traceability by recording important activities and events associated with an AI system. Depending on the system and organizational requirements, records may include approvals, significant configuration changes, access events, model versions, testing results, incidents, or governance decisions. Such records can help organizations investigate problems, demonstrate accountability, support audits, and understand how a system changed over time. Audit trails do not guarantee accurate AI outputs and should not be considered a replacement for monitoring. Their value comes from providing reliable evidence about what happened and when. Appropriate auditability is particularly important for higher-risk systems where organizations may need to reconstruct events and determine whether established procedures were followed.<\/span><\/p>\nQuestion 185<\/b><\/p>\n
Why should organizations define escalation criteria for AI-related incidents?<\/b><\/p>\n\n- To ensure significant issues are directed to the appropriate decision-makers<\/span><\/li>\n
- To prevent employees from reporting problems<\/span><\/li>\n
- To eliminate incident documentation<\/span><\/li>\n
- To ensure every minor issue receives executive review<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Escalation criteria help organizations determine when an AI-related issue requires attention from specific individuals, teams, or leadership levels. Criteria may consider the severity of potential harm, number of affected users, sensitivity of information involved, system criticality, regulatory obligations, or duration of the incident. Clearly defined thresholds help prevent serious issues from being overlooked while avoiding unnecessary escalation of routine events. Employees should understand how to report concerns and what information should accompany an escalation. Effective escalation supports timely decision-making, containment, investigation, and communication. It does not mean every minor technical issue must reach senior executives. Instead, it provides a structured method for directing issues to the appropriate level of authority.<\/span><\/p>\nQuestion 186<\/b><\/p>\n
Which factor should be considered when determining appropriate human oversight for an AI system?<\/b><\/p>\n\n- The potential consequences of incorrect or harmful outputs<\/span><\/li>\n
- The number of colors used in the user interface<\/span><\/li>\n
- The physical size of the computer running the model<\/span><\/li>\n
- The name of the AI vendor alone<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
The level of human oversight should reflect the potential consequences associated with the AI system’s outputs and decisions. Systems that could cause significant financial, legal, safety, employment, or other meaningful impacts may require stronger human review than systems used for low-impact tasks. Other considerations can include system reliability, degree of automation, affected populations, reversibility of decisions, and the ability to detect errors. Human oversight should be meaningful, meaning reviewers have sufficient authority, information, and competence to intervene when necessary. The interface design or vendor name alone does not determine the appropriate level of oversight. A risk-based approach helps organizations establish proportionate review requirements.<\/span><\/p>\nQuestion 187<\/b><\/p>\n
What is an important purpose of documenting AI system limitations?<\/b><\/p>\n\n- To help users understand when outputs may require additional verification<\/span><\/li>\n
- To make the system appear more capable than it is<\/span><\/li>\n
- To prevent all users from accessing the system<\/span><\/li>\n
- To remove the need for user training<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Documenting limitations helps users understand situations in which AI outputs may be unreliable, incomplete, or inappropriate. Limitations can relate to data quality, model performance, supported scenarios, known failure modes, environmental conditions, or uncertainty. Providing this information helps users make better decisions about when additional verification or human review is necessary. Clear limitation documentation can also support training, risk assessments, monitoring, and incident investigations. Organizations should avoid presenting AI systems as more capable or reliable than available evidence supports. Documentation does not eliminate the need for training; rather, it gives training programs accurate information to communicate. Understanding limitations is especially important for reducing inappropriate reliance on AI-generated results.<\/span><\/p>\nQuestion 188<\/b><\/p>\n
Which practice best supports accountability when multiple teams contribute to an AI system?<\/b><\/p>\n\n- Assigning no individual responsibilities because ownership is shared<\/span><\/li>\n
- Clearly defining roles, responsibilities, and decision authority<\/span><\/li>\n
- Allowing every team to make independent production changes<\/span><\/li>\n
- Keeping governance decisions undocumented<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
When multiple teams contribute to an AI system, clearly defined roles and decision authority are essential for accountability. Responsibilities may be distributed among product teams, data scientists, security personnel, privacy specialists, legal teams, business owners, and governance committees. Each role should understand its responsibilities and escalation paths. A system can have several contributors while still having clearly assigned accountability for important decisions. Allowing every team to make independent production changes can create inconsistent controls and increase operational risk. Similarly, undocumented responsibilities can cause tasks to be overlooked. A structured responsibility model helps organizations coordinate activities and ensures that important governance decisions have an identifiable owner.<\/span><\/p>\nQuestion 189<\/b><\/p>\n
What should an organization consider when evaluating AI training or testing data?<\/b><\/p>\n\n- Whether the data is relevant, appropriate, sufficiently representative, and suitable for the intended purpose<\/span><\/li>\n
- Only the total number of records<\/span><\/li>\n
- Only the file size of the dataset<\/span><\/li>\n
- Whether the dataset has the shortest possible name<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI data should be evaluated according to the purpose for which it is being used. Important considerations can include relevance, quality, completeness, accuracy, representativeness, provenance, potential bias, and suitability for the intended application. A large dataset is not automatically a good dataset. Data can be extensive while still containing errors, missing populations, outdated information, or characteristics that create undesirable performance differences. Organizations should also understand how data was obtained and whether its use is appropriate under applicable requirements and organizational policies. Proper data evaluation helps improve model reliability and supports responsible governance. The specific criteria should be proportionate to the system’s purpose and risk level.<\/span><\/p>\nQuestion 190<\/b><\/p>\n
What is the main benefit of defining AI approval criteria before deployment?<\/b><\/p>\n\n- It establishes objective requirements that must be satisfied before the system is approved<\/span><\/li>\n
- It guarantees that no future monitoring is necessary<\/span><\/li>\n
- It allows teams to deploy systems without testing<\/span><\/li>\n
- It removes the need for risk classification<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Approval criteria provide a defined set of requirements that an AI system should satisfy before it is authorized for deployment. Criteria may cover risk assessment, performance testing, security, privacy, documentation, human oversight, data governance, incident response, and other controls appropriate to the system. Establishing these requirements in advance can make approval decisions more consistent and reduce the risk of deploying systems before important issues are addressed. Approval criteria should be aligned with the system’s risk and intended use. They do not eliminate the need for post-deployment monitoring because risks can change after deployment. Instead, they establish a baseline of conditions that should be met before production use begins.<\/span><\/p>\nQuestion 191<\/b><\/p>\n
Which situation most clearly indicates that an AI system may require additional review?<\/b><\/p>\n\n- The system’s documentation has been printed<\/span><\/li>\n
- The system is being used for a materially different purpose than originally approved<\/span><\/li>\n
- An employee changed their desk location<\/span><\/li>\n
- The system’s interface uses a new font<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
A materially different intended use can significantly change the risks associated with an AI system and therefore may require additional review. A change in purpose can affect the types of decisions being supported, the individuals affected, the data being processed, the level of human oversight needed, and the consequences of errors. For example, an AI tool initially used to summarize internal documents may require a different risk assessment if it is later used to recommend actions affecting individuals. Organizations should establish change-management procedures that identify significant changes and determine when reassessment or reapproval is necessary. Minor administrative or cosmetic changes generally do not create the same governance concern.<\/span><\/p>\nQuestion 192<\/b><\/p>\n
Why is data provenance relevant to AI governance?<\/b><\/p>\n\n- It helps organizations understand where data originated and how it was obtained or transformed<\/span><\/li>\n
- It guarantees that every dataset is unbiased<\/span><\/li>\n
- It eliminates the need for data quality checks<\/span><\/li>\n
- It prevents all future changes to datasets<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Data provenance provides information about the origin, history, and transformations of data used by an AI system. Understanding provenance can help organizations determine whether data was obtained from appropriate sources, whether relevant permissions or requirements were considered, and how transformations may have affected the resulting dataset. Provenance can also support troubleshooting when unexpected model behavior occurs because teams can trace data back through its sources and processing steps. Provenance alone does not guarantee that data is unbiased or high quality. It is one part of broader data governance that can include quality assessment, representativeness checks, access controls, privacy considerations, and documentation of processing activities.<\/span><\/p>\nQuestion 193<\/b><\/p>\n
Which control can help reduce the risk of unauthorized changes to a production AI model?<\/b><\/p>\n\n- Allowing all users to modify production files<\/span><\/li>\n
- Using controlled change management with restricted production permissions<\/span><\/li>\n
- Removing authentication from production systems<\/span><\/li>\n
- Sharing administrator credentials among employees<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Controlled change management and restricted production permissions help protect AI systems from unauthorized or poorly reviewed modifications. Access should generally be limited according to job responsibilities, while significant changes should follow established approval, testing, documentation, and deployment procedures. Version control can also help organizations identify which model or configuration is currently deployed and provide a record of previous versions. Allowing unrestricted modifications or sharing administrator credentials makes accountability difficult and increases the risk of accidental or malicious changes. Production environments should therefore use appropriate access controls and change procedures. These safeguards are particularly important for AI systems where a seemingly small modification can affect model behavior or system risk.<\/span><\/p>\nQuestion 194<\/b><\/p>\n
What is the best reason to collect feedback from users of an AI system?<\/b><\/p>\n\n- User feedback can reveal practical problems, unexpected behavior, and opportunities for improvement<\/span><\/li>\n
- User feedback guarantees that the AI model is unbiased<\/span><\/li>\n
- User feedback replaces all technical testing<\/span><\/li>\n
- User feedback eliminates the need for monitoring<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
User feedback provides valuable information about how an AI system performs in real-world situations. Users may identify unexpected outputs, confusing behavior, inappropriate recommendations, usability problems, or scenarios that were not adequately represented during testing. This information can support continuous improvement and help governance teams determine whether additional testing or mitigation is required. Feedback does not prove that a system is unbiased and should not replace formal technical evaluation. Instead, it complements quantitative monitoring and structured assessments by providing practical insight from people who interact with the system. Organizations should establish appropriate channels for collecting, reviewing, prioritizing, and responding to feedback, especially for higher-impact AI applications.<\/span><\/p>\nQuestion 195<\/b><\/p>\n
What is a key consideration when an organization plans to retire an AI system?<\/b><\/p>\n\n- Ensuring that data, access, dependencies, records, and replacement arrangements are appropriately managed<\/span><\/li>\n
- Immediately deleting every record without review<\/span><\/li>\n
- Leaving production credentials active indefinitely<\/span><\/li>\n
- Ignoring users who still depend on the system<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI retirement should be treated as a governed lifecycle activity rather than simply turning off the model. Organizations should identify dependencies, communicate with affected users, revoke unnecessary access, address data retention and deletion requirements, preserve appropriate records, and ensure that replacement processes are available where necessary. Security considerations are also important because inactive systems or credentials can create unnecessary exposure if they remain accessible. Organizations may need to preserve certain documentation for audit, legal, or operational reasons rather than deleting everything immediately. A structured retirement process helps ensure that the system is safely removed while maintaining appropriate accountability and managing impacts on users and business operations.<\/span><\/p>\nQuestion 196<\/b><\/p>\n
Which metric is most useful for detecting deterioration in an AI system after deployment?<\/b><\/p>\n\n- A relevant performance measure tracked over time against established thresholds<\/span><\/li>\n
- The number of employees in the organization<\/span><\/li>\n
- The physical storage capacity of the server<\/span><\/li>\n
- The color of the system dashboard<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Performance metrics tracked over time can help organizations detect whether an AI system is deteriorating relative to established expectations. The appropriate metric depends on the system’s purpose and may include accuracy, error rates, false-positive or false-negative rates, response quality, reliability, or other relevant measures. Monitoring should establish meaningful thresholds or triggers that prompt investigation when performance changes significantly. A single measurement may not be sufficient, so organizations should consider trends and operating conditions. Metrics should also be interpreted within context because changes in the underlying environment or data may affect performance. Effective monitoring allows teams to identify problems early and determine whether corrective action or reassessment is necessary.<\/span><\/p>\nQuestion 197<\/b><\/p>\n
What is an appropriate response when an AI system produces a serious unexpected outcome?<\/b><\/p>\n\n- Record and investigate the event according to the organization’s incident process<\/span><\/li>\n
- Delete all evidence immediately<\/span><\/li>\n
- Assume the user caused the problem without investigation<\/span><\/li>\n
- Continue normal operation without documenting the event<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
A serious unexpected AI outcome should be documented and investigated through the organization’s established incident management process. Investigation can help determine what happened, which users or systems were affected, whether the issue is ongoing, and whether immediate containment is required. The organization should preserve relevant evidence and involve appropriate stakeholders based on the severity of the incident. Depending on the circumstances, temporary restrictions or suspension may be necessary while the cause is investigated. Blaming a user without evidence or deleting records can prevent effective root-cause analysis. Incident investigations can also provide lessons that improve future testing, monitoring, controls, training, and governance processes.<\/span><\/p>\nQuestion 198<\/b><\/p>\n
Why should AI governance responsibilities be communicated to relevant employees?<\/b><\/p>\n\n- Employees need to understand their responsibilities and escalation paths<\/span><\/li>\n
- Communication makes technical testing unnecessary<\/span><\/li>\n
- It ensures employees can bypass governance requirements<\/span><\/li>\n
- It eliminates the need for management oversight<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Employees need to understand their responsibilities so that governance processes operate effectively in practice. Communication can explain who owns AI systems, who approves deployments, who performs risk assessments, how incidents should be reported, and when issues must be escalated. Clear responsibilities reduce confusion and help prevent important tasks from being overlooked. Training should be appropriate to each employee’s role, particularly when people interact with AI systems or make decisions based on AI outputs. Communication does not replace technical controls or management oversight. Instead, it ensures that employees understand how organizational policies and governance procedures apply to their daily activities and how to obtain help when they encounter an AI-related concern.<\/span><\/p>\nQuestion 199<\/b><\/p>\n
What is an important purpose of periodic AI governance reviews?<\/b><\/p>\n\n- To determine whether governance processes and controls remain effective and appropriate<\/span><\/li>\n
- To automatically approve every AI system<\/span><\/li>\n
- To prevent organizations from improving their policies<\/span><\/li>\n
- To eliminate accountability for system owners<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Periodic governance reviews help organizations determine whether their AI policies, processes, responsibilities, and controls continue to work effectively. AI systems, business requirements, threats, regulations, data sources, and operating environments can change over time. A governance review can identify outdated procedures, ineffective controls, unclear responsibilities, recurring incidents, or areas where additional training is needed. Reviews may use audit findings, monitoring metrics, incident reports, stakeholder feedback, and changes in organizational requirements. The goal is not simply to approve systems automatically. Instead, periodic reviews support continuous improvement and help ensure that governance remains aligned with actual AI use and emerging risks.<\/span><\/p>\nQuestion 200<\/b><\/p>\n
Which statement best describes a mature AI governance program?<\/b><\/p>\n\n