To ensure every AI system uses identical controls<\/span><\/li>\n<\/ol>\nCorrect Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI impact assessment helps an organization systematically identify and evaluate the potential effects of an AI system on individuals, groups, the organization, and other relevant stakeholders. Depending on the use case, the assessment may consider privacy, fairness, security, safety, reliability, transparency, and other risks. The results can help determine appropriate safeguards and whether additional review or human oversight is necessary. An impact assessment does not guarantee that a system will never fail, nor does it eliminate the need for policies or technical controls. Instead, it provides a structured basis for understanding potential consequences before and during deployment. Higher-impact systems generally require more thorough assessment and mitigation.<\/span><\/p>\nQuestion 202<\/b><\/p>\n
Which factor is most important when determining whether an AI use case presents elevated risk?<\/b><\/p>\n\n- The length of the AI system’s name<\/span><\/li>\n
- The potential severity of harm resulting from system failure or misuse<\/span><\/li>\n
- The color of the application interface<\/span><\/li>\n
- The number of buttons displayed on the screen<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Risk assessment should consider the potential consequences of an AI system’s failure, misuse, or inappropriate operation. Severity of potential harm is particularly important because some AI systems can affect significant interests such as employment, financial opportunities, access to services, safety, or privacy. Organizations may also consider the likelihood of harmful events, the number and characteristics of affected individuals, the sensitivity of the data involved, and the degree of system autonomy. Cosmetic characteristics such as interface color or the length of a system name do not meaningfully determine AI risk. A risk-based approach helps organizations apply stronger controls where the consequences of failure could be more serious.<\/span><\/p>\nQuestion 203<\/b><\/p>\n
Why should an organization identify stakeholders affected by an AI system?<\/b><\/p>\n\n- To understand relevant interests, impacts, and concerns associated with the system<\/span><\/li>\n
- To ensure every stakeholder becomes a system administrator<\/span><\/li>\n
- To remove the need for risk assessment<\/span><\/li>\n
- To prevent stakeholders from providing feedback<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Identifying relevant stakeholders helps an organization understand who may be affected by an AI system and what concerns or interests those groups may have. Stakeholders can include users, customers, employees, business owners, technical teams, compliance personnel, affected individuals, and other parties depending on the use case. Their perspectives can reveal risks that may not be obvious to the development team alone. Stakeholder involvement can support impact assessments, requirements definition, testing, communication, and ongoing monitoring. It does not mean that every stakeholder receives administrative access or decision-making authority. Instead, organizations should determine appropriate participation based on the person’s role, expertise, and relationship to the AI system.<\/span><\/p>\nQuestion 204<\/b><\/p>\n
What is a key reason to document the assumptions used during an AI risk assessment?<\/b><\/p>\n\n- To make future review and reassessment easier when conditions change<\/span><\/li>\n
- To prevent anyone from questioning the assessment<\/span><\/li>\n
- To eliminate the need for monitoring<\/span><\/li>\n
- To ensure the assessment never needs to be updated<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Documenting assumptions creates a record of the conditions and expectations that influenced an AI risk assessment. These assumptions may concern the intended users, data sources, operating environment, expected performance, level of human involvement, or other relevant factors. If circumstances later change, the organization can compare the new conditions with the original assumptions and determine whether reassessment is necessary. Without documented assumptions, it can be difficult to understand why certain risks were considered acceptable or why particular controls were selected. Documentation therefore supports traceability and accountability. It does not prevent reassessment; rather, it makes future reviews more informed and helps organizations identify when previous conclusions may no longer be valid.<\/span><\/p>\nQuestion 205<\/b><\/p>\n
Which practice best supports responsible use of AI-generated content?<\/b><\/p>\n\n- Treating every AI-generated output as automatically accurate<\/span><\/li>\n
- Applying appropriate human review and verification based on the use case<\/span><\/li>\n
- Removing all records of generated content<\/span><\/li>\n
- Allowing users to publish outputs without checking them<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI-generated content can contain inaccuracies, omissions, unsupported claims, or other errors. Appropriate human review and verification can help reduce the risk that incorrect content is used or distributed without sufficient scrutiny. The required level of review should depend on the purpose and potential impact of the content. Low-risk brainstorming may require less review than content used in important decisions, legal communications, financial analysis, or other high-impact contexts. Organizations should provide users with clear guidance about when verification is required. Treating all AI-generated content as automatically accurate can encourage overreliance. Responsible use therefore combines appropriate human judgment with relevant policies, training, and controls.<\/span><\/p>\nQuestion 206<\/b><\/p>\n
What is the purpose of defining minimum security requirements for AI systems?<\/b><\/p>\n\n- To establish baseline safeguards that systems must satisfy to reduce security risks<\/span><\/li>\n
- To guarantee that an AI system can never be attacked<\/span><\/li>\n
- To eliminate the need for security monitoring<\/span><\/li>\n
- To allow all users unrestricted access<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Minimum security requirements establish baseline safeguards that AI systems should meet before and during operation. Depending on the system, requirements may address authentication, authorization, encryption, vulnerability management, logging, secure development, access controls, incident response, and protection of sensitive data. Establishing baseline requirements creates consistency across AI deployments and helps prevent important security controls from being overlooked. These requirements cannot guarantee that an AI system will never be attacked because no security program eliminates all threats. Instead, they reduce exposure and improve the organization’s ability to detect and respond to security events. Additional safeguards may be required for systems with higher levels of risk or sensitivity.<\/span><\/p>\nQuestion 207<\/b><\/p>\n
Which situation could indicate that an AI system’s original risk classification should be reconsidered?<\/b><\/p>\n\n- The organization changes the system’s intended use to a higher-impact application<\/span><\/li>\n
- The system receives a new desktop shortcut<\/span><\/li>\n
- A user changes their password according to policy<\/span><\/li>\n
- The system’s documentation is moved to another folder<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
A change to a higher-impact intended use can materially alter the risks associated with an AI system. The new application may involve more sensitive data, affect more individuals, influence consequential decisions, or create greater potential harm if the system performs incorrectly. In such circumstances, the organization should reassess the system’s risk classification and determine whether additional controls, testing, human oversight, or approval are required. Risk classification should not be considered permanently fixed when the system’s context changes. Organizations should establish clear reassessment triggers so significant changes are identified promptly. Minor administrative changes generally do not have the same effect on the system’s underlying risk profile.<\/span><\/p>\nQuestion 208<\/b><\/p>\n
Why is version control important for AI models and related configurations?<\/b><\/p>\n\n- It helps organizations identify which version was used and track changes over time<\/span><\/li>\n
- It prevents all model errors<\/span><\/li>\n
- It removes the need for testing<\/span><\/li>\n
- It allows undocumented changes to production systems<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Version control helps organizations maintain traceability across model versions, configurations, code, and other relevant components. When an AI system produces an unexpected result, teams may need to determine which version was operating at the time and what changed between versions. Version control can also support controlled deployment, rollback, testing, and auditing. It does not prevent model errors by itself, nor does it eliminate the need for testing. Instead, it provides a reliable record that supports change management and investigation. For higher-risk systems, knowing exactly which model and configuration were deployed can be particularly important for accountability, incident response, and demonstrating that approved versions were used.<\/span><\/p>\nQuestion 209<\/b><\/p>\n
What should an organization do if an AI system’s documented limitations are no longer accurate?<\/b><\/p>\n\n- Update the documentation and reassess related risks and controls as appropriate<\/span><\/li>\n
- Leave the documentation unchanged<\/span><\/li>\n
- Remove all limitation information<\/span><\/li>\n
- Assume the system has become risk-free<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Documentation should reflect the actual behavior, capabilities, and limitations of an AI system. If new testing, monitoring, incidents, or system changes show that previous documentation is inaccurate, the organization should update the relevant records. It should also determine whether the change affects risk assessments, user guidance, training, human oversight, or approval conditions. Accurate documentation helps users make informed decisions and reduces the possibility of relying on outdated assumptions. Simply deleting limitation information could increase the risk of misuse or overreliance. Governance should treat documentation as a living component of the AI lifecycle, updating it when evidence shows that the system’s behavior or operating conditions have materially changed.<\/span><\/p>\nQuestion 210<\/b><\/p>\n
Which approach is most appropriate for setting monitoring requirements for AI systems?<\/b><\/p>\n\n- Apply identical monitoring to every system regardless of risk<\/span><\/li>\n
- Base monitoring on the system’s risk, intended use, and relevant performance indicators<\/span><\/li>\n
- Monitor only during the first day of deployment<\/span><\/li>\n
- Avoid monitoring systems that use third-party models<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Monitoring requirements should be proportionate to the AI system’s risk and intended use. Higher-risk systems may require more frequent monitoring, broader performance indicators, stronger alerting, and more formal escalation procedures. Relevant metrics can include accuracy, error rates, reliability, security events, data changes, subgroup performance, or other measures appropriate to the system. Third-party systems may also require monitoring because organizations remain responsible for managing risks associated with their use. Monitoring only during initial deployment is insufficient because real-world conditions can change. A risk-based approach helps organizations focus monitoring resources where changes or failures could have the greatest consequences while maintaining appropriate oversight for lower-risk applications.<\/span><\/p>\nQuestion 211<\/b><\/p>\n
What is an important consideration when determining whether human review is meaningful?<\/b><\/p>\n\n- Whether the reviewer has sufficient authority, information, and competence to intervene<\/span><\/li>\n
- Whether the reviewer is physically located near the AI server<\/span><\/li>\n
- Whether the reviewer has never seen an AI output before<\/span><\/li>\n
- Whether the review process is undocumented<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Meaningful human review requires more than simply placing a person somewhere in the decision process. The reviewer should have enough information to understand the AI output, sufficient competence to evaluate it, appropriate authority to challenge or override the result, and enough time to perform the review effectively. The process should also define when intervention is expected and how concerns should be escalated. If reviewers lack authority or are instructed to accept AI outputs automatically, human involvement may provide little practical protection. Meaningful oversight is especially important for high-impact applications where incorrect or harmful AI outputs could significantly affect individuals. Organizations should therefore design human review around actual decision-making needs.<\/span><\/p>\nQuestion 212<\/b><\/p>\n
Which activity can help identify unauthorized or unapproved AI use within an organization?<\/b><\/p>\n\n- Maintaining an AI inventory and conducting appropriate discovery or monitoring activities<\/span><\/li>\n
- Removing all AI-related policies<\/span><\/li>\n
- Preventing employees from reporting AI use<\/span><\/li>\n
- Assuming that only officially registered systems exist<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Organizations need visibility into AI systems that employees and business units are using, including systems that may have been introduced outside formal procurement or development processes. Maintaining an AI inventory can provide a central record of approved systems, while appropriate discovery and monitoring activities can help identify unapproved applications. Organizations should also provide clear channels for employees to disclose AI use without creating unnecessary barriers to responsible adoption. Assuming that only officially registered systems exist can create governance blind spots. Unauthorized AI use may introduce risks involving sensitive data, security, privacy, intellectual property, or inaccurate outputs. Identifying these systems allows the organization to evaluate the risks and determine appropriate corrective actions.<\/span><\/p>\nQuestion 213<\/b><\/p>\n
Why should AI governance programs include clear exception procedures?<\/b><\/p>\n\n- To provide a controlled process for evaluating requests that fall outside standard requirements<\/span><\/li>\n
- To allow employees to permanently ignore policies<\/span><\/li>\n
- To eliminate accountability for policy decisions<\/span><\/li>\n
- To ensure every exception is automatically approved<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Organizations may occasionally encounter legitimate situations where standard AI governance requirements do not fit a particular circumstance. A formal exception process provides a controlled way to evaluate such requests. The process can define who may request an exception, who has authority to approve it, what justification is required, how risks should be evaluated, what compensating controls may be necessary, and how long the exception remains valid. Exceptions should be documented and periodically reviewed rather than becoming permanent informal practices. A controlled process preserves accountability while allowing reasonable flexibility. Automatically approving every exception would weaken governance, while allowing employees to ignore policies without review could create significant unmanaged risks.<\/span><\/p>\nQuestion 214<\/b><\/p>\n
What is a key purpose of AI governance training for senior management?<\/b><\/p>\n\n- To help leaders understand their oversight responsibilities and major AI risks<\/span><\/li>\n
- To make every executive a machine-learning engineer<\/span><\/li>\n
- To remove the need for technical teams<\/span><\/li>\n
- To ensure all AI systems receive identical approval<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Senior management plays an important role in AI governance because leadership may approve resources, establish organizational priorities, accept certain risks, and make decisions about high-impact systems. Governance training can help leaders understand major AI risks, accountability expectations, escalation processes, and the organization’s approach to responsible AI use. The purpose is not to turn executives into technical specialists. Instead, leaders should understand enough to ask appropriate questions and make informed oversight decisions. Effective leadership awareness can strengthen organizational accountability and ensure that AI risks receive appropriate attention. Technical teams remain responsible for specialized implementation and evaluation, while leadership provides strategic direction and oversight.<\/span><\/p>\nQuestion 215<\/b><\/p>\n
Which practice helps reduce the risk of overreliance on AI outputs?<\/b><\/p>\n\n- Training users to critically evaluate outputs and understand system limitations<\/span><\/li>\n
- Telling users that AI outputs are always correct<\/span><\/li>\n
- Removing all human review requirements<\/span><\/li>\n
- Preventing users from reporting questionable results<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Overreliance occurs when users place more confidence in AI outputs than is justified by the system’s actual capabilities or evidence. Training users to understand limitations and critically evaluate outputs can reduce this risk. Users should know that AI systems may produce inaccurate, incomplete, biased, or contextually inappropriate results. Depending on the use case, organizations may also require verification, human review, or confirmation against trusted sources. Presenting AI as infallible encourages automation bias and can lead users to accept incorrect recommendations without sufficient scrutiny. Governance should therefore combine user education, clear system limitations, appropriate human oversight, and monitoring to promote informed use rather than unquestioning reliance.<\/span><\/p>\nQuestion 216<\/b><\/p>\n
What should an organization consider when establishing data retention requirements for an AI system?<\/b><\/p>\n\n- The purpose of the data, applicable requirements, risk, and legitimate operational needs<\/span><\/li>\n
- Keeping all data forever regardless of purpose<\/span><\/li>\n
- Deleting all data immediately without assessment<\/span><\/li>\n
- Retaining data only because storage is inexpensive<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Data retention should be based on the purpose for which information is needed, applicable requirements, organizational policies, and the risks associated with retaining the data. Keeping information indefinitely can increase privacy and security exposure, while deleting information too quickly may interfere with legitimate operational, legal, or audit requirements. Organizations should identify appropriate retention periods and establish processes for secure deletion or disposal when information is no longer required. AI systems may process training data, user inputs, logs, outputs, and other information with different retention needs. A thoughtful retention approach therefore considers each category separately and applies controls that are proportionate to the sensitivity and purpose of the data.<\/span><\/p>\nQuestion 217<\/b><\/p>\n
Which practice best supports secure management of AI system credentials?<\/b><\/p>\n\n- Sharing administrator passwords among team members<\/span><\/li>\n
- Using appropriate authentication, access controls, and secure credential management<\/span><\/li>\n
- Storing credentials in publicly accessible documents<\/span><\/li>\n
- Using the same password for every AI environment<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
Secure credential management reduces the risk that unauthorized individuals can access AI systems, models, data, or production environments. Organizations should use appropriate authentication mechanisms, limit permissions according to job responsibilities, protect credentials securely, and avoid sharing accounts whenever possible. Separate credentials or identities can improve accountability by making it possible to determine who performed a particular action. Sensitive credentials should not be stored in publicly accessible documents or reused across environments unnecessarily. Strong access management is especially important for systems that process confidential information or have the ability to modify production models. Security controls should be supported by periodic access reviews and prompt removal of unnecessary privileges.<\/span><\/p>\nQuestion 218<\/b><\/p>\n
What is the purpose of conducting post-deployment reviews of a high-risk AI system?<\/b><\/p>\n\n- To evaluate real-world performance, emerging risks, and whether controls remain effective<\/span><\/li>\n
- To automatically approve every future modification<\/span><\/li>\n
- To eliminate the need for incident response<\/span><\/li>\n
- To stop collecting performance information<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Post-deployment reviews provide an opportunity to evaluate how a high-risk AI system performs in its actual operating environment. Real-world use can reveal issues that were not identified during pre-deployment testing, including unexpected data changes, performance deterioration, user behavior, security concerns, or impacts on particular groups. Reviews can also determine whether established controls and human oversight remain effective. Findings may lead to additional testing, changes in controls, retraining, restrictions, or reassessment of the system’s approval. Post-deployment review complements continuous monitoring rather than replacing it. Together, these activities help organizations maintain appropriate governance as conditions evolve throughout the operational lifecycle.<\/span><\/p>\nQuestion 219<\/b><\/p>\n
Why should AI governance records identify who approved a significant decision?<\/b><\/p>\n\n- To establish accountability and traceability for the decision<\/span><\/li>\n
- To prevent future governance reviews<\/span><\/li>\n
- To guarantee that the decision was correct<\/span><\/li>\n
- To allow anyone to modify the record without authorization<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Identifying the person or authorized group responsible for approving a significant AI governance decision supports accountability and traceability. It creates a record of who had the authority to make the decision and can help clarify the reasoning and evidence considered at the time. This information can be useful during later reviews, audits, incidents, or reassessments. Recording an approver does not prove that the decision was correct, but it makes the governance process more transparent and helps ensure that appropriate authority was involved. Governance records should also be protected against unauthorized modification so that they remain trustworthy evidence of organizational decisions and actions.<\/span><\/p>\nQuestion 220<\/b><\/p>\n
Which principle should guide the design of an effective AI governance program?<\/b><\/p>\n\n