To provide unrestricted authority to individual developers<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. To define the governance body’s purpose, authority, responsibilities, and scope<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An AI governance charter formally establishes how governance responsibilities will operate within an organization. It can define the purpose of the governance body, its scope, membership, decision-making authority, responsibilities, reporting relationships, and escalation mechanisms. A clear charter reduces ambiguity between business, technical, risk, legal, privacy, and security functions. It also helps ensure that governance activities are supported by appropriate organizational authority rather than relying on informal cooperation. The charter should align with the organization’s broader governance structure and should be reviewed when responsibilities or organizational objectives change. A well-defined charter provides the foundation for consistent oversight without replacing the detailed policies, procedures, and technical controls required to manage AI systems.<\/span><\/p>\nQuestion 102. Which responsibility should normally remain with senior management for significant AI initiatives?<\/b><\/h3>\n\n- <\/b> Writing every model’s source code<\/span><\/li>\n
- <\/b> Approving risk appetite and overseeing significant AI-related risks<\/span><\/li>\n
- <\/b> Performing every data transformation manually<\/span><\/li>\n
- <\/b> Configuring individual user accounts<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Approving risk appetite and overseeing significant AI-related risks<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Senior management provides strategic direction and accountability for significant organizational risks, including risks created by AI initiatives. Management should establish or approve the organization’s risk appetite and ensure that appropriate governance structures exist to identify, assess, treat, and monitor AI-related risks. Senior leaders do not need to perform technical development tasks or configure individual systems themselves. Instead, they should receive meaningful reporting and challenge significant risk decisions when appropriate. Management oversight is especially important for high-impact AI applications because these systems may create financial, operational, legal, privacy, security, or reputational consequences. Clear executive accountability helps ensure that AI governance remains connected to organizational objectives and enterprise risk management.<\/span><\/p>\nQuestion 103. Why should AI governance roles be documented in a responsibility matrix?<\/b><\/h3>\n\n- <\/b> To identify who is responsible, accountable, consulted, and informed for important governance activities<\/span><\/li>\n
- <\/b> To eliminate the need for management oversight<\/span><\/li>\n
- <\/b> To ensure one person performs every activity<\/span><\/li>\n
- <\/b> To replace all AI policies<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. To identify who is responsible, accountable, consulted, and informed for important governance activities<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A responsibility matrix helps clarify ownership across complex AI governance activities. Different stakeholders may participate in risk assessments, model validation, privacy reviews, security testing, deployment approval, monitoring, incident response, and policy management. Without clearly defined responsibilities, important tasks can be overlooked or duplicated. A matrix such as RACI can distinguish who performs an activity, who is ultimately accountable, who must provide expertise or consultation, and who needs to be informed. This structure improves coordination and reduces ambiguity. The matrix should reflect the organization’s actual operating model and should be updated when roles, systems, or processes change. Clear accountability is particularly important for high-risk AI use cases.<\/span><\/p>\nQuestion 104. What is an AI impact assessment intended to identify?<\/b><\/h3>\n\n- <\/b> Only the computational resources required by a model<\/span><\/li>\n
- <\/b> The potential effects of an AI system on individuals, groups, the organization, and other stakeholders<\/span><\/li>\n
- <\/b> Only the cost of purchasing an AI service<\/span><\/li>\n
- <\/b> The preferred programming language for development<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. The potential effects of an AI system on individuals, groups, the organization, and other stakeholders<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An AI impact assessment examines the potential consequences of deploying or using an AI system. Depending on the context, it can consider effects on individuals, groups, customers, employees, business operations, privacy, security, fairness, legal obligations, and other stakeholders. The assessment helps organizations identify concerns before or during deployment and determine whether additional safeguards are necessary. It can also support transparent decision-making by documenting assumptions, affected parties, potential harms, and mitigation measures. The depth of an impact assessment should be proportionate to the system’s risk and intended use. For higher-impact applications, organizations may need more extensive analysis, stakeholder involvement, testing, documentation, and approval before operational use.<\/span><\/p>\nQuestion 105. Which activity should occur when an AI use case changes materially after approval?<\/b><\/h3>\n\n- <\/b> Ignore the change if the original system remains online<\/span><\/li>\n
- <\/b> Reassess the use case and determine whether additional approval or controls are required<\/span><\/li>\n
- <\/b> Delete the original risk assessment<\/span><\/li>\n
- <\/b> Automatically classify the system as low risk<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Reassess the use case and determine whether additional approval or controls are required<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An approved AI use case may become materially different when its purpose, users, data, model, decision authority, or operating environment changes. For example, an internal recommendation tool could become significantly higher risk if it is later used to support consequential decisions. Governance processes should therefore define what types of changes trigger reassessment. A material change may require a new impact assessment, updated risk classification, additional testing, revised documentation, or renewed approval. The original approval should not automatically be assumed to cover substantially different use. Change-triggered reassessment helps organizations maintain appropriate oversight throughout the lifecycle and ensures that controls remain aligned with the system’s actual purpose and risk profile.<\/span><\/p>\nQuestion 106. Which practice can help prevent sensitive information from being unintentionally submitted to an external generative AI service?<\/b><\/h3>\n\n- <\/b> Data loss prevention controls and clearly defined approved-use requirements<\/span><\/li>\n
- <\/b> Disabling all employee training<\/span><\/li>\n
- <\/b> Allowing unrestricted external AI access<\/span><\/li>\n
- <\/b> Removing data classification labels<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Data loss prevention controls and clearly defined approved-use requirements<\/b><\/p>\n
Explanation:<\/b><\/p>\n
External generative AI services can create information leakage risks when users submit confidential, proprietary, personal, or otherwise sensitive information. Organizations can address this through a combination of policy and technical controls. Acceptable-use requirements should explain what information may or may not be entered into external AI services. Technical measures such as data loss prevention, browser controls, approved enterprise AI platforms, access restrictions, and monitoring can reinforce those requirements. User training is also important because employees need to understand why certain information is restricted. Controls should reflect the organization’s data classification scheme and contractual obligations. The objective is to reduce inappropriate disclosure while still enabling authorized and useful AI adoption.<\/span><\/p>\nQuestion 107. What is the purpose of data classification in AI governance?<\/b><\/h3>\n\n- <\/b> To determine appropriate handling and protection requirements based on data sensitivity<\/span><\/li>\n
- <\/b> To guarantee data accuracy<\/span><\/li>\n
- <\/b> To ensure all data receives identical controls<\/span><\/li>\n
- <\/b> To eliminate the need for access management<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. To determine appropriate handling and protection requirements based on data sensitivity<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Data classification categorizes information according to characteristics such as sensitivity, confidentiality, criticality, or regulatory requirements. In AI environments, classification can help determine whether information may be used for training, testing, prompts, retrieval, or model outputs and what safeguards are required. Highly sensitive information may require stronger access restrictions, encryption, monitoring, retention controls, or prohibitions on use in certain external services. Classification does not itself guarantee data quality or security. It provides a basis for applying proportionate controls. Effective AI governance should connect data classifications with practical handling rules so that employees, applications, and AI systems can consistently determine how different categories of information should be protected.<\/span><\/p>\nQuestion 108. Which principle is most relevant when collecting only the information necessary for a defined AI purpose?<\/b><\/h3>\n\n- <\/b> Unlimited data retention<\/span><\/li>\n
- <\/b> Data minimization<\/span><\/li>\n
- <\/b> Universal access<\/span><\/li>\n
- <\/b> Maximum data collection<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Data minimization<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Data minimization means collecting, processing, or retaining only the information that is necessary for a legitimate and defined purpose. In AI systems, minimizing data can reduce privacy exposure, security risk, storage requirements, and the potential consequences of a breach or misuse. It can also make governance easier because teams have fewer categories of information to manage. Organizations should first identify the intended AI purpose and then determine what information is genuinely required. Collecting additional data simply because it might become useful later can increase risk without providing corresponding value. Data minimization should be considered during system design, dataset creation, prompt handling, retention planning, and changes to the AI use case.<\/span><\/p>\nQuestion 109. What is the purpose of conducting bias and fairness testing on an AI system?<\/b><\/h3>\n\n- <\/b> To identify whether model behavior may produce materially different or inappropriate outcomes across relevant groups<\/span><\/li>\n
- <\/b> To guarantee that no model can ever make an error<\/span><\/li>\n
- <\/b> To eliminate all human decision-making<\/span><\/li>\n
- <\/b> To increase model size<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. To identify whether model behavior may produce materially different or inappropriate outcomes across relevant groups<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Fairness testing helps organizations investigate whether an AI system produces problematic differences in outcomes across relevant groups or populations. The appropriate evaluation depends on the use case, affected population, data characteristics, and organizational or legal requirements. Testing may examine differences in error rates, selection rates, false positives, false negatives, or other outcome measures. Results should be interpreted carefully because fairness metrics can sometimes produce different conclusions and may not capture every relevant concern. Testing should therefore be combined with contextual analysis, documentation, and appropriate stakeholder review. Identified disparities should be investigated to determine whether they arise from data, model behavior, business rules, or other aspects of the overall decision process.<\/span><\/p>\nQuestion 110. Why should fairness assessment methods be selected according to the AI use case?<\/b><\/h3>\n\n- <\/b> Because fairness concerns and appropriate metrics depend on the context, population, decisions, and consequences involved<\/span><\/li>\n
- <\/b> Because one fairness metric is universally correct<\/span><\/li>\n
- <\/b> Because technical performance is unrelated to fairness<\/span><\/li>\n
- <\/b> Because fairness testing is only necessary for image models<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Because fairness concerns and appropriate metrics depend on the context, population, decisions, and consequences involved<\/b><\/p>\n
Explanation:<\/b><\/p>\n
There is no single fairness measurement that is appropriate for every AI application. The relevant assessment depends on what the system does, who is affected, what decisions are being supported, and what types of errors create harm. For example, an organization may need to examine different outcome and error measures depending on whether an AI system recommends content, detects fraud, supports resource allocation, or assists with another consequential process. Governance teams should define relevant populations and metrics before evaluating results and should document why the selected methods are appropriate. Fairness assessment should also consider limitations in the available data and should not treat a favorable metric as proof that every fairness concern has been resolved.<\/span><\/p>\nQuestion 111. Which practice best supports explainability of a high-impact AI decision?<\/b><\/h3>\n\n- <\/b> Providing relevant information about the factors, process, and limitations underlying the decision<\/span><\/li>\n
- <\/b> Hiding all information about the model<\/span><\/li>\n
- <\/b> Providing only the model’s version number<\/span><\/li>\n
- <\/b> Allowing users to assume the output is always correct<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Providing relevant information about the factors, process, and limitations underlying the decision<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Explainability helps relevant stakeholders understand how an AI system arrived at an output or recommendation, to the extent appropriate for the model and use case. For high-impact decisions, stakeholders may need information about important input factors, decision logic, model limitations, confidence or uncertainty indicators, and the role of human review. The appropriate level of explanation varies by system and audience. Explainability does not necessarily mean exposing proprietary source code or every internal model parameter. Instead, governance should ensure that explanations provide meaningful information for oversight, challenge, and decision-making. Documentation should also clearly identify situations where the AI output may be unreliable or where additional human investigation is required.<\/span><\/p>\nQuestion 112. What is the role of human oversight when an AI system supports a high-impact decision?<\/b><\/h3>\n\n- <\/b> To provide meaningful review, challenge, and intervention when appropriate<\/span><\/li>\n
- <\/b> To approve every output without examination<\/span><\/li>\n
- <\/b> To transfer accountability entirely to the model<\/span><\/li>\n
- <\/b> To remove all escalation procedures<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. To provide meaningful review, challenge, and intervention when appropriate<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Human oversight is intended to ensure that consequential AI-supported decisions are not accepted automatically without appropriate review. Effective oversight requires people with suitable knowledge, authority, and access to relevant information. Reviewers should understand the AI system’s limitations and know when to question, reject, or escalate an output. Human oversight is ineffective if the reviewer simply approves every recommendation without examination or lacks the authority to intervene. Governance should therefore define when human review is mandatory, what evidence should be considered, and how decisions are documented. The level of oversight should be proportionate to risk, with higher-impact decisions generally requiring stronger review and intervention mechanisms.<\/span><\/p>\nQuestion 113. What is a key objective of AI model validation before production deployment?<\/b><\/h3>\n\n- <\/b> To obtain evidence that the model meets defined performance, risk, and governance requirements<\/span><\/li>\n
- <\/b> To guarantee that the model will never fail<\/span><\/li>\n
- <\/b> To eliminate all monitoring after deployment<\/span><\/li>\n
- <\/b> To avoid documenting test results<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. To obtain evidence that the model meets defined performance, risk, and governance requirements<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Model validation provides evidence that an AI model is suitable for its intended purpose before it is placed into production. Validation can address performance, robustness, security, fairness, privacy, reliability, and other requirements relevant to the use case. The testing approach should use appropriate datasets and clearly defined criteria. Results and limitations should be documented so decision-makers understand what was tested and what was not. Validation does not guarantee future performance because models and operating environments can change. Consequently, predeployment validation should be complemented by postdeployment monitoring and periodic reassessment. Strong validation provides an evidence-based basis for deciding whether a model is ready for controlled operational use.<\/span><\/p>\nQuestion 114. Which situation should normally trigger additional AI risk assessment?<\/b><\/h3>\n\n- <\/b> A significant change to the model, data, purpose, users, or operating environment<\/span><\/li>\n
- <\/b> A routine employee lunch break<\/span><\/li>\n
- <\/b> A change in office furniture<\/span><\/li>\n
- <\/b> A cosmetic change to an unrelated website<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. A significant change to the model, data, purpose, users, or operating environment<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AI risk is dynamic, so material changes should trigger consideration of whether the existing assessment remains valid. Significant changes may include replacing a model, introducing a new dataset, expanding the system to a new population, changing the intended purpose, increasing automation, connecting new external services, or moving the system into a more critical business process. These changes can introduce risks that were not present during the original assessment. Organizations should establish defined change thresholds and reassessment triggers so teams know when additional review is required. Risk reassessment does not necessarily mean repeating every activity from the beginning; the scope should be proportionate to the nature and significance of the change.<\/span><\/p>\nQuestion 115. Why should AI-related incidents be analyzed for root causes?<\/b><\/h3>\n\n- <\/b> To identify underlying weaknesses and reduce the likelihood of similar incidents recurring<\/span><\/li>\n
- <\/b> To assign blame without examining controls<\/span><\/li>\n
- <\/b> To avoid documenting incidents<\/span><\/li>\n