Risk and regulatory drivers
What the exam tests
This domain checks your ability to connect AI governance to regulatory and risk drivers and to translate obligations into controls and evidence.
Core drivers
- The EU AI Act uses risk tiers: prohibited practices, high-risk systems, limited-risk transparency obligations, and general-purpose AI rules. High-risk examples include employment screening, credit eligibility, education access, and essential services.
- NIST AI RMF organizes work into Govern, Map, Measure, and Manage functions; it is a voluntary framework, not a certification.
- ISO/IEC 42001 defines an AI management system; certification shows management-system conformity, not automatic legal compliance.
- Sector rules matter: SR 11-7 for bank model risk management, GDPR for personal data and automated decisions, and consumer-protection or employment laws.
Worked example
An insurer deploys an AI tool to screen job applicants. Under the EU AI Act this is likely high-risk employment use. The control set should include a risk-management system, data governance, technical documentation, logging, transparency to candidates, human oversight, and accuracy, robustness, and cybersecurity measures. GDPR may also require a legal basis, impact assessment, and candidate information. The governance tool records the assessment, approvals, and monitoring evidence; it does not by itself make the client compliant.
Traps that cost marks
- Assuming the EU AI Act applies only to EU-established companies; extraterritorial scope can catch providers and deployers.
- Treating ISO certification or a completed risk questionnaire as proof of legal compliance.
- Ignoring sector regulators and internal model risk policy while focusing only on one AI regulation.