I85PREP
⌘ K
AI-RRS study materials
AI-RRS study resources

AI-RRS practice questions

One question at a time. Build your AI-RRS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AI and Algorithm Risk Fundamentals

Which statement best defines algorithmic risk in an AI system?

  1. The latency of model inference under peak load
  2. The cost of the compute hardware required to train a model
  3. The legal ownership status of training data
  4. The potential for an AI system to cause harm or loss through its outputs, decisions, or behavior Correct answer.

Explanation

Algorithmic risk refers to the possibility that an AI system's design, data, or behavior produces harmful or loss-inducing outcomes for people or the organization. Hardware cost, data ownership, and latency are operational or legal concerns but do not by themselves constitute algorithmic risk.

Question 2AI and Algorithm Risk Fundamentals

A bank's credit model performs well overall but approves far fewer applicants from one demographic group. Which risk category does this most directly illustrate?

  1. Data poisoning
  2. Model drift
  3. Bias and unfair discrimination Correct answer.
  4. Overfitting to noise

Explanation

Disparate approval rates across demographic groups are the classic signature of bias and unfair discrimination in a model. Drift, poisoning, and overfitting concern performance change, data integrity, and generalization respectively, not group-level fairness disparities.

Question 3AI and Algorithm Risk Fundamentals

What does the term 'model drift' describe?

  1. A degradation in model performance as the relationship between inputs and outcomes changes over time Correct answer.
  2. The compression of a model for edge deployment
  3. The migration of a model between cloud providers
  4. The process of retraining a model from scratch

Explanation

Model drift is the deterioration of predictive performance when the statistical relationship between inputs and targets shifts. It is distinct from infrastructure migration, model compression, and full retraining, which are engineering activities rather than a phenomenon of performance change.

Question 4AI and Algorithm Risk Fundamentals

Which of the following is the clearest example of an 'explainability' risk in an AI system?

  1. A model whose decisions cannot be justified to regulators or affected customers Correct answer.
  2. A model trained on an insufficiently large dataset
  3. A model that consumes too much memory on servers
  4. A model that runs too slowly during peak hours

Explanation

Explainability risk arises when stakeholders cannot understand or justify how a model reached a decision, which impedes accountability and regulatory compliance. Slow runtime, small datasets, and high memory use are performance or data concerns, not explainability.

Question 5AI and Algorithm Risk Fundamentals

In the AI risk lifecycle, at which stage is it most effective to identify and mitigate bias in training data?

  1. During data collection and preparation, before training Correct answer.
  2. After the model has been retired
  3. During the final audit following a customer complaint
  4. Only after the model has been deployed to production

Explanation

Bias is best addressed at the data collection and preparation stage, before it is learned by the model. Detecting it only after deployment or after complaints is reactive and costly, and post-retirement review is too late to prevent harm.

Question 6AI and Algorithm Risk Fundamentals

Which concept refers to an attacker deliberately manipulating the inputs at inference time to cause a model to misclassify?

  1. Adversarial example Correct answer.
  2. Label leakage
  3. Feature scaling
  4. Concept drift

Explanation

An adversarial example is an input intentionally perturbed to induce a model error at inference. Concept drift is a natural change in data distribution, label leakage is a training data flaw, and feature scaling is a preprocessing step.

Question 7AI and Algorithm Risk Fundamentals

Which of the following best describes 'human oversight' as an AI risk control?

  1. A scheduled job that retrains the model nightly
  2. A backup server that takes over if the primary fails
  3. A person with authority reviews and can override consequential model decisions Correct answer.
  4. A dashboard that displays model accuracy metrics to engineers

Explanation

Human oversight means a person with the authority and ability to review and override consequential decisions made by the system. Dashboards, failover servers, and retraining jobs are monitoring or engineering controls that do not provide decision-level human intervention.

Question 8AI and Algorithm Risk Fundamentals

A team documents the intended use, known limitations, and assumptions of a model before deployment. Which risk management practice does this represent?

  1. Model documentation and intended-use specification Correct answer.
  2. Data deduplication
  3. Load balancing
  4. Penetration testing

Explanation

Recording intended use, limitations, and assumptions is model documentation, a core governance practice that helps downstream users understand appropriate and inappropriate applications. Penetration testing, load balancing, and deduplication are technical operations unrelated to documenting intended use.

Question 9AI and Algorithm Risk Fundamentals

An AI system makes automated decisions about loan eligibility. Which factor most increases the severity of the risk it poses?

  1. The model uses a decision-tree architecture
  2. The model is served from a container
  3. The training set contains 50,000 rows
  4. The decisions have significant financial consequences for individuals Correct answer.

Explanation

Risk severity scales with the magnitude of impact on affected people, so high-stakes financial decisions elevate risk. Architecture choice, dataset size, and deployment packaging affect performance or operations but not the severity of consequences.

Question 10AI and Algorithm Risk Fundamentals

What distinguishes 'model risk' from general operational risk in an AI context?

  1. Model risk is solely a cybersecurity concern
  2. Model risk arises from incorrect or misused model outputs and decisions Correct answer.
  3. Model risk only applies to non-AI software
  4. Model risk is limited to hardware failures

Explanation

Model risk is the risk of adverse consequences from incorrect or inappropriate use of model outputs and decisions. It is broader than hardware failure, applies specifically to models, and is not reducible to cybersecurity.

Question 11AI and Algorithm Risk Fundamentals

A fraud model was trained on historical data reflecting past enforcement patterns that over-targeted a specific region. What risk does this most likely introduce?

  1. The model will require less monitoring
  2. The model will necessarily converge faster
  3. The model may perpetuate historical bias present in the labels Correct answer.
  4. The model will be immune to drift

Explanation

When labels reflect biased historical decisions, a model trained on them learns and reproduces that bias. This does not improve convergence, reduce monitoring needs, or confer immunity to drift.

Question 12AI and Algorithm Risk Fundamentals

Which of the following best characterizes 'feedback loop' risk in a deployed AI system?

  1. The model uses a fixed random seed
  2. The training data is stored in multiple regions
  3. The system periodically restarts to clear memory
  4. Model outputs influence future training data, reinforcing and amplifying initial patterns Correct answer.

Explanation

Feedback loops occur when the model's own outputs shape the data used to retrain it, potentially amplifying biases or errors over time. Restarts, random seeds, and data replication are unrelated operational details.

Question 13AI and Algorithm Risk Fundamentals

What is the primary purpose of conducting a pre-deployment risk assessment for an AI system?

  1. To satisfy a one-time documentation requirement
  2. To eliminate the need for ongoing monitoring
  3. To guarantee the model has zero errors
  4. To identify, evaluate, and plan mitigations for risks before harms occur Correct answer.

Explanation

A pre-deployment risk assessment identifies and evaluates potential harms and defines mitigations before the system is used. It cannot guarantee zero errors, does not remove the need for monitoring, and is more than a paperwork exercise.

Question 14AI and Algorithm Risk Fundamentals

A recommendation engine increasingly shows users content similar to what they already engaged with, narrowing exposure over time. Which risk does this illustrate?

  1. Label leakage
  2. Filter bubble or echo chamber amplification Correct answer.
  3. Model quantization
  4. Data poisoning

Explanation

Feedback-driven personalization that narrows exposure to familiar content illustrates filter bubbles or echo chambers. Poisoning involves corrupted data, label leakage is a training flaw, and quantization is a model-compression technique.

Question 15AI and Algorithm Risk Fundamentals

Which factor most directly determines the likelihood component of an AI risk?

  1. The choice of programming language
  2. The number of engineers on the team
  3. The brand of GPU used for training
  4. The frequency and conditions under which the harmful event could occur Correct answer.

Explanation

Likelihood in risk analysis reflects how often and under what conditions a harmful event could occur. Team size, language, and hardware brand are not direct determinants of the probability of harm.

Question 16AI and Algorithm Risk Fundamentals

A healthcare triage model performs well in the hospital where it was trained but poorly at a rural clinic with different patient demographics. Which risk is most evident?

  1. Model quantization error
  2. Distribution shift between training and deployment populations Correct answer.
  3. License non-compliance
  4. Adversarial attack

Explanation

Performance degradation when deployment populations differ from the training distribution is distribution shift. This is not an adversarial attack, a quantization artifact, or a licensing issue.

Question 17AI and Algorithm Risk Fundamentals

Which practice best supports accountability for an AI system's decisions?

  1. Relying solely on vendor documentation
  2. Removing all logging to protect privacy
  3. Allowing any team member to change the model without review
  4. Assigning clear ownership and responsibility for the model across its lifecycle Correct answer.

Explanation

Accountability requires clearly assigned ownership and responsibility throughout the model lifecycle. Removing logs, permitting unreviewed changes, and relying only on vendor documentation all undermine traceability and responsibility.

Question 18AI and Algorithm Risk Fundamentals

An organization wants to reduce the risk of an overconfident model producing wrong answers in a high-stakes setting. Which control most directly addresses this?

  1. Increasing the batch size during training
  2. Adding more GPUs to the inference cluster
  3. Shortening the model's variable names
  4. Calibrating confidence scores and routing low-confidence cases to human review Correct answer.

Explanation

Calibration makes confidence scores reflect true correctness, and routing low-confidence cases to humans limits the impact of overconfidence. Batch size, GPU count, and variable naming do not address the reliability of confidence estimates.

Question 19AI and Algorithm Risk Fundamentals

Which of the following is an example of a 'false negative' risk in a screening AI system?

  1. The system uses too much disk space
  2. The system runs slower than expected
  3. The system fails to flag a case that should have been flagged Correct answer.
  4. The system flags a case that is actually benign

Explanation

A false negative occurs when the system misses a positive case it should have flagged, which can be a serious safety risk in screening. A false positive is flagging a benign case, while slowness and disk usage are performance concerns.

Question 20AI and Algorithm Risk Fundamentals

What is the main risk associated with deploying a model whose training data provenance is unknown?

  1. The model will require no validation
  2. The model will automatically be explainable
  3. The model will train faster than expected
  4. The data may contain unauthorized, biased, or unrepresentative content affecting outputs and compliance Correct answer.

Explanation

Unknown provenance raises risks that data is unauthorized, biased, or unrepresentative, affecting both outputs and legal compliance. It does not speed training, remove validation needs, or confer explainability.

Question 21AI and Algorithm Risk Fundamentals

Which statement best captures the relationship between model complexity and explainability risk?

  1. Simpler models always have higher explainability risk
  2. More complex models often trade interpretability for performance, raising explainability risk Correct answer.
  3. More complex models are always more explainable
  4. Explainability is unrelated to model complexity

Explanation

Complex models such as deep networks often achieve higher performance at the cost of interpretability, increasing explainability risk. They are not always more explainable, explainability is related to complexity, and simpler models generally pose lower explainability risk.

Question 22AI and Algorithm Risk Fundamentals

A team detects that their deployed model's input feature distributions have shifted but its accuracy metrics remain stable. What is the most appropriate interpretation?

  1. The model is guaranteed to remain accurate indefinitely
  2. The shift can be safely ignored without monitoring
  3. The model must be immediately retired
  4. Covariate shift may be occurring, and monitoring should continue in case performance later degrades Correct answer.

Explanation

A change in input distributions with stable accuracy indicates covariate shift that has not yet harmed performance; continued monitoring is warranted because performance may degrade later. It does not guarantee future accuracy, justify ignoring the shift, or require immediate retirement.

Question 23AI and Algorithm Risk Fundamentals

Which scenario best illustrates 'automation bias' as an AI risk?

  1. An engineer retrains the model on fresh data
  2. A team documents the model's intended use
  3. A reviewer accepts a model's recommendation without independent scrutiny because it appears authoritative Correct answer.
  4. A developer writes unit tests for preprocessing

Explanation

Automation bias is the tendency for humans to over-trust automated outputs and reduce their own scrutiny, weakening the effectiveness of human oversight. Retraining, unit testing, and documentation are sound practices that do not describe this bias.

Question 24AI and Algorithm Risk Fundamentals

An AI system's risk register lists a risk as 'high likelihood, low severity.' How should mitigation effort typically be prioritized relative to a 'low likelihood, high severity' risk?

  1. Both require attention, but the high-severity risk may warrant stronger safeguards despite lower likelihood Correct answer.
  2. Only the high-severity risk matters
  3. Neither risk requires mitigation
  4. Only the high-likelihood risk matters

Explanation

Risk prioritization considers both likelihood and severity, and high-severity outcomes can justify strong safeguards even when unlikely. Dismissing either dimension ignores the combined nature of risk, and neither risk can be assumed to need no mitigation.

Question 25AI and Algorithm Risk Fundamentals

A model's outputs are used to allocate scarce public resources. Which combination of factors most increases overall algorithmic risk?

  1. High impact on individuals, limited explainability, and weak human oversight Correct answer.
  2. Low impact on individuals, limited explainability, and weak oversight
  3. High impact on individuals, strong explainability, and robust oversight
  4. Low impact on individuals, strong explainability, and robust oversight

Explanation

Risk compounds when high-impact decisions combine with poor explainability and weak oversight, since harms are severe and hard to detect or contest. The other combinations either reduce impact or strengthen transparency and oversight, lowering overall risk.

Question 26AI and Algorithm Risk Fundamentals

In AI risk terminology, what does 'algorithmic bias' most precisely refer to?

  1. Random hardware failures that corrupt model outputs at inference time
  2. Systematic and repeatable errors that create unfair outcomes for particular groups Correct answer.
  3. The tendency of users to trust automated outputs more than human judgment
  4. The use of encrypted algorithms to protect sensitive training data

Explanation

Algorithmic bias describes systematic, repeatable skew in outcomes that disadvantages certain groups, arising from data, design, or deployment context. It is distinguished from random error because the pattern is consistent and directional.

Question 27AI and Algorithm Risk Fundamentals

Which term describes the risk that a model continues to perform as designed but its environment has changed so its outputs are no longer appropriate?

  1. Model drift Correct answer.
  2. Adversarial evasion
  3. Overfitting
  4. Data poisoning

Explanation

Model drift covers degradation in relevance or performance as the relationship between inputs and the real world changes over time. The model may still run correctly, but its assumptions no longer match the deployment context.

Question 28AI and Algorithm Risk Fundamentals

Which of the following best describes 'explainability risk' in an AI system?

  1. The training dataset contains more features than the model can use
  2. Stakeholders cannot understand or challenge the basis of a model's outputs Correct answer.
  3. The model has been trained on data from a single geographic region
  4. The model requires more compute than the deployment budget allows

Explanation

Explainability risk arises when the reasoning behind outputs cannot be understood or contested by affected parties, auditors, or operators. This impairs accountability, recourse, and effective oversight.

Question 29AI and Algorithm Risk Fundamentals

Which concept refers to unintended harm caused by an AI system operating exactly as specified but in a way that conflicts with human values or expectations?

  1. Model inversion
  2. Concept drift
  3. Bias auditing
  4. Specification gaming Correct answer.

Explanation

Specification gaming occurs when a system optimizes the literal objective it was given in ways that violate the intent behind it. The system is functioning as designed, yet the outcome is harmful or misaligned with human expectations.

Question 30AI and Algorithm Risk Fundamentals

A bank deploys a credit-scoring model. Which characteristic most directly raises the potential severity of harm from an error?

  1. The model uses gradient-boosted trees rather than a neural network
  2. The model's predictions are reviewed by a second analyst
  3. The model's outputs determine access to essential financial services Correct answer.
  4. The model is retrained on a quarterly schedule

Explanation

Severity reflects the magnitude of consequences when something goes wrong, and decisions affecting access to essential services carry high stakes. Retraining cadence, algorithm family, and review steps affect likelihood or mitigation rather than the intrinsic severity of an error.

Question 31AI and Algorithm Risk Fundamentals

A team finds that a deployed model's predictions remain accurate overall, but error rates for a minority subgroup have risen sharply. Which risk category does this most clearly illustrate?

  1. Disparate performance across subgroups Correct answer.
  2. Training-serving skew in feature encoding
  3. Adversarial input manipulation
  4. Model extraction attack

Explanation

Unequal error rates across subgroups indicate performance disparity, a fairness and reliability risk even when aggregate metrics look healthy. Aggregate accuracy can mask subgroup-specific degradation.

Question 32AI and Algorithm Risk Fundamentals

Which practice most directly reduces the risk of deploying an AI system whose behavior cannot be reconstructed after an incident?

  1. Adding more hidden layers to the architecture
  2. Maintaining versioned records of data, code, and model artifacts Correct answer.
  3. Increasing the size of the training dataset
  4. Shortening the model's inference latency

Explanation

Reproducibility and post-incident investigation depend on traceable, versioned records linking data, code, configuration, and model artifacts. Without this lineage, investigators cannot reconstruct how a given output was produced.

Question 33AI and Algorithm Risk Fundamentals

What is the primary risk associated with an AI system that has no defined scope of intended use?

  1. The system will require retraining on every request
  2. The system cannot be deployed in any cloud environment
  3. The system will automatically fail its accuracy benchmarks
  4. The system may be applied to contexts it was not validated for Correct answer.

Explanation

A defined intended-use statement constrains where and how a model may legitimately be applied. Without it, the model can be repurposed into contexts where its assumptions and validation do not hold.

Question 34AI and Algorithm Risk Fundamentals

Which of the following is a privacy-specific risk of a model trained on personal data?

  1. Membership inference revealing whether an individual was in the training set Correct answer.
  2. Concept drift reducing predictive accuracy over time
  3. Model latency exceeding service-level targets
  4. Overfitting causing poor generalization to new users

Explanation

Membership inference is a privacy attack that exploits a model's behavior to infer whether specific personal records were used in training. It is distinct from performance or operational concerns.

Question 35AI and Algorithm Risk Fundamentals

An organization is prioritizing mitigations in its AI risk register. Which risk should typically be addressed first?

  1. A low-likelihood, low-severity risk with a well-understood cause
  2. A high-likelihood, high-severity risk affecting vulnerable populations Correct answer.
  3. A medium-likelihood, low-severity risk with an inexpensive fix
  4. A low-likelihood, high-severity risk that has never been observed

Explanation

Prioritization generally combines likelihood and severity, and risks affecting vulnerable populations can amplify both. The highest combined exposure should receive attention before lower-exposure items.

Question 36AI and Algorithm Risk Fundamentals

Which factor most directly increases the likelihood component of an AI risk?

  1. A high rate of known failure modes occurring under normal operating conditions Correct answer.
  2. The size of the organization deploying the system
  3. The presence of a documented human review step
  4. The use of a recently published model architecture

Explanation

Likelihood estimates how probable a harmful event is, and frequent occurrence of known failure modes in normal operation directly raises that probability. Organizational or architectural attributes do not by themselves establish event frequency.

Question 37AI and Algorithm Risk Fundamentals

A company fine-tunes a general-purpose model on internal documents. Which risk arises specifically because the model may reproduce memorized training content?

  1. Inability to run the model on-premises
  2. Leakage of confidential information in generated outputs Correct answer.
  3. Increased inference latency from fine-tuning
  4. Reduced ability to process long inputs

Explanation

Fine-tuning on sensitive documents can cause a model to memorize and later emit that content, creating a confidentiality leakage risk. This is a data-protection concern rather than a performance one.

Question 38AI and Algorithm Risk Fundamentals

Which statement best characterizes the relationship between model complexity and explainability risk?

  1. Explainability risk applies only to linear models
  2. Greater complexity always improves explainability by capturing more features
  3. Greater complexity often reduces transparency, raising explainability risk Correct answer.
  4. Explainability risk is independent of model complexity

Explanation

As models grow more complex, their internal decision logic typically becomes harder to interpret, increasing explainability risk. The relationship is a tendency rather than an absolute rule.

Question 39AI and Algorithm Risk Fundamentals

A model's accuracy remains stable, but the distribution of its input features has shifted substantially since deployment. Which interpretation is most appropriate?

  1. The shift is harmless because accuracy is the only meaningful risk indicator
  2. Stable accuracy can mask latent risk because the model may be relying on fragile relationships Correct answer.
  3. The shift proves the model was overfitted at training time
  4. The model has been compromised by an adversarial attacker

Explanation

Stable aggregate accuracy does not guarantee robustness when inputs change, since performance may depend on relationships that could break under further shift. Monitoring should track input distributions alongside outcome metrics.

Question 40AI and Algorithm Risk Fundamentals

Which combination of factors most increases overall algorithmic risk for a system used to allocate scarce public benefits?

  1. High-stakes decisions, limited contestability, and vulnerable affected groups Correct answer.
  2. Low-stakes decisions, limited transparency, and automated retraining
  3. Low-stakes decisions, clear appeal rights, and broad stakeholder input
  4. High-stakes decisions, clear appeal rights, and regular independent audits

Explanation

Overall risk rises when high-stakes outcomes combine with weak ability to challenge decisions and impacts concentrated on vulnerable people. These factors compound severity and reduce the capacity for harm to be corrected.

Question 41AI Risk Governance and Frameworks

Which document in a typical AI governance framework assigns day-to-day accountability for a model's performance to a named individual?

  1. The acceptable use policy for employees
  2. The risk register entry for the model
  3. The roles and responsibilities matrix Correct answer.
  4. The model card published for external users

Explanation

A roles and responsibilities matrix (such as a RACI chart) maps specific activities and decisions to accountable owners. Model cards, risk registers, and acceptable use policies describe artifacts, risks, or permitted behavior rather than assigning ownership.

Question 42AI Risk Governance and Frameworks

An organization wants a lightweight first-pass screen to decide which AI systems require deeper risk assessment. Which governance mechanism best fits this purpose?

  1. A full third-party audit
  2. A board-level risk appetite statement
  3. A tiered intake triage questionnaire Correct answer.
  4. A post-incident root cause review

Explanation

Intake triage is designed to classify proposed AI systems quickly and route high-risk ones to deeper review. Full audits, appetite statements, and incident reviews operate at other stages or levels of the governance lifecycle.

Question 43AI Risk Governance and Frameworks

What is the primary function of a model risk register within an AI governance program?

  1. To log every API call made to production models
  2. To store the training datasets used to build models
  3. To publish marketing claims about model accuracy
  4. To track identified risks, ratings, owners, and mitigation status Correct answer.

Explanation

A risk register is a living inventory that records each identified risk along with its assessment, assigned owner, and treatment status. It supports monitoring and escalation rather than data storage, marketing, or operational logging.

Question 44AI Risk Governance and Frameworks

A governance team defines the maximum acceptable rate of false declines for a credit-scoring model before escalation is triggered. What governance element have they established?

  1. A model training budget
  2. An incident severity taxonomy
  3. A risk tolerance threshold Correct answer.
  4. A data retention schedule

Explanation

A risk tolerance threshold expresses the level of a given metric beyond which the organization will not accept the risk without action. Retention schedules, budgets, and severity taxonomies address different governance concerns.

Question 45AI Risk Governance and Frameworks

Which practice best supports traceability of governance decisions across an AI system's lifecycle?

  1. Deleting interim review notes after launch
  2. Relying on verbal approvals from senior leaders
  3. Archiving only the final production model artifact
  4. Maintaining a dated decision log with rationale and approvers Correct answer.

Explanation

A decision log captures what was decided, when, by whom, and why, enabling later audit and accountability. Verbal approvals, artifact-only archiving, and deletion of review notes all undermine traceability.

Question 46AI Risk Governance and Frameworks

In a three-lines-of-defense model, which group provides independent oversight and challenge to AI risk management?

  1. The customer support team
  2. The data engineering team
  3. The internal audit function Correct answer.
  4. The business unit that owns the AI product

Explanation

In the three-lines model, internal audit forms the third line and provides independent assurance over the risk management performed by the first and second lines. Business owners, engineering, and support teams operate within the first line.

Question 47AI Risk Governance and Frameworks

Which statement best describes the purpose of an AI ethics review board?

  1. To replace all regulatory compliance obligations
  2. To provide multidisciplinary judgment on ethically sensitive AI use cases Correct answer.
  3. To approve the engineering sprint backlog each quarter
  4. To set the organization's cloud infrastructure budget

Explanation

An ethics review board convenes diverse expertise to evaluate ethically contentious use cases and advise on acceptable deployment. It complements rather than replaces compliance obligations and does not manage engineering or infrastructure planning.

Question 48AI Risk Governance and Frameworks

What distinguishes a policy from a standard in an AI governance document hierarchy?

  1. A policy is reviewed annually, while a standard is never revised
  2. A policy applies only to executives, while a standard applies only to engineers
  3. A policy is optional guidance, while a standard is legally binding
  4. A policy states mandatory high-level requirements, while a standard specifies detailed mandatory controls Correct answer.

Explanation

In a typical hierarchy, policies set mandatory direction and intent, while standards translate that intent into specific, enforceable requirements. Both are generally mandatory, and both apply across relevant roles and are subject to revision.

Question 49AI Risk Governance and Frameworks

A team proposes an AI hiring-screening tool. Under a risk-tiering framework, which characteristic most strongly pushes the tool toward a high-risk classification?

  1. It uses a cloud-hosted database
  2. It has a web-based user interface
  3. It is written in a popular programming language
  4. It produces decisions affecting access to employment Correct answer.

Explanation

Risk tiers typically hinge on the significance of the affected domain and the potential for harm to individuals. Employment decisions are a sensitive domain, so tools affecting access to jobs are commonly treated as high risk regardless of technical implementation details.

Question 50AI Risk Governance and Frameworks

A governance analyst finds that a deployed model's documented intended use excludes clinical diagnosis, but a hospital client is using it that way. Which control gap does this most directly expose?

  1. Poor user interface accessibility
  2. Insufficient model compression
  3. Missing use-case enforcement and monitoring Correct answer.
  4. Inadequate data encryption at rest

Explanation

When actual use diverges from documented intended use, the governance failure lies in enforcement and monitoring of permitted use cases. Compression, encryption, and accessibility are technical concerns unrelated to use-case drift.