I85PREP
⌘ K
ISO 42001 Foundation study materials
ISO 42001 Foundation study resources

ISO 42001 Foundation practice questions

One question at a time. Build your ISO 42001 Foundation understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best describes ISO/IEC 42001?

  1. A certifiable management system standard for an organization's AI management system. Correct answer.
  2. A product certification scheme that confirms the safety of individual AI applications before release.
  3. A voluntary code of practice that recommends AI ethics principles to developers and vendors.
  4. A technical specification that fixes minimum accuracy thresholds for machine-learning models.

Explanation

ISO/IEC 42001 is a certifiable management system standard: it specifies requirements for establishing, implementing, maintaining and continually improving an AI management system, using the same harmonized structure as other ISO management system standards. It does not set technical performance thresholds, function as a voluntary ethics code, or certify individual AI products.

Question 2Fundamental principles and concepts of an artificial intelligence management system (AIMS)

ISO/IEC 42001 uses the harmonized structure shared by other ISO management system standards. What is the main benefit of this for an organization that already operates an ISO/IEC 27001 information security management system?

  1. It allows AIMS processes to be integrated with existing management system processes. Correct answer.
  2. It allows AI controls to replace existing information security controls.
  3. It guarantees certification of the AIMS without a Stage 1 audit.
  4. It exempts the organization from repeating any AI risk assessment activity.

Explanation

The harmonized structure uses common clause numbering and core requirements, so processes such as document control, internal audit, management review and corrective action can be extended to cover the AIMS rather than duplicated. Integration reduces effort but does not remove the need for AI-specific risk assessment, replace security controls, or bypass certification audits.

Question 3Fundamental principles and concepts of an artificial intelligence management system (AIMS)

In the Plan-Do-Check-Act cycle applied in ISO/IEC 42001, which clause area corresponds to 'Check'?

  1. Operation (Clause 8)
  2. Planning (Clause 6)
  3. Leadership and commitment (Clause 5)
  4. Performance evaluation (Clause 9) Correct answer.

Explanation

'Check' is represented by Clause 9, performance evaluation, which covers monitoring, measurement, analysis, internal audit and management review. Planning belongs to 'Plan', while operation belongs to 'Do' and improvement to 'Act'.

Question 4Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which description best matches the concept of an AI system as used in ISO/IEC 42001?

  1. A system that infers from its inputs how to produce outputs that affect its environment. Correct answer.
  2. A hardware device that executes deterministic calculations without any learning, adaptation or inference.
  3. Any software application that stores, retrieves and processes records using fixed, pre-programmed business rules and no inference.
  4. A database management system that organizes and stores training data for later human analysis.

Explanation

An AI system is a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. Inference from inputs, rather than fixed rule execution alone, is the defining characteristic.

Question 5Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What is the primary focus of the AI system impact assessment described in Annex A of ISO/IEC 42001?

  1. Identifying and evaluating consequences of an AI system for individuals, groups and society. Correct answer.
  2. Verifying that the AI system's source code contains no security vulnerabilities.
  3. Confirming that the AI system meets its documented accuracy targets in production.
  4. Estimating the financial return that an AI system will generate for the organization.

Explanation

The impact assessment examines how an AI system may affect individuals, groups and wider society, including human rights considerations, and informs decisions about whether and how to proceed. It complements, but is distinct from, the organizational AI risk assessment and from technical testing activities.

Question 6Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What role does the Statement of Applicability play in an ISO/IEC 42001 AIMS?

  1. It records which Annex A controls apply, justifies exclusions and states implementation status. Correct answer.
  2. It lists every AI model the organization has deployed, together with their version numbers.
  3. It provides the technical specification that developers must follow when training models.
  4. It records the minutes of management review meetings and the actions arising from them.

Explanation

The Statement of Applicability is documented information that identifies the Annex A controls the organization considers applicable, gives justification for inclusions and exclusions, and records whether each control is implemented. It provides a traceable link between the risk treatment decisions and the controls actually applied.

Question 7Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization outsources development of a customer-facing AI system to a supplier. How does ISO/IEC 42001 treat accountability for that system?

  1. Accountability transfers entirely to the supplier once the contract is signed.
  2. Accountability is shared equally, so the organization bears no separate responsibility.
  3. The organization retains accountability and must manage the supplier relationship and its risks. Correct answer.
  4. Accountability depends entirely on whether the supplier holds its own ISO/IEC 42001 certificate.

Explanation

Outsourcing work does not outsource accountability: the organization remains answerable for AI systems it provides or uses and must govern third-party relationships through agreements, defined responsibilities and monitoring. A supplier's own certification may provide assurance but does not transfer the organization's accountability.

Question 8Fundamental principles and concepts of an artificial intelligence management system (AIMS)

When defining AI risk criteria, which approach is most consistent with ISO/IEC 42001?

  1. Use only financial loss as the criterion, since other impacts are covered by the impact assessment.
  2. Adopt the risk criteria of the AI supplier, because the supplier owns the model and its behaviour.
  3. Set risk criteria once at certification and keep them unchanged for the whole certification cycle.
  4. Define criteria based on the organization's context and objectives to judge which AI risks are acceptable. Correct answer.

Explanation

The organization establishes risk criteria that reflect its context, its objectives and the nature of its AI systems, and uses them to decide which risks are acceptable and which require treatment. Criteria are reviewed and updated as the context changes, and they may cover impacts beyond financial loss.

Question 9Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What does ISO/IEC 42001 require of top management with respect to the AI policy?

  1. Top management must delegate ownership and maintenance of the AI policy to an external auditor.
  2. Top management must establish the AI policy and align it with the organization's strategic direction. Correct answer.
  3. Top management must personally review and approve every AI model before it is deployed.
  4. Top management must restrict the AI policy to regulators and withhold it from staff.

Explanation

Top management is required to establish, implement and maintain an AI policy that is appropriate to the organization's purpose and provides a framework for setting AI objectives. The policy must be communicated within the organization and made available to relevant interested parties as appropriate.

Question 10Fundamental principles and concepts of an artificial intelligence management system (AIMS)

According to the AI system life cycle guidance in ISO/IEC 42001, which activities belong to the operation and monitoring stage?

  1. Defining business requirements, data requirements and acceptance criteria for the model.
  2. Operating the deployed system, monitoring performance and responding to incidents. Correct answer.
  3. Retiring the system, revoking access and archiving records at the end of life.
  4. Architecting the model, selecting algorithms and preparing the training data.

Explanation

Operation and monitoring covers running the deployed AI system, observing its performance and behaviour, handling incidents and detecting drift or degradation so that corrective action can be taken. Requirements definition, design and development occur earlier, while decommissioning is a later life cycle stage.

Question 11Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization is identifying interested parties for its AIMS. Why does ISO/IEC 42001 require this?

  1. To select the cloud provider for hosting training data
  2. To understand requirements that can affect AI management Correct answer.
  3. To allocate the budget for AI research across departments
  4. To decide which AI models will be sold to customers

Explanation

Clause 4 requires the organization to determine interested parties relevant to the AIMS and the requirements they have that affect AI management. These requirements help shape the management system and its obligations; they are not a substitute for budgeting, product planning, or supplier selection.

Question 12Fundamental principles and concepts of an artificial intelligence management system (AIMS)

The scope of an AIMS must be available as documented information. What must this scope primarily establish?

  1. The boundaries and applicability of the AI management system Correct answer.
  2. The names of employees who completed AI awareness training
  3. Every AI model the organization may develop in future
  4. The complete catalogue of AI laws in every country of operation

Explanation

Clause 4.3 requires the AIMS scope to be documented and to state its boundaries and applicability, taking account of internal and external issues, interested-party requirements, and the AI systems involved. The scope is not an inventory of future models, a legal catalogue, or a training register.

Question 13Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Top management must ensure that responsibilities and authorities for relevant roles are assigned and communicated. Which result best shows this requirement is met?

  1. An external auditor manages all of the AI systems
  2. Every AI decision is escalated to the chief executive
  3. The IT department holds all responsibility for AI outcomes
  4. AI duties are clearly owned and understood Correct answer.

Explanation

Clause 5.3 requires top management to ensure responsibilities and authorities for relevant roles are assigned and communicated within the organization. Clear ownership and understanding of AI duties demonstrates that this requirement is operating, whereas concentrating every decision or all responsibility in one function does not.

Question 14Fundamental principles and concepts of an artificial intelligence management system (AIMS)

ISO/IEC 42001 expects AI risk assessments to be repeated at planned intervals and when significant changes occur. What is the main reason for this?

  1. To replace monitoring and measurement of AI systems
  2. To require annual retraining of every AI model
  3. To keep risk judgements current as context changes Correct answer.
  4. To issue a new Statement of Applicability each time

Explanation

AI risk assessment is iterative: changes in AI systems, data, use, legal requirements, or impacts can alter the level and nature of risk. Repeating the assessment keeps the organization's risk judgements and treatments relevant to current circumstances.

Question 15Fundamental principles and concepts of an artificial intelligence management system (AIMS)

A recruitment AI ranks job applicants. Which question belongs in the AI system impact assessment rather than the organizational AI risk assessment?

  1. What is the expected licensing cost for the next financial year?
  2. Could the ranking reduce opportunities for particular applicant groups? Correct answer.
  3. Which team owns the annual budget for recruitment technology?
  4. How many security incidents occurred on the platform last quarter?

Explanation

An AI system impact assessment examines how the system may affect individuals, groups, societies, or environments, including effects such as unequal access to opportunities. Organizational risk assessment focuses on risks to the organization's objectives, such as cost, security, or ownership.

Question 16Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which action best meets the competence requirement for personnel doing AI-related work under the AIMS?

  1. Recording every AI experiment in a shared spreadsheet
  2. Ensuring people have needed competence through training or experience Correct answer.
  3. Outsourcing AI tasks so internal competence is unnecessary
  4. Requiring all staff to read the AI policy at induction

Explanation

Clause 7.2 requires the organization to determine the competence needed for personnel whose work affects AI performance, ensure those people are competent, and retain appropriate evidence. Reading a policy supports awareness, not competence, and outsourcing does not remove the need to manage supplier competence.

Question 17Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which practice is most consistent with the Annex A controls on data for AI systems?

  1. Deleting provenance records after training is complete
  2. Allowing anyone to modify production training data
  3. Using the largest dataset regardless of its origin
  4. Documenting data quality, provenance and intended fitness Correct answer.

Explanation

Annex A data controls require the organization to manage data acquisition, quality, provenance, preparation, and suitability so that data is appropriate for the AI system's intended purpose. Preserving provenance and controlling changes are essential parts of that control set.

Question 18Fundamental principles and concepts of an artificial intelligence management system (AIMS)

When planning its internal audit programme, what must the organization take into account?

  1. The personal preferences of the AI development team
  2. The number of AI models currently in production
  3. Only audit results from external certification bodies
  4. Process importance, changes and prior audit results Correct answer.

Explanation

Clause 9.2 requires the internal audit programme to consider the importance of the processes concerned, changes affecting the organization, and the results of previous audits. This risk-based focus keeps audit effort directed at what matters most.

Question 19Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An AI incident shows that a required control was not followed. What is the organization expected to do first under the nonconformity requirements?

  1. Revise the AI policy to remove the control
  2. Close the incident without records to avoid scrutiny
  3. Wait until the next management review to decide
  4. Control and correct the nonconformity and address consequences Correct answer.

Explanation

Clause 10.2 requires the organization to react to a nonconformity by controlling and correcting it and dealing with the consequences. It must then evaluate the need for action to eliminate the cause and retain documented information.

Question 20Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best reflects the transparency expectation for AI systems in ISO/IEC 42001?

  1. All source code and training data must be published publicly
  2. Only regulators may receive information about AI operations
  3. A disclaimer in employment contracts achieves transparency
  4. Relevant AI information is provided to interested parties appropriately Correct answer.

Explanation

Transparency in ISO/IEC 42001 is supported by providing relevant information about AI systems to interested parties in a form and level appropriate to their needs and the context. It does not demand full public disclosure of proprietary source code or data, and it is broader than regulatory reporting alone.

Question 21Fundamental principles and concepts of an artificial intelligence management system (AIMS)

ISO/IEC 42001 contains a clause dedicated to continual improvement. What is the main purpose of that clause in an AIMS?

  1. To define the minimum number of AI systems an organization may deploy
  2. To require the organization to enhance the suitability, adequacy and effectiveness of the AIMS Correct answer.
  3. To prescribe a vendor list for AI development tools
  4. To replace the need for internal audits and management review

Explanation

Continual improvement requires the organization to keep enhancing the AIMS so that it remains suitable, adequate and effective. It builds on performance evaluation, audit results and management review rather than replacing those activities. The focus is on improving the management system and its outcomes over time.

Question 22Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What does ISO/IEC 42001 require regarding awareness of people doing work under the organization's control?

  1. They hold an externally issued professional AI ethics certification
  2. They are aware of the AI policy and their contribution to the AIMS Correct answer.
  3. They personally approve all AI risk treatment plans before deployment
  4. They have memorized every Annex A control objective and related procedure

Explanation

The awareness requirement ensures that people whose work affects the AIMS understand the AI policy, how their work contributes to AIMS effectiveness, and the implications of not conforming. Awareness is distinct from competence, which concerns the knowledge and skills needed for particular tasks. The requirement applies to people doing work under the organization's control, including contractors where relevant.

Question 23Fundamental principles and concepts of an artificial intelligence management system (AIMS)

When creating or updating documented information for the AIMS, what must the organization ensure?

  1. It is approved only by the external auditor
  2. It is written only in the organization's head office language
  3. It has suitable identification, format and review approval Correct answer.
  4. It is retained forever regardless of legal requirements

Explanation

Documented information must be controlled so that it is available and suitable for use where needed. This includes appropriate identification, format, review and approval for suitability and adequacy when it is created or updated. Retention and language choices are determined by the organization's needs and applicable requirements, not by a single fixed rule.

Question 24Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An AI risk assessment finds a risk that exceeds the organization's tolerance. What does ISO/IEC 42001 expect the organization to do next?

  1. Remove the AI system from the AIMS scope without further review
  2. Ignore the risk until the next scheduled management review
  3. Record the risk in the register without changing any existing controls
  4. Apply risk treatment options and evaluate residual risk Correct answer.

Explanation

When an assessed AI risk is unacceptable, the organization plans and applies risk treatment options. It then evaluates the residual risk to determine whether it is acceptable and whether further action is needed. The treatment and residual risk decisions should be documented as part of the AIMS risk process.

Question 25Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which item is a required input to management review of the AIMS?

  1. The organization's share price history over the last five years
  2. Results of AI risk assessments and AI system impact assessments Correct answer.
  3. The marketing budget for all AI-related products and services
  4. The personal performance ratings of every AI developer in the organization

Explanation

Management review considers information needed to evaluate AIMS performance and decide on improvements. This includes the results of AI risk assessments and AI system impact assessments, along with other performance and change information. The review is focused on the management system, not on unrelated financial or marketing data.

Question 26Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which practice is consistent with ISO/IEC 42001 when setting AI objectives?

  1. Keep objectives confidential so that delivery teams cannot measure progress
  2. Set objectives only for the legal department and senior executives
  3. Make objectives measurable where practicable and monitor them Correct answer.
  4. Avoid updating objectives after significant changes in AI technology

Explanation

AI objectives should be consistent with the AI policy and be measurable where practicable. The organization monitors progress, communicates relevant objectives, and updates them when circumstances change. Objectives are not limited to one department and should be relevant to functions and levels responsible for the AIMS.

Question 27Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What must an organization do to support objectivity during an internal AIMS audit?

  1. Skip audit evidence collection to save time and reduce costs
  2. Use only auditors who currently work in the AI development team
  3. Let each AI team audit its own processes without independent review
  4. Assign auditors who are independent of the work being audited Correct answer.

Explanation

Internal audit should be conducted objectively and impartially. A key way to support this is to select auditors who do not audit their own work or have a conflict of interest regarding the area being audited. Evidence collection remains essential to determine whether the AIMS conforms to planned arrangements.

Question 28Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which action best meets the AIMS communication requirement in ISO/IEC 42001?

  1. Communicate only after an AI incident has become public knowledge
  2. Restrict every AI communication to the legal department
  3. Leave all communication decisions to each individual employee
  4. Define what, when, how and with whom AI matters are shared Correct answer.

Explanation

The organization must plan internal and external communications relevant to the AIMS. This includes determining what to communicate, when, how, with whom, and who communicates. Communication planning should reflect the organization's context and the needs of interested parties.

Question 29Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization wants to embed AIMS controls into existing software delivery gates. Which interpretation best reflects ISO/IEC 42001's life cycle approach?

  1. Limit controls to the procurement stage and ignore development and operation
  2. Apply controls across relevant life cycle stages, not only at deployment Correct answer.
  3. Add controls only after the AI system has been fully retired and archived
  4. Apply controls only when a regulator makes a formal request for evidence

Explanation

ISO/IEC 42001 takes a life cycle view of AI systems, so relevant AIMS controls should be applied throughout stages such as design, development, deployment, operation and retirement. Integrating controls into delivery gates supports this by making AI management part of normal work. Control activities are not confined to a single stage or to external requests.

Question 30Fundamental principles and concepts of an artificial intelligence management system (AIMS)

After an AI incident reveals a control failure, which statement reflects the relationship between corrective action and continual improvement in ISO/IEC 42001?

  1. Corrective action fixes the nonconformity's cause; continual improvement raises AIMS performance Correct answer.
  2. Corrective action fixes the immediate incident only, while improvement is unrelated to it
  3. Continual improvement fully replaces the need to correct the nonconformity and its cause
  4. Both terms mean exactly the same thing and require no separate activities or records

Explanation

Corrective action deals with a nonconformity by addressing its cause so it does not recur. Continual improvement is broader: it uses lessons and performance information to enhance the overall suitability, adequacy and effectiveness of the AIMS. The two are related but not interchangeable.

Question 31Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which description best captures what an artificial intelligence management system (AIMS) is?

  1. A catalogue of technical standards that prescribes the algorithms an organization may use and the model accuracy it must achieve.
  2. A structured set of elements for establishing AI policy, objectives, and processes to achieve them. Correct answer.
  3. A certification mark awarded to individual AI algorithms after laboratory testing.
  4. A software platform that automatically enforces AI model approvals and audits every deployment.

Explanation

An AIMS is a management system focused on AI: interrelated elements used to establish policy and objectives and the processes needed to achieve those objectives. It is organizational and process-oriented, not a software product, an algorithm certificate, or a prescriptive algorithm catalogue.

Question 32Fundamental principles and concepts of an artificial intelligence management system (AIMS)

ISO/IEC 42001 structures AIMS activities around which continual improvement cycle?

  1. Observe-Orient-Decide-Act
  2. Plan-Do-Check-Act Correct answer.
  3. Verify-Build-Run
  4. Define-Measure-Analyze-Improve-Control

Explanation

ISO/IEC 42001 uses the Plan-Do-Check-Act cycle common to management system standards. Planning establishes objectives and processes, doing implements them, checking monitors results, and acting drives improvement.

Question 33Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which organizations can adopt ISO/IEC 42001 for an AIMS?

  1. Only large enterprises with a dedicated AI research department and an existing quality management system.
  2. Only organizations that develop and train their own machine learning models for commercial sale.
  3. Organizations that provide or use AI systems, regardless of size, type, or sector. Correct answer.
  4. Only organizations that already hold ISO/IEC 27001 certification for information security.

Explanation

ISO/IEC 42001 is applicable to organizations that provide or use AI systems, and it is not limited by size, type, or sector. It can be used by developers, providers, deployers, and users of AI.

Question 34Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What must the AI policy established by top management provide?

  1. A detailed register of every AI model the organization expects to deploy in the next five years.
  2. A guarantee that AI systems will not cause harm to any individual or community.
  3. A framework for setting AI objectives, with commitments to meet applicable requirements and improve continually. Correct answer.
  4. A list naming the employees who must respond to every AI-related incident.

Explanation

The AI policy is a high-level direction-setting document. It must be appropriate to the organization's purpose, provide a framework for setting AI objectives, and include commitments to satisfy applicable requirements and to continual improvement.

Question 35Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What does risk-based thinking mean in an AIMS?

  1. Eliminating every AI project that an employee considers potentially risky before development starts.
  2. Transferring all AI-related risk to an insurance provider or external counsel.
  3. Addressing risks and opportunities so the AIMS can achieve its intended outcomes. Correct answer.
  4. Recording AI risks only after a system has been deployed and an incident has occurred.

Explanation

Risk-based thinking means identifying and addressing risks and opportunities that could affect the AIMS and its intended outcomes. It supports prevention and improvement rather than blanket avoidance of AI work or after-the-fact record keeping.

Question 36Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best distinguishes an AI system impact assessment from an AI risk assessment under ISO/IEC 42001?

  1. It considers effects on individuals, groups, or society, while risk assessment focuses on risks to the organization's objectives. Correct answer.
  2. It focuses only on financial loss to the organization, whereas risk assessment covers legal fines and contractual penalties.
  3. It is optional for every organization, whereas risk assessment is the only analysis the standard requires.
  4. It is performed once at procurement, whereas risk assessment is performed only by the external AI provider.

Explanation

An AI system impact assessment examines potential consequences for individuals, groups, or society. An AI risk assessment addresses risks to the organization's objectives and the AIMS, so the two analyses serve different but complementary purposes.

Question 37Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What does applying the process approach in an AIMS involve?

  1. Assigning all AI-related processes to an external auditor for day-to-day control.
  2. Managing AI activities as interrelated processes with understood inputs, outputs, and interactions. Correct answer.
  3. Replacing AI policies with software workflows that route approvals automatically.
  4. Documenting every AI activity as a separate procedure with its own owner and approval signature.

Explanation

The process approach means understanding AI-related activities as interrelated processes and managing their inputs, outputs, and interactions to achieve intended results. It does not require every activity to become a separate procedure or transfer control to an auditor.

Question 38Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization already operates an ISO/IEC 27001 information security management system. How should it treat its AIMS under ISO/IEC 42001?

  1. The AIMS can only be integrated after the existing ISO/IEC 27001 certification is withdrawn.
  2. It may integrate the AIMS with existing management system elements while addressing AI-specific requirements. Correct answer.
  3. The AIMS must remain completely separate, with no shared governance, documentation, or audit processes.
  4. ISO/IEC 42001 forbids using any elements from an existing management system.

Explanation

ISO/IEC 42001 is designed to be compatible with other management system standards. An organization may integrate common elements such as governance, documented information, and audit while still addressing the AI-specific requirements and controls.

Question 39Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best describes the role of Annex A in ISO/IEC 42001?

  1. Reference control objectives and controls that the organization tailors based on its risk assessment. Correct answer.
  2. A set of controls that applies only to AI developers and never to AI users.
  3. A replacement for the AI policy and AI risk assessment processes.
  4. A mandatory checklist in which every listed control must be implemented in exactly the same way by all organizations.

Explanation

Annex A provides reference control objectives and controls for AI-related risks. Organizations determine applicability and tailor the controls to their context rather than implementing them identically or using them to replace core AIMS processes.

Question 40Fundamental principles and concepts of an artificial intelligence management system (AIMS)

A bank uses a third-party AI service for credit scoring. Which expectation best reflects ISO/IEC 42001?

  1. Because the service is external, the bank may exclude it from the AIMS scope without further analysis.
  2. The bank must build its own foundation model before it can use any third-party AI service.
  3. The provider's ISO/IEC 42001 certificate transfers all AIMS responsibility to the provider.
  4. The bank remains responsible for its AIMS and must determine controls over the externally provided AI service. Correct answer.

Explanation

Outsourcing an AI capability does not outsource the organization's responsibility for its AIMS. The organization must determine how externally provided processes, products, or services are controlled and how they fit within its own risk and impact assessments.

Question 41Fundamental principles and concepts of an artificial intelligence management system (AIMS)

When establishing the context of its artificial intelligence management system (AIMS), what is the organization required to determine?

  1. The exact number of AI models to be deployed next year.
  2. The market share of each competitor offering AI products.
  3. External and internal issues relevant to the AIMS's intended outcomes. Correct answer.
  4. The personal preferences of the largest customer.

Explanation

Clause 4.1 requires the organization to determine external and internal issues that are relevant to its purpose and strategic direction and that affect its ability to achieve the intended outcomes of the AIMS. These issues can include legal, regulatory, ethical, social, technological, and organizational factors. Operational details such as model counts or competitor market share are not the focus of this requirement.

Question 42Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What must the organization determine when defining the scope of its AIMS?

  1. The salaries of employees working on AI projects.
  2. The advertising budget for AI-related products.
  3. The boundaries and applicability of the AIMS. Correct answer.
  4. A list of every AI algorithm ever evaluated by the organization.

Explanation

Clause 4.3 requires the organization to determine the boundaries and applicability of the AIMS to establish its scope. The scope must consider the external and internal issues, the requirements of relevant interested parties, and the interfaces and functions of the organization. It is not a list of algorithms, salaries, or advertising budgets.

Question 43Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Clause 4.2 requires the organization to determine which interested parties are relevant to the AIMS and what else?

  1. The number of employees in each department.
  2. Their share price and quarterly earnings.
  3. The relevant requirements of those interested parties. Correct answer.
  4. Their preferred communication platform.

Explanation

Clause 4.2 requires the organization to determine the interested parties that are relevant to the AIMS and the requirements of those interested parties. This helps the organization understand obligations and expectations that affect the AIMS. Financial or communication preferences are not the focus of this clause.

Question 44Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which action demonstrates top management's leadership and commitment to the AIMS?

  1. Requiring the AI team to work overtime during audits.
  2. Integrating AIMS requirements into business processes. Correct answer.
  3. Approving the purchase of the most expensive AI tool available.
  4. Delegating all AI decisions to the IT service desk.

Explanation

Top management must demonstrate leadership and commitment by ensuring the AI policy and objectives are compatible with strategic direction and by integrating AIMS requirements into the organization's business processes. Delegating all decisions or approving expensive tools does not by itself demonstrate this commitment. Leadership also includes providing resources, communicating, and promoting improvement.

Question 45Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What must top management ensure when assigning roles and responsibilities in the AIMS?

  1. Assigning and communicating responsibilities and authorities. Correct answer.
  2. Having every AI decision made by the most senior manager.
  3. Using identical job titles across all departments.
  4. Giving AI-related authority only to external consultants.

Explanation

Clause 5.3 requires top management to ensure that responsibilities and authorities for relevant roles are assigned and communicated within the organization. This supports accountability and effective operation of the AIMS. It does not require identical job titles or that only external consultants hold authority.

Question 46Fundamental principles and concepts of an artificial intelligence management system (AIMS)

When performing AI risk assessments, what must the organization establish?

  1. The exact cost of every possible AI failure.
  2. A fixed list of risks that will never be updated.
  3. The names of all employees who will be audited.
  4. Risk criteria, including risk acceptance criteria. Correct answer.

Explanation

Clause 6.1.2 requires the organization to define and apply an AI risk assessment process that establishes risk criteria, including risk acceptance criteria. These criteria guide identification, analysis, and evaluation of risks. A fixed list of risks or exact failure costs is not what the clause requires.

Question 47Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which documented information is required as an output of AI risk treatment planning?

  1. A data backup schedule together with a network diagram.
  2. AI risk treatment plan and statement of applicability. Correct answer.
  3. A training calendar together with a staff satisfaction survey.
  4. An AI incident log together with a customer complaint register.

Explanation

AI risk treatment planning requires documented information showing the selected treatment options, the controls judged necessary, and the reasons for including or excluding Annex A controls. This is typically captured in an AI risk treatment plan and a statement of applicability. Incident logs, backup schedules, and training calendars do not fulfil this output requirement.

Question 48Fundamental principles and concepts of an artificial intelligence management system (AIMS)

In an AI system impact assessment, what should be considered alongside the intended use of the system?

  1. The programming language used to build the system.
  2. Reasonably foreseeable misuse and its consequences. Correct answer.
  3. The marketing budget for the system.
  4. The number of servers hosting the system.

Explanation

An AI system impact assessment considers the potential impacts of the system on individuals, groups, and society. It should examine intended use together with reasonably foreseeable misuse and the consequences that may follow. Technical implementation details alone do not capture these impacts.

Question 49Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What must the organization do to plan and control the processes needed to meet AIMS requirements?

  1. Rely only on vendor certifications for process control.
  2. Approve every AI output personally before release.
  3. Let each team choose any process without documentation.
  4. Establish process criteria, apply control, and keep documented information. Correct answer.

Explanation

Clause 8.1 requires the organization to plan and control processes needed to meet AIMS requirements. This includes establishing criteria for the processes, implementing control in line with those criteria, and maintaining documented information to show the processes are carried out as planned. It also includes controlling planned changes and outsourced processes.

Question 50Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What must the organization determine when monitoring and measuring AIMS performance?

  1. Only the number of AI models deployed.
  2. What to monitor, methods, timing, responsibility, and analysis. Correct answer.
  3. Only the financial cost of AI tools.
  4. The social media followers of the AI team.

Explanation

Clause 9.1 requires the organization to determine what needs to be monitored and measured, the methods for monitoring and measurement, when monitoring and measurement will be performed, who is responsible, and when results will be analyzed and evaluated. Monitoring only model counts or costs is too narrow. The organization must also retain appropriate documented information as evidence.