I85PREP
⌘ K
ISO 42001 Lead Implementer study materials
ISO 42001 Lead Implementer study resources

ISO 42001 Lead Implementer practice questions

One question at a time. Build your ISO 42001 Lead Implementer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of an artificial intelligence management system (AIMS)

In ISO/IEC 42001, what is the primary purpose of establishing an artificial intelligence management system (AIMS) within an organization?

  1. To replace the organization's existing information security controls with AI-specific technical safeguards
  2. To certify the accuracy and performance benchmarks of individual AI models before deployment
  3. To provide a structured framework of policies, objectives, and processes for governing responsible AI use Correct answer.
  4. To document the source code and training datasets of every AI system in a public register

Explanation

An AIMS is a management-system framework, so it establishes policies, objectives, roles, and processes that govern how the organization develops and uses AI responsibly. It is not a model-benchmarking scheme, a technical control set replacing information security, nor a public disclosure register.

Question 2Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which characteristic distinguishes a management-system approach (such as an AIMS) from a one-off AI ethics project?

  1. It relies exclusively on external auditors to define objectives
  2. It uses continuing Plan-Do-Check-Act cycles to maintain and improve performance over time Correct answer.
  3. It requires a fixed set of controls that never changes after initial certification
  4. It applies only to the research and development phase of AI

Explanation

Management systems are built on iterative improvement cycles, so the AIMS is reviewed, adjusted, and improved continuously rather than being a one-time deliverable. This continuing cycle is what sustains governance as AI systems and contexts evolve.

Question 3Fundamental principles and concepts of an artificial intelligence management system (AIMS)

According to the foundational concepts of an AIMS, which element most directly establishes top-level commitment and direction for AI governance?

  1. The AI policy statement issued and supported by top management Correct answer.
  2. The technical architecture diagram of the AI model pipeline
  3. The list of third-party AI vendors approved for procurement
  4. The inventory of AI incident tickets maintained by the service desk

Explanation

The AI policy is the governing statement through which top management sets direction, commitments, and principles for AI across the organization. Supporting artifacts such as incident logs, architecture diagrams, and vendor lists operationalize that direction but do not establish it.

Question 4Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which concept best describes the relationship between an AIMS and the organization's other management systems, such as quality or information security management?

  1. The AIMS is designed to integrate with existing management systems using common high-level structure Correct answer.
  2. The AIMS must operate in complete isolation to avoid conflicts of interest
  3. The AIMS automatically supersedes all other management systems once adopted
  4. The AIMS can only be implemented after all other management systems are discontinued

Explanation

ISO management system standards share a common high-level structure, enabling an AIMS to be integrated with quality, information security, and other systems. Integration reduces duplication and aligns governance across the organization.

Question 5Fundamental principles and concepts of an artificial intelligence management system (AIMS)

In the context of an AIMS, what does the term 'interested party' refer to?

  1. Any vendor that supplies cloud computing infrastructure to the organization
  2. Only the internal software engineers who build AI models
  3. Only government regulators with statutory authority over AI
  4. Any person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity Correct answer.

Explanation

Interested parties are broadly defined as persons or organizations that can affect, be affected by, or perceive themselves to be affected by a decision or activity. This includes customers, employees, regulators, affected communities, and suppliers, not a single narrow group.

Question 6Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best captures the concept of 'AI system' as used in the foundational concepts of an AIMS?

  1. A physical robot that operates without any software component
  2. A machine-based system that infers from input to generate outputs such as predictions, content, or decisions Correct answer.
  3. Only systems that use deep neural networks with more than one billion parameters
  4. Any spreadsheet used for business calculations, regardless of automation

Explanation

An AI system is understood as a machine-based system that, for explicit or implicit objectives, infers from inputs how to generate outputs such as predictions, content, recommendations, or decisions. The concept is technology-agnostic and not limited to a particular model architecture.

Question 7Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Why does an AIMS emphasize a lifecycle perspective rather than focusing only on AI model development?

  1. Because lifecycle thinking is required only for hardware products
  2. Because risks and impacts can arise at any stage, from data acquisition through operation and decommissioning Correct answer.
  3. Because models become permanently safe once they pass initial testing
  4. Because lifecycle documentation is only needed for regulatory audits

Explanation

AI-related risks and impacts can emerge at any lifecycle stage, including data collection, design, training, deployment, monitoring, and retirement. A lifecycle perspective ensures governance covers those stages rather than only model development.

Question 8Fundamental principles and concepts of an artificial intelligence management system (AIMS)

What role does 'context of the organization' play in establishing an AIMS?

  1. It determines the exact number of AI controls that must be implemented
  2. It specifies the programming languages permitted for AI development
  3. It sets the maximum budget allowed for AI projects
  4. It defines the external and internal issues relevant to the organization's purpose and affects how the AIMS is designed Correct answer.

Explanation

Understanding the organization's context means identifying external and internal issues, such as legal, social, technological, and organizational factors, that influence the AIMS. This understanding shapes the scope, objectives, and risk approach of the management system.

Question 9Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization is defining the scope of its AIMS. Which approach best reflects the foundational concepts of scoping an AI management system?

  1. Scope it to the AI systems, processes, and locations the organization determines are relevant, documenting the justification Correct answer.
  2. Scope it only to the marketing department because it communicates about AI
  3. Scope it to every AI activity globally, regardless of where the organization operates
  4. Scope it to nothing until a regulator formally requests an AIMS

Explanation

The scope of an AIMS is determined by the organization based on its context, activities, and the AI systems it governs, and the boundaries and applicability must be documented. A defensible scope reflects what the organization can actually govern.

Question 10Fundamental principles and concepts of an artificial intelligence management system (AIMS)

A company introduces a generative AI assistant for customer service. Which action best reflects the principle of accountability within an AIMS?

  1. Removing documentation to speed up deployment
  2. Assigning named roles and responsibilities for the AI system's oversight and decisions Correct answer.
  3. Outsourcing all responsibility for the assistant to the model vendor
  4. Letting each employee decide independently how to use the assistant

Explanation

Accountability in an AIMS requires clear assignment of roles, responsibilities, and authorities for AI-related activities and decisions. This ensures that oversight and answerability are defined rather than diffuse.

Question 11Fundamental principles and concepts of an artificial intelligence management system (AIMS)

How does the principle of transparency apply within an AIMS?

  1. Disclosing only aggregate financial results related to AI
  2. Hiding all information about AI systems to protect trade secrets
  3. Publishing all internal source code and training data to the public internet
  4. Making appropriate information about AI systems available to relevant interested parties so decisions and outputs can be understood Correct answer.

Explanation

Transparency in an AIMS means providing relevant, appropriate information about AI systems to interested parties so that their behavior, limitations, and impacts can be understood. It is proportionate disclosure, not unlimited public release or total concealment.

Question 12Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An AI team wants to add a new facial analysis feature. Which AIMS activity most directly ensures that potential harms to affected individuals are identified before deployment?

  1. Updating the organization's marketing brochure
  2. Conducting an AI risk assessment that considers impacts on individuals and society Correct answer.
  3. Increasing the model's parameter count to improve accuracy
  4. Scheduling a press release announcing the feature

Explanation

AI risk assessment examines potential harms and impacts on individuals, groups, and society, informing decisions before deployment. It connects the management system to the actual consequences of AI use.

Question 13Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best reflects the concept of 'AI system impact' as distinguished from technical performance?

  1. Impact refers exclusively to the financial return on AI investment
  2. Impact refers only to the model's inference latency in milliseconds
  3. Impact refers only to the number of lines of code in the system
  4. Impact refers to the effects of an AI system on individuals, groups, society, and the environment Correct answer.

Explanation

In AIMS concepts, impact concerns the consequences of an AI system for people, groups, society, and the environment, going beyond technical metrics. This broader view is why impact assessment complements technical testing.

Question 14Fundamental principles and concepts of an artificial intelligence management system (AIMS)

A hospital deploys an AI triage tool. Which action best demonstrates the AIMS principle of human oversight?

  1. Removing clinicians from the loop to improve processing speed
  2. Disabling logging of clinician decisions to protect privacy
  3. Allowing the model to make final treatment decisions without review
  4. Requiring qualified staff to review and, where necessary, override AI recommendations Correct answer.

Explanation

Human oversight means that competent people can monitor, review, and intervene in AI-supported decisions, particularly in high-stakes contexts. This preserves meaningful human control over consequential outcomes.

Question 15Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which of the following best describes the concept of 'AI-related risk' in an AIMS?

  1. Only the risk that competitors copy the AI model
  2. The effect of uncertainty on objectives arising from AI systems, including potential harms and missed opportunities Correct answer.
  3. Only the risk of a hardware server failure
  4. Only the risk that a model produces a mathematically incorrect output

Explanation

AI-related risk is the effect of uncertainty on objectives associated with AI, encompassing potential harms as well as missed opportunities. It is broader than a single technical or competitive concern.

Question 16Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization is mapping its AI systems. Which practice best supports the AIMS concept of an AI system inventory?

  1. Recording each AI system with its purpose, owner, lifecycle stage, and dependencies Correct answer.
  2. Recording systems only after an incident has occurred
  3. Maintaining the inventory informally in individual email threads
  4. Listing only systems purchased from external vendors

Explanation

An AI system inventory supports identification, ownership, and lifecycle management by recording purpose, accountable owner, stage, and dependencies. This provides the visibility needed for governance and risk assessment.

Question 17Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best reflects the role of leadership in the foundational concepts of an AIMS?

  1. Leadership establishes the AI policy, ensures resources, and integrates AIMS requirements into business processes Correct answer.
  2. Leadership focuses only on short-term financial targets
  3. Leadership delegates all AI governance to external consultants
  4. Leadership avoids communicating about AI to staff

Explanation

Leadership in an AIMS sets policy, provides resources, assigns responsibilities, and ensures AI governance is integrated into the organization's processes. Visible commitment is a foundational enabler of the management system.

Question 18Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization wants to ensure its AIMS objectives are meaningful. Which characteristic best aligns with the concept of measurable AI objectives?

  1. Objectives that are set once and never reviewed
  2. Objectives that are specific, measurable, monitored, and consistent with the AI policy Correct answer.
  3. Objectives that apply only to the IT department
  4. Objectives that are vague and cannot be evaluated

Explanation

AIMS objectives should be specific, measurable, monitored, communicated, and aligned with the AI policy. This enables the organization to evaluate progress and adjust its approach through the improvement cycle.

Question 19Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best describes the concept of 'continual improvement' in an AIMS?

  1. Replacing the AIMS every year with an entirely new framework
  2. Ongoing enhancement of AIMS performance through monitoring, evaluation, and corrective action Correct answer.
  3. Freezing all processes once initial certification is achieved
  4. Waiting for a regulator to mandate changes before acting

Explanation

Continual improvement is the recurring process of monitoring performance, evaluating results, and taking corrective action to enhance the AIMS. It is embedded in the management system cycle rather than triggered only by external mandates.

Question 20Fundamental principles and concepts of an artificial intelligence management system (AIMS)

A team is deciding whether a particular AI use case falls within the scope of the AIMS. Which consideration most directly supports a defensible decision?

  1. Whether the use case is popular on social media
  2. Whether the use case involves an AI system that the organization develops, provides, or uses within its defined scope Correct answer.
  3. Whether the use case was proposed by a senior manager
  4. Whether the use case uses a specific vendor's cloud platform

Explanation

Scope decisions should be based on whether an AI system is developed, provided, or used within the boundaries the organization has defined. This ties the decision to documented scope criteria rather than popularity or hierarchy.

Question 21Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best explains why an AIMS addresses both AI developers and AI users within an organization?

  1. Developers are exempt from AIMS requirements
  2. Only developers create AI risks, so users need no governance
  3. Risks and impacts arise from how AI is used and operated as well as how it is built, so both groups must be governed Correct answer.
  4. Users are always external to the organization

Explanation

An AIMS governs the full range of AI activities, including development, provision, and use, because risks and impacts can arise from how systems are operated and applied. Governing only developers would leave significant risks unaddressed.

Question 22Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization uses a third-party foundation model as a component of its own AI service. How does the AIMS concept of control over AI systems apply to this situation?

  1. The organization can ignore the vendor's limitations and documentation
  2. The organization remains responsible for how the AI service it provides affects interested parties and must govern the third-party dependency Correct answer.
  3. The organization has no AIMS responsibilities because it did not train the model
  4. The organization must take over the vendor's internal development processes

Explanation

Using a third-party model does not transfer the organization's accountability for the AI service it offers. The AIMS addresses supplier relationships and dependencies so that externally sourced components are governed within the organization's own controls.

Question 23Fundamental principles and concepts of an artificial intelligence management system (AIMS)

A risk assessment identifies that an AI recruitment tool may produce biased outcomes. Which response best reflects the AIMS principle of risk treatment?

  1. Deleting the assessment record to avoid reputational exposure
  2. Deploying the tool faster to gather more data before deciding
  3. Ignoring the finding because the model's overall accuracy is high
  4. Selecting and implementing treatment options, such as bias testing, human review, or use restrictions, and monitoring their effectiveness Correct answer.

Explanation

Risk treatment involves choosing and applying measures to address identified risks and then monitoring whether they are effective. This links risk assessment to concrete, tracked actions within the management system.

Question 24Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Two business units propose AI use cases with different impact levels. How should the AIMS principle of risk-based proportionality guide the response?

  1. Apply identical controls to both regardless of impact
  2. Apply no controls to either until an incident occurs
  3. Apply controls only to the use case with the lower impact
  4. Apply controls proportionate to the assessed risk and impact, with more rigorous measures for higher-impact uses Correct answer.

Explanation

A risk-based approach tailors the rigor of controls to the assessed level of risk and impact, so higher-impact AI uses receive more stringent governance. This proportionality makes the management system both effective and efficient.

Question 25Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization discovers that an AI system's behavior has drifted after deployment, affecting its outputs. Which AIMS concept most directly addresses this situation?

  1. One-time validation performed before go-live
  2. Annual financial auditing of the AI budget
  3. Recruitment of additional data scientists
  4. Continual monitoring and evaluation of AI system performance after deployment Correct answer.

Explanation

Post-deployment monitoring and evaluation detect changes in AI system behavior and performance so that corrective action can be taken. This reflects the lifecycle and improvement principles of the AIMS.

Question 26Fundamental principles and concepts of an artificial intelligence management system (AIMS)

In the foundational concepts of an AIMS, what distinguishes an 'AI system' from conventional software in a way that matters for management system controls?

  1. It is limited to numerical outputs and cannot generate text, images, or recommendations.
  2. It produces outputs such as predictions or decisions that are inferred from data rather than fully specified in advance by explicit rules. Correct answer.
  3. It must be certified by an external regulator before it can be placed into production use.
  4. It always requires a cloud infrastructure subscription and a dedicated data science team to operate.

Explanation

An AI system is characterized by inference: it derives outputs such as predictions, content, or recommendations from inputs using models rather than only executing explicitly coded logic. This inference-based, partly nondeterministic behaviour is why an AIMS needs controls for data, model development, monitoring, and human oversight. The other statements describe deployment choices or fictional mandatory certification, not defining characteristics.

Question 27Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization is establishing an AIMS and must decide what the management system will cover. Which action best reflects the foundational concept of determining AIMS scope?

  1. Adopting the broadest possible scope so that no AI-related activity anywhere in the world is ever excluded.
  2. Documenting the organizational units, functions, AI systems, and lifecycle stages to be governed, together with interfaces to excluded activities. Correct answer.
  3. Listing every AI technology the organization might evaluate in the next five years, including research not yet approved.
  4. Delegating the scope decision to the data science team because they understand the models best.

Explanation

Scope in a management system defines the boundaries of what is governed, so it must identify the units, AI systems, lifecycle stages, and interfaces involved. It should be documented and justified rather than aspirational or infinitely broad. Scope decisions belong to top management with appropriate input, not solely to technical staff.

Question 28Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Which statement best captures why an AIMS is built on a plan-do-check-act style continual improvement cycle?

  1. It replaces the need for risk assessment because improvement activities are continuous.
  2. It allows an organization to freeze its AI governance documentation after the first certification audit.
  3. It guarantees that no AI system will ever fail once it has passed an initial assessment.
  4. It ensures that AI policies, controls, and objectives are repeatedly reviewed and adjusted as systems, data, and risks change. Correct answer.

Explanation

Continual improvement in an AIMS means governance is iterative: objectives are set, controls implemented, performance checked, and changes made as AI systems, data, and risk landscapes evolve. It does not promise failure-free systems, nor does it remove the need for risk assessment or freeze documentation.

Question 29Fundamental principles and concepts of an artificial intelligence management system (AIMS)

A model risk committee is classifying AI systems by potential impact. Which practice best reflects risk-based proportionality in an AIMS?

  1. Assigning the strictest controls only to systems with the largest compute budgets.
  2. Applying identical controls to every AI system so that the approach is demonstrably consistent.
  3. Applying more stringent controls, documentation, and oversight to AI systems with higher potential for harm. Correct answer.
  4. Deferring all classification until after deployment so real-world evidence is available.

Explanation

Risk-based proportionality means the intensity of controls and oversight is matched to the level of potential impact or risk. Higher-impact AI systems therefore receive more rigorous treatment than low-impact ones. Uniform controls ignore differing risk, and compute budget is not a measure of impact.

Question 30Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization relies on a third-party foundation model inside its own customer-facing assistant. How does the AIMS concept of control over externally provided processes apply here?

  1. Responsibility transfers entirely to the foundation model provider once a commercial contract is signed.
  2. External components are outside any AIMS scope because they are not developed internally.
  3. The organization remains responsible for the AI system it delivers and must govern the external component through defined requirements, evaluation, and monitoring. Correct answer.
  4. The organization only needs to record the provider's name in the AI system inventory.

Explanation

Under an AIMS, an organization is accountable for the AI systems it puts into use, including externally provided components. It must therefore specify requirements, evaluate the supplier's component, and monitor performance in its own context. Contracting does not transfer the organization's accountability for the delivered system.

Question 31Fundamental principles and concepts of an artificial intelligence management system (AIMS)

During an impact assessment, a team argues that an AI system's high accuracy means no further analysis is needed. Which response best reflects the AIMS concept of AI system impact?

  1. Accuracy is one input, but impact also considers effects on individuals, groups, and society, including potential harms and affected stakeholders. Correct answer.
  2. Accuracy is the decisive criterion because a sufficiently accurate system cannot cause harm.
  3. Impact assessment should be postponed until the system has been in operation for at least a year.
  4. Impact is determined solely by the number of users of the system.

Explanation

AI system impact extends beyond technical performance to the consequences for individuals, groups, and society, including potential harms to affected stakeholders. High accuracy can coexist with discriminatory, privacy, or autonomy harms. Impact assessment is therefore broader than a performance metric and should precede deployment.

Question 32Fundamental principles and concepts of an artificial intelligence management system (AIMS)

A team wants to add a sentiment-scoring feature that infers employees' emotional states from workplace messages. Which AIMS activity most directly addresses the ethical concerns before approval?

  1. Adding the feature to the AI system inventory after go-live.
  2. Benchmarking the model's F1 score against public sentiment datasets.
  3. Requesting a discount from the model vendor to reduce project cost.
  4. Conducting an impact assessment that identifies affected stakeholders and evaluates potential harms and mitigations. Correct answer.

Explanation

Ethical concerns about inferring employee emotions are addressed through an impact assessment that identifies affected stakeholders and evaluates potential harms and mitigations. Performance benchmarking alone does not examine ethical consequences. Inventory registration and procurement are administrative and do not substitute for impact analysis.

Question 33Fundamental principles and concepts of an artificial intelligence management system (AIMS)

Senior management asks how the AIMS principle of accountability should be operationalized across an AI lifecycle. Which arrangement best reflects that principle?

  1. Collective responsibility in which no individual is named, so the whole organization shares ownership.
  2. Accountability assigned only to the external vendor that supplied the model.
  3. Accountability documented once at project kickoff and not revisited afterwards.
  4. Named roles with defined decision rights at each lifecycle stage, and evidence that decisions were reviewed and approved by the responsible party. Correct answer.

Explanation

Accountability in an AIMS requires identifiable roles with clear decision rights and records showing that the responsible party reviewed and approved key decisions. Diffuse collective ownership without named roles cannot be evidenced or enforced. Accountability also persists across the lifecycle and cannot be outsourced to a vendor.

Question 34Fundamental principles and concepts of an artificial intelligence management system (AIMS)

An organization states that its AIMS will 'support trustworthy AI'. Which revision best turns this aspiration into an AIMS objective consistent with foundational concepts?

  1. Establish a working group to discuss AI ethics whenever concerns arise.
  2. Ensure that all staff complete AI awareness training at some point in the future.
  3. Reduce the rate of unreviewed high-impact AI decisions to below a stated threshold by a defined date, with an assigned owner and measurement method. Correct answer.
  4. Commit to using the most advanced AI models available in every business unit.

Explanation

A meaningful AIMS objective is specific, measurable, time-bound, assigned to an owner, and linked to a defined measurement method. The revised statement meets these characteristics and can be monitored. The alternatives are aspirational, unbounded, or lack measurable criteria.

Question 35Artificial intelligence management system requirements

According to ISO/IEC 42001, which document type establishes the organization's intentions and direction for its AI management system and is formally approved by top management?

  1. The statement of applicability
  2. The AI risk register
  3. The AI system impact assessment
  4. The AI policy Correct answer.

Explanation

The AI management system policy expresses top management's intentions and direction for AI within the organization and must be documented, communicated, and reviewed for continuing suitability. It provides the framework against which objectives and controls are set.

Question 36Artificial intelligence management system requirements

When defining the scope of an AI management system, what must the organization determine and document?

  1. The boundaries and applicability of the AIMS, including external and internal issues relevant to its purpose Correct answer.
  2. The complete source code of every AI model under development
  3. A list of every software vendor the organization has ever used
  4. The names of all employees who have completed AI awareness training

Explanation

Scope determination requires the organization to define the boundaries and applicability of the management system, considering external and internal issues, interested parties, and the nature of its AI-related activities. The scope statement is documented information that anchors later risk and control decisions.

Question 37Artificial intelligence management system requirements

ISO/IEC 42001 requires leadership to establish an AI policy. Which element is a required characteristic of that policy?

  1. A guarantee that no AI system will ever cause harm to any interested party
  2. A commitment to satisfy applicable requirements and to continual improvement of the AI management system Correct answer.
  3. A detailed technical specification of each model's hyperparameters
  4. A fixed schedule of disciplinary measures for staff who misuse AI

Explanation

The AI policy must include commitments to satisfy applicable requirements and to continual improvement, alongside a framework for setting AI objectives. Absolute guarantees of no harm are impossible and are not required.

Question 38Artificial intelligence management system requirements

Which set of items must an organization determine as part of planning actions to address AI risks and opportunities?

  1. Only the marketing benefits expected from AI products
  2. The risks and opportunities related to its AI context, and the controls needed to address them Correct answer.
  3. Only the financial cost of each AI project
  4. Only the legal jurisdictions where AI outputs are published

Explanation

Planning requires identifying risks and opportunities arising from the organization's context and AI activities, then determining controls and evaluating their effectiveness. This mirrors the risk-based planning clause structure common to management system standards.

Question 39Artificial intelligence management system requirements

What is the primary purpose of an AI system impact assessment within the AIMS?

  1. To calculate the return on investment of the AI system for the finance function
  2. To analyze how an AI system may affect individuals, groups, and society and identify mitigation measures Correct answer.
  3. To determine which cloud region hosts the production model
  4. To confirm that the AI system's source code meets internal style guidelines

Explanation

An AI system impact assessment evaluates potential consequences of an AI system for individuals, groups, and wider society, including foreseeable misuse, and identifies measures to address them. It complements risk assessment by focusing on impacts beyond the organization itself.

Question 40Artificial intelligence management system requirements

Which activity demonstrates that top management is fulfilling its leadership role for the AI management system?

  1. Approving AI deployments solely on the basis of vendor marketing material
  2. Delegating all AI governance decisions permanently to an external consultant
  3. Restricting AI awareness training to the legal department
  4. Integrating AIMS requirements into the organization's business processes and ensuring resources are available Correct answer.

Explanation

Leadership requires top management to integrate AIMS requirements into business processes, ensure resources, communicate the importance of the AIMS, and promote improvement. Active integration and resourcing show genuine ownership rather than nominal endorsement.

Question 41Artificial intelligence management system requirements

Which of the following is documented information that the AIMS requires to be retained as evidence of competence?

  1. The minutes of every customer sales meeting
  2. Records of education, training, skills, and experience of persons doing AI-related work Correct answer.
  3. The floor plan of the data center hosting the models
  4. The version history of the corporate website theme

Explanation

Competence requirements call for determining necessary competence, ensuring persons are competent, and retaining documented evidence such as education, training, skills, and experience records. This evidence supports auditor verification of capability.

Question 42Artificial intelligence management system requirements

An organization wants to demonstrate conformity of its AIMS. Which activity provides assurance that the management system conforms to ISO/IEC 42001 and is effectively implemented?

  1. Publishing a press release announcing AI leadership
  2. Purchasing additional graphics processing units
  3. Renaming the AI team to a governance council
  4. Conducting internal audits and management reviews at planned intervals Correct answer.

Explanation

Internal audit evaluates conformity and effectiveness of the AIMS, and management review ensures continuing suitability, adequacy, and alignment with strategy. Together they form the evaluation and improvement feedback loop.

Question 43Artificial intelligence management system requirements

An organization has defined its AIMS scope to cover an AI-based recruitment screening tool. During risk planning, the team identifies that the model may produce biased rankings for certain demographic groups. Which action best reflects ISO/IEC 42001 risk treatment?

  1. Increase the marketing budget to improve the tool's public image
  2. Disable all logging to avoid collecting evidence of biased outcomes
  3. Record the bias concern in the risk register and take no further action because the model is proprietary
  4. Select and implement controls such as bias testing, human oversight, and dataset review, then evaluate residual risk Correct answer.

Explanation

Risk treatment requires selecting controls, planning their implementation, and evaluating whether residual risk is acceptable. For bias in recruitment, appropriate controls include testing, oversight, and data review, with results documented.

Question 44Artificial intelligence management system requirements

A hospital deploys an AI triage assistant. The impact assessment shows potential harm to patients if the model errs. How should human oversight be addressed in the AIMS?

  1. Document oversight as optional guidance that clinicians may ignore
  2. Define oversight measures proportionate to the risk, such as clinician review of AI recommendations before action Correct answer.
  3. Assign oversight to a committee that meets once every three years
  4. Rely entirely on the model because automation removes human error

Explanation

ISO/IEC 42001 expects oversight measures to be determined and applied in proportion to risk, ensuring humans can intervene meaningfully. For clinical triage, review of recommendations before action is a typical proportionate control.

Question 45Artificial intelligence management system requirements

During an internal audit, an auditor finds that an AI model was retrained but the change was never reviewed against the AIMS change management process. What is the most appropriate corrective action?

  1. Investigate the root cause, update the change control process and its enforcement, and verify effectiveness Correct answer.
  2. Blame the data science team publicly and close the finding
  3. Delay any action until the next external certification audit
  4. Delete the audit finding because the model performs better after retraining

Explanation

Corrective action requires reacting to the nonconformity, evaluating the need to eliminate root causes, implementing changes to the management system, and reviewing effectiveness. Simply deleting or deferring the finding leaves the weakness in place.

Question 46Artificial intelligence management system requirements

An organization uses a third-party foundation model as a component of its AI service. How should ISO/IEC 42001 address this externally provided component?

  1. Assume the provider's own certifications guarantee the organization's conformity
  2. Exclude the provider from scope because the contract transfers all responsibility
  3. Require the provider to share all internal source code with the public
  4. Determine controls over the externally provided process, product, or service and monitor the provider's performance Correct answer.

Explanation

Externally provided processes, products, and services must be controlled, with criteria for selection, monitoring, and evaluation retained as documented information. Outsourcing does not transfer the organization's accountability for its own AIMS.

Question 47Artificial intelligence management system requirements

Which approach best satisfies ISO/IEC 42001 requirements for continual improvement of the AIMS?

  1. Wait for a serious AI incident before reviewing any AIMS process
  2. Use audit results, monitoring data, and management review outputs to identify and implement improvements Correct answer.
  3. Change the AI policy annually without analyzing performance data
  4. Freeze all AI processes once initial certification is achieved

Explanation

Continual improvement draws on monitoring, audit findings, nonconformities, and management review outputs to enhance the suitability, adequacy, and effectiveness of the AIMS. Improvement must be evidence-driven rather than reactive or cosmetic.

Question 48Artificial intelligence management system requirements

An organization identifies that its AI chatbot may generate harmful content. Which control objective in the AIMS most directly addresses verification that the system behaves as intended before release?

  1. Supplier invoice reconciliation
  2. Employee travel expense approval
  3. Physical access control to the server room
  4. AI system verification and validation activities performed prior to deployment Correct answer.

Explanation

Verification and validation confirm that an AI system meets specified requirements and behaves as intended across relevant conditions, including misuse scenarios, before release. This directly targets residual behavior risks such as harmful generation.

Question 49Artificial intelligence management system requirements

What must management review of the AIMS consider as input regarding the organization's AI risk landscape?

  1. Only the average salary of AI engineers
  2. Changes in external and internal issues relevant to the AIMS, and status of actions from previous reviews Correct answer.
  3. Only the social media follower count of the AI team
  4. Only the number of AI models deployed last quarter

Explanation

Management review inputs include changes in external and internal issues, risk assessment results, performance and effectiveness data, audit results, and status of prior actions. This ensures decisions reflect the current context and risk picture.

Question 50Artificial intelligence management system requirements

An AI team proposes using a new dataset containing personal data scraped from public websites. Which AIMS action best reflects ISO/IEC 42001 data governance expectations?

  1. Assess the data for quality, provenance, and legal and ethical constraints, and document the decision and controls Correct answer.
  2. Anonymize nothing and rely on the model to avoid memorizing personal data
  3. Proceed immediately because public data is always freely usable
  4. Store the dataset indefinitely without any access restrictions

Explanation

Data governance for AI requires evaluating data quality, provenance, and applicable legal and ethical constraints, then documenting decisions and controls. Public availability does not automatically make use lawful or acceptable.