I85PREP
⌘ K
MLARM study materials
MLARM study resources

MLARM practice questions

One question at a time. Build your MLARM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundations of AI/ML and Risk Management

In a machine-learning risk taxonomy, which concern is addressed by model risk management rather than by conventional IT security controls?

  1. Denial-of-service flooding of the inference endpoint
  2. Losses arising from inaccurate or misused model outputs and decisions Correct answer.
  3. Unauthorized network access to the training cluster
  4. Physical theft of backup tapes from a data center

Explanation

Model risk management targets the uncertainty and harm created when a model's outputs, assumptions, or use are wrong, including discriminatory or unstable decisions. Network intrusion, physical media theft, and availability attacks are classic information-security domains handled by access control, encryption, and resilience controls.

Question 2Foundations of AI/ML and Risk Management

An ML system's outputs are used to approve loan applications. Under a model risk framework, which element most directly establishes accountability for the model's ongoing fitness for use?

  1. The size of the training dataset in gigabytes
  2. The programming language used to serve predictions
  3. The choice of a gradient-boosted tree algorithm
  4. The model owner role with defined validation and monitoring duties Correct answer.

Explanation

Model risk frameworks assign explicit ownership so that validation, performance monitoring, and escalation have a named accountable party. Algorithm choice, data volume, and implementation language are technical attributes that do not by themselves create governance accountability.

Question 3Foundations of AI/ML and Risk Management

A team trains a classifier on historical loan decisions and finds it reproduces past discriminatory lending patterns. Which risk category does this illustrate?

  1. Data leakage between training and test splits
  2. Bias and fairness risk embedded in training data Correct answer.
  3. Overfitting caused by excessive model capacity
  4. Concept drift after deployment

Explanation

When a model learns from data that encodes past discriminatory outcomes, it inherits and can amplify that bias, which is a fairness risk. Overfitting, leakage, and drift concern generalization, evaluation validity, and temporal change rather than disparate treatment of groups.

Question 4Foundations of AI/ML and Risk Management

Which practice best supports reproducibility of an ML model as part of model risk documentation?

  1. Recording the model's business purpose in a slide deck
  2. Reporting the accuracy on the training set
  3. Storing only the final trained model weights
  4. Versioning the training data, code, hyperparameters, and environment together Correct answer.

Explanation

Reproducibility requires capturing every input that determines the trained artifact, including data snapshots, code, hyperparameters, and software environment. Storing weights alone or documenting purpose does not let an independent party regenerate or verify the model.

Question 5Foundations of AI/ML and Risk Management

A model performs well on its holdout set but degrades sharply once deployed to production. Which explanation is most consistent with this pattern?

  1. The holdout set was too small to estimate accuracy
  2. The production data distribution differs from the development distribution Correct answer.
  3. The evaluation metric was misconfigured
  4. The model was trained with too few epochs

Explanation

A large gap between holdout and production performance typically signals distribution shift, where live inputs differ from those seen during development. Small holdouts, under-training, or metric errors would usually also depress holdout results rather than appear only after deployment.

Question 6Foundations of AI/ML and Risk Management

Which control most directly mitigates the risk of an ML model silently failing after a data pipeline upstream changes a feature's units?

  1. Automated input data quality and distribution monitoring with alerting Correct answer.
  2. Retraining the model on the original dataset
  3. Increasing the model's regularization strength
  4. Adding more layers to the neural network

Explanation

Silent failures from upstream schema or unit changes are detected by monitoring input data for schema, range, and distribution anomalies and alerting operators. Regularization, retraining on stale data, or deeper architectures do not detect a broken pipeline.

Question 7Foundations of AI/ML and Risk Management

A credit model is highly accurate overall but performs poorly for a small demographic group. Which evaluation approach best surfaces this risk?

  1. Disaggregated performance metrics computed per subgroup Correct answer.
  2. Training loss curves over epochs
  3. A single aggregate AUC across the full population
  4. Confusion matrix totals for the whole dataset

Explanation

Aggregate metrics can mask poor performance in small subgroups because the majority dominates the average. Computing metrics separately per group reveals disparities in error rates and calibration that overall scores hide.

Question 8Foundations of AI/ML and Risk Management

In a three-tier model risk framework, what is the primary purpose of independent validation of a high-risk model?

  1. To accelerate the model's deployment timeline
  2. To tune hyperparameters for maximum accuracy
  3. To provide an objective assessment of the model's conceptual soundness and performance separate from its developers Correct answer.
  4. To replace the model owner's accountability

Explanation

Independent validation gives an unbiased challenge to the developer's work, assessing conceptual soundness, data quality, and performance before and after deployment. It does not speed deployment, absorb ownership accountability, or serve as a tuning service.

Question 9Foundations of AI/ML and Risk Management

A model's predicted probabilities are well ranked but systematically too high. Which property is violated?

  1. Reproducibility of the training run
  2. Ranking discrimination measured by AUC
  3. Calibration of the predicted probabilities Correct answer.
  4. Determinism of the inference pipeline

Explanation

Calibration means predicted probabilities match observed frequencies; a model can rank well yet be miscalibrated if its scores are uniformly inflated. AUC depends only on ordering, so it can remain high despite the shift in probability levels.

Question 10Foundations of AI/ML and Risk Management

Which scenario best exemplifies model risk arising from inappropriate use outside the model's intended purpose?

  1. A model validated for short-term delinquency is repurposed to set long-term credit limits Correct answer.
  2. A model is deployed on a faster GPU server
  3. A model's source code is stored in a private repository
  4. A model's predictions are logged for audit purposes

Explanation

Model risk includes use risk: a model is only fit for the purpose and population it was validated against. Extending a short-horizon delinquency model to long-horizon credit limits exceeds its validated scope, whereas infrastructure, storage, and logging changes do not.

Question 11Foundations of AI/ML and Risk Management

A team wants to estimate how a deployed model's accuracy will degrade under expected population change. Which approach is most appropriate?

  1. Backtesting on temporally later data and stress-testing with shifted covariate distributions Correct answer.
  2. Removing correlated features from the model
  3. Increasing the number of training epochs
  4. Reporting the model's accuracy on a random holdout from the original period

Explanation

Out-of-time backtesting and stress tests with shifted inputs simulate how performance responds to changing populations. A random holdout from the original period cannot reveal temporal degradation, and training or feature changes do not measure it.

Question 12Foundations of AI/ML and Risk Management

Which statement correctly distinguishes explainability from interpretability in model risk documentation?

  1. Interpretability applies only to deep networks, while explainability applies only to linear models
  2. Interpretability concerns understanding model mechanics, while explainability concerns justifying specific outputs to stakeholders Correct answer.
  3. Explainability is a legal requirement in all jurisdictions, while interpretability is optional
  4. Interpretability and explainability are identical and interchangeable in all contexts

Explanation

Interpretability is about how comprehensible the model's internal logic is, whereas explainability is about producing justifications for individual predictions that stakeholders can review. The two overlap but serve different governance needs, such as adverse-action reasoning versus model debugging.

Question 13Foundations of AI/ML and Risk Management

A model's feature importance shows a variable that is a proxy for a protected attribute. Which risk does this most directly raise?

  1. Overfitting due to too many features
  2. Increased inference latency
  3. Data leakage from the target variable
  4. Disparate impact through a proxy variable Correct answer.

Explanation

Proxy variables can transmit protected-attribute information into predictions even when the attribute itself is excluded, producing disparate impact. Feature count, leakage, and latency are separate technical concerns unrelated to the proxy mechanism.

Question 14Foundations of AI/ML and Risk Management

Which element is essential in a model inventory maintained under a model risk framework?

  1. The personal contact details of every data scientist
  2. A list of all cloud regions used by the organization
  3. The full source code of every model in a single file
  4. A record of each model's purpose, owner, risk rating, and validation status Correct answer.

Explanation

A model inventory functions as the central register linking each model to its purpose, accountable owner, risk tier, and validation state so governance can be tracked. Source code dumps, staff contacts, or infrastructure lists do not provide that governance view.

Question 15Foundations of AI/ML and Risk Management

A monitoring dashboard shows that a deployed model's input feature distributions have shifted but its output accuracy remains stable. What is the most appropriate interpretation?

  1. Early-warning signal of possible future degradation that warrants investigation Correct answer.
  2. Proof that the model is unaffected and monitoring can be relaxed
  3. Evidence that the model has been overfit to the training data
  4. Confirmation that the model's calibration has improved

Explanation

Input drift is an early indicator that the environment is changing, even if accuracy has not yet fallen, because label-dependent metrics lag. Treating stable accuracy as proof of safety or as evidence of overfitting or improved calibration misreads the signal.

Question 16Foundations of AI/ML and Risk Management

Which practice best supports the auditability of an ML decision system over time?

  1. Immutable logging of model version, input features, and output for each decision Correct answer.
  2. Periodic deletion of old prediction logs to save storage
  3. Aggregating all decisions into monthly counts only
  4. Storing only the final model artifact without version history

Explanation

Auditability requires reconstructing which model version produced which decision from which inputs, which immutable per-decision logging enables. Deleting logs, keeping only aggregates, or discarding version history destroys the evidence trail.

Question 17Foundations of AI/ML and Risk Management

A team applies a post-hoc explanation method that approximates a complex model locally. Which risk should reviewers keep in mind when relying on those explanations?

  1. The explanation guarantees causality between features and outcomes
  2. The explanation removes the need for independent validation
  3. The explanation proves the model is fair across groups
  4. The explanation is an approximation and may not faithfully reflect the model's true reasoning Correct answer.

Explanation

Post-hoc local approximations can diverge from the underlying model's behavior, so explanations are evidence to be scrutinized rather than ground truth. They do not establish causality, replace validation, or demonstrate fairness.

Question 18Foundations of AI/ML and Risk Management

Two models have identical AUC, but model A is well calibrated and model B is not. For a use case that sets decision thresholds from predicted probabilities, why does calibration matter?

  1. Calibration determines the model's inference latency
  2. Miscalibration always indicates the model was overfit
  3. AUC will necessarily drop once the model is deployed
  4. Thresholds chosen on miscalibrated scores will not correspond to the intended error trade-off Correct answer.

Explanation

When decisions depend on probability thresholds, miscalibrated scores shift the effective operating point away from the intended balance of false positives and false negatives. AUC is rank-based and can remain unchanged, and calibration is independent of overfitting and latency.

Question 19Foundations of AI/ML and Risk Management

A regulator asks how an institution ensures that a high-risk model remains within acceptable performance bounds after deployment. Which combination best answers this?

  1. A pledge to review the model annually without metrics
  2. Defined performance thresholds, continuous monitoring, and a documented remediation and retraining process Correct answer.
  3. A larger training dataset collected at launch
  4. A one-time validation report completed before launch

Explanation

Ongoing fitness requires explicit thresholds that define acceptable performance, monitoring to detect breaches, and a documented process for remediation or retraining when breaches occur. One-time validation, larger initial data, or metric-free annual reviews do not maintain bounds over time.

Question 20Foundations of AI/ML and Risk Management

An ML system's training data includes sensitive personal information. Which control most directly addresses privacy risk during model development?

  1. Deploying the model behind a load balancer
  2. Data minimization with de-identification and access controls on training data Correct answer.
  3. Using a larger batch size during training
  4. Increasing model regularization to reduce overfitting

Explanation

Privacy risk in development is reduced by collecting only necessary data, de-identifying it, and restricting access to authorized personnel. Regularization, load balancing, and batch size affect model fitting or serving, not the exposure of personal data.

Question 21AI/ML Governance, Frameworks, and Regulation

Under the EU AI Act, which practice is explicitly prohibited regardless of the context in which the system is deployed?

  1. Social scoring of individuals by public authorities leading to detrimental treatment Correct answer.
  2. Emotion recognition in workplace safety monitoring with employee consent
  3. Real-time biometric identification authorized by a judicial order for serious crime
  4. Publishing AI-generated deepfake content clearly labeled as synthetic

Explanation

The EU AI Act bans AI systems that evaluate or classify people based on social behavior or personal characteristics, producing detrimental treatment unrelated to the context of data collection. The other listed practices are either permitted with safeguards or subject to transparency duties rather than outright prohibition.

Question 22AI/ML Governance, Frameworks, and Regulation

In the NIST AI Risk Management Framework, the function that focuses on prioritizing and treating identified AI risks is:

  1. Manage Correct answer.
  2. Govern
  3. Measure
  4. Map

Explanation

The NIST AI RMF is organized around four functions: Govern, Map, Measure, and Manage. The Manage function allocates resources to prioritized risks and implements treatment plans, whereas Map frames context and Measure assesses risk levels.

Question 23AI/ML Governance, Frameworks, and Regulation

A bank's model risk management policy requires independent validation of a credit-scoring model before deployment. Which governance control does this requirement primarily represent?

  1. Post-market surveillance reporting to a regulator
  2. Data minimization during model training
  3. Ongoing production monitoring for drift
  4. Second-line independent challenge of a first-line model Correct answer.

Explanation

Independent validation is a second-line control: the business or model developer owns the model, while a separate function challenges assumptions, data, and performance. Monitoring, data minimization, and regulatory reporting are distinct controls addressing different risks.

Question 24AI/ML Governance, Frameworks, and Regulation

Which document is the primary international soft-law instrument setting out OECD AI Principles adopted in 2019 and updated since?

  1. The ISO/IEC 42001 certification scheme
  2. The IEEE 7000 series standard
  3. The General Data Protection Regulation
  4. The Recommendation of the Council on Artificial Intelligence Correct answer.

Explanation

The OECD Recommendation on AI is the intergovernmental soft-law instrument containing principles on inclusive growth, human rights, transparency, and accountability. It has influenced national policies and the G20 AI principles, but it is not binding law or a certification standard.

Question 25AI/ML Governance, Frameworks, and Regulation

Under the GDPR, a company uses an AI system to make automated decisions producing legal effects about individuals. What right do data subjects generally hold?

  1. A right to receive source code of the underlying model
  2. A right to veto the deployment of any AI system in the company
  3. A right to obtain human intervention and contest the decision Correct answer.
  4. A right to demand deletion of all training data within 24 hours

Explanation

Article 22 of the GDPR restricts solely automated decisions with significant effects and provides safeguards including human intervention, expressing a view, and contesting the decision. The other options describe rights that the GDPR does not grant in this form.

Question 26AI/ML Governance, Frameworks, and Regulation

The term 'AI system' in the EU AI Act is defined primarily by which characteristic?

  1. It must exceed a defined parameter threshold to qualify
  2. It infers from input how to generate outputs such as predictions, content, or decisions Correct answer.
  3. It must operate autonomously without any human oversight
  4. It must be trained using supervised learning on labeled datasets

Explanation

The Act defines an AI system as a machine-based system designed to operate with varying levels of autonomy that infers from input how to generate outputs influencing physical or virtual environments. It does not require a specific learning paradigm, parameter count, or full autonomy.

Question 27AI/ML Governance, Frameworks, and Regulation

Which of the following best describes the role of an AI management system standard such as ISO/IEC 42001?

  1. It certifies that a specific trained model is free of bias
  2. It mandates a particular machine learning algorithm for high-risk systems
  3. It specifies requirements for establishing, implementing, and continually improving AI governance processes Correct answer.
  4. It replaces national AI regulation with a voluntary code

Explanation

ISO/IEC 42001 is a management system standard analogous to ISO 27001, requiring organizations to establish policies, roles, risk processes, and continual improvement for AI. It does not certify individual models, prescribe algorithms, or supersede law.

Question 28AI/ML Governance, Frameworks, and Regulation

A hospital deploys an AI triage tool. Under a risk-based regulatory regime, which classification most appropriately applies given potential harm to patients?

  1. Unregulated, because clinicians retain final decision authority
  2. Prohibited, because it affects health outcomes
  3. High-risk, triggering conformity assessment and post-market monitoring obligations Correct answer.
  4. Minimal-risk, requiring only voluntary disclosure

Explanation

AI used in critical healthcare decisions is typically classified as high-risk, requiring conformity assessment, risk management, documentation, human oversight, and post-market monitoring. Clinician override does not remove the classification, and such tools are not prohibited.

Question 29AI/ML Governance, Frameworks, and Regulation

An organization wants to document how a high-risk AI system's training data was collected, labeled, and checked for representativeness. Which governance artifact is most directly relevant?

  1. A board resolution approving the annual budget
  2. A data governance and dataset documentation record such as a datasheet Correct answer.
  3. A penetration test report for the inference API
  4. A service level agreement with the cloud provider

Explanation

Dataset documentation instruments, often called datasheets or data statements, capture provenance, labeling methods, known gaps, and suitability. They support conformity assessment and bias analysis, whereas the other artifacts address security, commercial, or financial matters.

Question 30AI/ML Governance, Frameworks, and Regulation

A regulator asks a firm to explain how its AI system reaches individual decisions. Which practice best satisfies a 'right to explanation' expectation while protecting trade secrets?

  1. Providing meaningful information about the logic involved, significance, and envisaged consequences at a level the affected person can understand Correct answer.
  2. Disclosing the complete training dataset and all model weights to each requester
  3. Publishing only the model's overall accuracy metric on the corporate website
  4. Refusing all explanation requests on the grounds of proprietary IP

Explanation

Explanation duties are generally met through meaningful, context-appropriate information about the logic and consequences rather than full technical disclosure. This balances transparency with legitimate confidentiality interests, while blanket refusal or a single accuracy figure is inadequate.

Question 31AI/ML Governance, Frameworks, and Regulation

Which scenario best illustrates the 'human in the loop' oversight requirement for a high-risk AI system?

  1. The vendor's support team monitors system uptime
  2. A human clicks 'approve' on every output without access to underlying evidence
  3. A trained operator can review, override, or halt the system's output before it takes effect Correct answer.
  4. The system logs all decisions for annual audit review

Explanation

Effective human oversight requires that overseers can understand relevant outputs, intervene, and stop the system, which presupposes competence, context, and authority. Rubber-stamping approvals or retrospective logging alone does not constitute meaningful oversight.

Question 32AI/ML Governance, Frameworks, and Regulation

A team builds a generative model trained on scraped web content. Which governance concern is most directly raised by the training data source?

  1. The choice of cloud region for model hosting
  2. The inference latency of the deployed endpoint
  3. The licensing cost of the visualization dashboard
  4. Copyright and personal data compliance in the provenance of training content Correct answer.

Explanation

Scraped content raises questions about copyright permissions, personal data processing, and lawful basis, which must be addressed in data governance. Latency, hosting region, and dashboard licensing are operational or commercial matters unrelated to provenance compliance.

Question 33AI/ML Governance, Frameworks, and Regulation

In a three-lines-of-defense model, which group is primarily responsible for owning and managing AI risk in a business unit?

  1. The internal audit function, which provides independent assurance
  2. The external regulator, which supervises compliance
  3. The first line, which operates the AI system and applies controls Correct answer.
  4. The second line, which sets risk frameworks and challenges

Explanation

The first line owns and manages risk in day-to-day operations, while the second line sets frameworks and provides challenge, and internal audit gives independent assurance. Regulators supervise but do not manage internal risk.

Question 34AI/ML Governance, Frameworks, and Regulation

A vendor claims its AI hiring tool is 'bias-free.' Which response is most consistent with sound AI governance?

  1. Deploy the tool but remove demographic fields from the input
  2. Rely on the tool because it uses a large training dataset
  3. Accept the claim because the vendor is ISO certified
  4. Request disaggregated performance evidence across protected groups and test the tool in the local context Correct answer.

Explanation

Fairness claims require disaggregated metrics, documented testing, and validation in the deploying context, since bias is context-dependent. Certification of a management system, dataset size, or removing explicit fields does not establish absence of discrimination.

Question 35AI/ML Governance, Frameworks, and Regulation

Which obligation is most characteristic of a provider of a high-risk AI system under the EU AI Act before placing it on the market?

  1. Obtaining consent from each affected individual at inference time
  2. Registering every end user with the national tax authority
  3. Publishing the full model architecture in the official journal
  4. Conducting a conformity assessment and affixing the CE marking Correct answer.

Explanation

Providers of high-risk systems must conduct conformity assessment, draw up technical documentation, implement a quality management system, and affix CE marking before market placement. The other options are not obligations under the Act.

Question 36AI/ML Governance, Frameworks, and Regulation

An AI system's performance degrades after a change in customer behavior. Which governance process should detect and respond to this?

  1. Annual financial auditing of the AI budget line
  2. A one-time validation performed before launch
  3. Periodic review of the vendor's marketing materials
  4. Continuous post-deployment monitoring with defined drift thresholds and remediation triggers Correct answer.

Explanation

Post-market monitoring is designed to detect performance degradation and drift, with pre-defined thresholds that trigger investigation or remediation. Pre-launch validation alone cannot capture distributional change, and financial or marketing reviews are unrelated.

Question 37AI/ML Governance, Frameworks, and Regulation

A company wants to use synthetic data to reduce privacy risk in training. Which governance check is most important before relying on it?

  1. Ensuring the generator was trained on the largest available dataset
  2. Checking that synthetic samples look visually realistic
  3. Confirming that synthetic data reduces storage costs
  4. Verifying that synthetic records do not memorize or leak real individuals' data Correct answer.

Explanation

Synthetic data can still leak information through memorization or overfitting to rare records, so privacy testing such as membership inference or nearest-neighbor checks is essential. Cost, dataset size, and realism do not establish privacy protection.

Question 38AI/ML Governance, Frameworks, and Regulation

Which statement best captures the difference between AI governance and AI ethics?

  1. Ethics is legally binding while governance is voluntary
  2. Governance operationalizes ethical principles through policies, controls, and accountability mechanisms Correct answer.
  3. Governance applies only to public sector organizations
  4. Ethics concerns model accuracy while governance concerns data storage

Explanation

Ethics articulates values and principles, while governance translates them into enforceable policies, roles, controls, and accountability structures. The relationship is one of operationalization, not a legal-versus-voluntary or sector-specific split.

Question 39AI/ML Governance, Frameworks, and Regulation

A jurisdiction requires AI systems interacting with humans to disclose their artificial nature. Which transparency measure directly satisfies this?

  1. Displaying the model's version number in the footer
  2. Including the disclosure in a 40-page terms-of-service document
  3. Informing users at the outset that they are interacting with an AI system Correct answer.
  4. Registering the chatbot with a trade association

Explanation

Transparency obligations for conversational AI require clear, timely disclosure so users know they are interacting with a machine. Burying notice in lengthy terms, trade-association registration, or version numbers does not achieve meaningful disclosure.

Question 40AI/ML Governance, Frameworks, and Regulation

Which indicator most strongly suggests that an organization's AI governance is mature rather than performative?

  1. Employees complete an annual AI awareness module
  2. AI risk findings are tracked to remediation with named owners and deadlines Correct answer.
  3. The organization publishes an AI ethics statement on its homepage
  4. A chief AI officer position has been created

Explanation

Maturity is evidenced by closed-loop accountability: risks are logged, assigned, remediated, and verified. Statements, titles, and training are inputs that support governance but do not by themselves demonstrate that risks are managed.

Question 41AI/ML Governance, Frameworks, and Regulation

A model trained in one country is deployed in another with different demographic composition. Which governance action best addresses the resulting fairness risk?

  1. Revalidating performance on local population data before and after deployment Correct answer.
  2. Removing fairness metrics to avoid regulatory scrutiny
  3. Relying on the original validation results because the model is unchanged
  4. Increasing the model's parameter count to improve general accuracy

Explanation

Fairness and performance are population-dependent, so a model validated elsewhere must be re-tested on local data to detect subgroup degradation. The model weights being unchanged does not make the original validation transferable.

Question 42AI/ML Governance, Frameworks, and Regulation

A regulator imposes a duty of technical documentation for high-risk AI. Which set of contents most plausibly satisfies this duty?

  1. Marketing plan, pricing strategy, and competitor analysis
  2. Source code only, with no explanatory narrative
  3. Intended purpose, design and development description, data requirements, risk management, testing results, and human oversight measures Correct answer.
  4. Employee handbook, payroll records, and office lease

Explanation

Technical documentation for high-risk systems must describe the system's purpose, design, data, risk management, testing, and oversight so that conformity can be assessed. Commercial records and raw code without explanatory context do not enable regulatory assessment.

Question 43AI/ML Governance, Frameworks, and Regulation

An organization uses a third-party foundation model API and fine-tunes it for customer service. Which allocation of responsibility is most consistent with prevailing AI governance frameworks?

  1. Responsibility transfers to the end customer who accepts the terms
  2. The model provider bears all responsibility for any downstream harm
  3. Responsibility is eliminated because the model is third-party
  4. The deployer retains responsibility for downstream use, oversight, and compliance in its context Correct answer.

Explanation

Value-chain frameworks allocate obligations across providers and deployers: the deployer remains accountable for how the system is used and monitored in its own context. Outsourcing the model does not outsource accountability for downstream effects.

Question 44AI/ML Governance, Frameworks, and Regulation

A team proposes using an AI system to infer employees' emotional states during performance reviews. Under the EU AI Act, how should this be assessed?

  1. It falls within a prohibited practice concerning emotion recognition in the workplace Correct answer.
  2. It is permitted if employees are informed in advance
  3. It is unregulated because performance reviews are internal
  4. It is high-risk but permissible with CE marking

Explanation

The AI Act prohibits emotion recognition in the workplace and education settings, subject only to narrow exceptions such as medical or safety reasons. Consent, CE marking, or the internal nature of the process does not make such a system permissible.

Question 45AI/ML Governance, Frameworks, and Regulation

Which approach best operationalizes the principle of accountability in an AI governance program?

  1. Delegating all AI decisions to the data science team
  2. Adopting a general statement that the organization values responsible AI
  3. Relying on external auditors to make deployment decisions
  4. Assigning documented decision rights and approval gates for each AI system across its lifecycle Correct answer.

Explanation

Accountability requires clear decision rights, approval gates, and traceable ownership at each lifecycle stage so that responsibility can be located and enforced. General statements, undifferentiated delegation, or outsourcing decisions to auditors do not create accountable governance.

Question 46AI/ML Governance, Frameworks, and Regulation

Under the EU AI Act, which practice is prohibited because it exploits a person's vulnerability due to age, disability, or specific social or economic situation to materially distort behavior in a harmful way?

  1. Real-time remote biometric identification in public spaces
  2. Social scoring by private companies
  3. Emotion recognition in workplace settings
  4. Manipulative techniques targeting vulnerable groups Correct answer.

Explanation

The Act bans AI practices that deploy subliminal, manipulative, or deceptive techniques, and it specifically adds a prohibition on exploiting vulnerabilities tied to age, disability, or social or economic circumstances to distort behavior and cause significant harm. This is a standalone prohibited practice, distinct from the high-risk categories that merely impose obligations.

Question 47AI/ML Governance, Frameworks, and Regulation

A national standards body wants to certify that a company's AI program has a repeatable, auditable process for managing risk across the AI lifecycle. Which standard is most directly designed for this purpose?

  1. ISO/IEC 17025 testing laboratory competence
  2. ISO/IEC 25010 software quality model
  3. ISO/IEC 42001 AI management systems Correct answer.
  4. ISO/IEC 27001 information security management

Explanation

ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system, making it the natural basis for certifying a lifecycle-wide governance process. It is structured around management-system clauses and AI-specific controls, so it directly fits the described goal.

Question 48AI/ML Governance, Frameworks, and Regulation

A company plans to deploy a chatbot that gives medical advice to patients. Under the EU AI Act, which classification analysis is most appropriate?

  1. Out of scope because it is a software application
  2. Clearly minimal-risk because the chatbot only provides text output
  3. Prohibited because it interacts with humans
  4. Likely high-risk because it is a safety component or medical device context, triggering conformity assessment Correct answer.

Explanation

The Act's high-risk list includes AI systems intended to be used as safety components in the management and operation of critical infrastructure and AI systems that are safety components of, or themselves, medical devices requiring third-party conformity assessment. A medical-advice chatbot therefore requires a careful high-risk analysis rather than automatic minimal-risk treatment.

Question 49AI/ML Governance, Frameworks, and Regulation

A bank uses a third-party credit-scoring model as a component of its own loan-decision system. Under the EU AI Act, how are responsibilities best described?

  1. The bank is always a provider because it makes the final lending decision
  2. The bank is a deployer, but if it places the system on the market under its own name it may become a provider Correct answer.
  3. The third-party vendor bears all obligations and the bank has none
  4. The bank is a distributor because it delivers loans to customers

Explanation

The Act distinguishes providers, deployers, and distributors, and a deployer can take on provider obligations when it puts the system into service under its own name or trademark or substantially modifies it. The bank's default role is deployer, with provider duties triggered by rebranding or substantial modification.

Question 50AI/ML Governance, Frameworks, and Regulation

An AI governance lead must demonstrate that a high-risk model's post-market monitoring is effective. Which arrangement best satisfies the EU AI Act's post-market monitoring expectation for providers?

  1. A statement in the user manual asking deployers to report any problems they notice
  2. A one-time validation report produced before deployment and archived for ten years
  3. A documented plan that actively collects and analyzes performance data in use and feeds findings into corrective action Correct answer.
  4. A customer satisfaction survey administered annually by the sales team

Explanation

Post-market monitoring requires a proactive, documented system for collecting and analyzing data on the system's performance throughout its lifetime and using the results to identify and address issues. Passive reliance on user reports or a single pre-deployment test does not meet the expectation of ongoing, structured monitoring.