Quick mixed check · Self-check | AI GRCA Practitioner Programme

What does 'inspection' mean as an evidence-gathering method?

Watching someone perform a taskAsking someone a questionExamining records, documents or system configurations directlyRedoing the control yourself

A non-EU company's AI product is never sold in the EU, but its output is used by an EU-based customer who receives services generated by it. Could EU AI Act obligations still be relevant?

Potentially yes — market connection can arise through the use of the system's output within the EU, not only through direct sales thereOnly physical hardware sales create market connectionThis scenario is explicitly exempted by the ActNo, obligations can never extend this way

Which is the best way to describe the relationship between Clause 4 scoping work and later Clause 8 operational controls?

They are entirely disconnected activitiesClause 4 scope defines what Clause 8 operational controls actually need to cover — controls should map back to the defined scopeClause 8 controls should be defined before Clause 4 scopeScope has no bearing on which systems need operational controls

A good acceptance criterion should be set:

As a vague aspirationAfter testing, once results are knownBefore testing, as a measurable threshold with a rule for unacceptable failureOnly by the AI vendor

What does 'data governance' cover in the EU AI Act's high-risk obligations?

Only applies to GPAI models, not high-risk systemsOnly where the servers are physically locatedPractices for training, validation and testing data, including relevance, representativeness and qualityMarketing approval of the dataset name

What is the primary purpose of the MAP function?

Board reportingSetting risk appetite policyWriting release evidenceEstablishing context: intended use, affected people, misuse and risk scenarios

What belongs in the 'retirement' stage of the AI lifecycle?

Data handling, supplier exit, evidence retention and communication to affected people, as relevantImmediate deletion of all records with no retentionTransferring accountability to the AI system itselfNothing further once a system stops being used

When classifying a scenario under the EU AI Act, what should a strong answer state alongside the conclusion?

A guarantee of complete legal certaintyOnly the technology used, not the use caseNothing — a bare classification label is sufficientThe key assumption or fact the classification depends on, and any residual uncertainty

Which two sectors in this module's coverage most explicitly require attention to how automated decisions affect vulnerable or differently-situated groups?

Only healthcareInternal copilots and recruitment onlyInsurance and public sectorOnly financial services

What's a reasonable trigger for a 'security review' at intake?

Security review is only needed after a breachSecurity review only applies to open-source systemsThe system has no external connections and processes no sensitive dataThe system integrates with external tools, APIs or handles sensitive data

Why does AI governance exist at all?

Only to satisfy IT departmentsTo slow down technology adoption for its own sakeTo manage the risks and responsibilities AI systems create for people and organisationsBecause all AI is illegal without it

Which RMF function establishes intended use, context and risk scenarios?

ManageGovernMapMeasure

What best describes 'control environment' in COSO terms?

A synonym for a firewallThe physical office layoutThe server infrastructure hosting the modelThe tone, culture, accountability structures and competence that underpin all other controls

Why does 'AI ownership' need to be distinct from general IT ownership?

IT ownership is always sufficientAI ownership is a redundant conceptAI systems carry no distinct risk from other softwareAI systems raise specific risks (bias, hallucination, autonomy) that general IT ownership models may not cover

Why does 'audit trail' design for agents typically need to capture the reasoning or plan, not just the final action taken?

Understanding why an agent chose a particular action helps diagnose whether it was manipulated, malfunctioning, or behaving as intendedOnly the final output ever needs reviewCapturing reasoning is technically impossible for any agentReasoning is irrelevant to understanding what happened

What role does the 'governance board' typically play under Clause 5, as distinct from day-to-day system owners?

The governance board should approve every individual AI outputSystem owners report to no one under Clause 5It has no distinct role from system ownersIt provides senior oversight, sets direction and approves policy, while system owners handle operational management of individual AI systems

A 'localisation/geographic restriction policy' addresses:

Only marketing localisationOnly applies to hardwareOnly translation qualityRestricting where data or system operation occurs, often for legal or risk reasons

A cited source doesn't actually support the claim made in the answer. This is a failure of:

Grounding and citation traceabilityDatabase rightsPurpose limitationData minimisation

Which of these is a 'special category' of data under UK GDPR?

Data concerning healthA person's job titleA person's employer nameA person's postcode

Why might 'monitor' be an acceptable treatment for a low-probability, low-severity harm, when it wouldn't be for a high-severity one?

Monitoring replaces the need to ever assess severityMonitoring is never an acceptable treatment for any harmTreatment should be proportionate to the risk level; lower risks can sometimes be managed with monitoring aloneAll harms require the same treatment regardless of severity

Why do ISO AI standards matter to a practitioner, beyond academic interest?

They have no practical useThey give a shared vocabulary, a governance-system structure and an impact-assessment method that make AI governance consistent and auditableThey are only relevant to software engineersThey replace the need for any legal analysis

Why would 'supplier controls' appear within Clause 8 operation rather than only in Annex A's third-party theme?

Because managing suppliers is an ongoing operational activity (not just a one-time control selection), it belongs in Clause 8's operational scope tooClause 8 and Annex A never overlap in subject matterSupplier controls are exclusively a Clause 5 leadership matterSupplier controls have no place in Clause 8 at all

What is the 'second line' in the three lines of defence model?

The team that owns and operates the AI systemRisk, compliance and similar functions providing oversight and challenge to the first lineExternal regulatorsA synonym for internal audit

Which best reflects the relationship between leadership commitment (Clause 5) and Annex A control selection?

Leadership commitment sets the direction and resourcing that makes meaningful Annex A control selection and operation possibleAnnex A controls are selected before any leadership involvementLeadership has no role in control selectionThey are entirely unrelated activities

Sector regulation for a financial services AI tool would most likely add requirements around:

Only employment contractsOnly general marketing practices with no sector specificityFinancial-services-specific obligations, such as fair lending or model risk management practicesOnly physical workplace safety