50 QUESTIONS · ALL 24 WEEKS

Standard mixed check

A balanced cross-syllabus session with at least two questions drawn from every syllabus module. Questions are original practice material aligned to this course syllabus; they are not copied from, endorsed by or represented as questions from an official certification exam.

A retailer in the supply chain makes a high-risk AI system available on the EU market without being the original provider or importer. Which role does this describe?

Affected personProduct manufacturerDeployerDistributor

A recruitment vendor's fairness testing only used labour-market data from one country. What's the practitioner concern if the tool is deployed elsewhere?

The testing evidence may not generalise to a different population or labour-market contextTesting location is irrelevant to fairness conclusionsThis only matters for public-sector recruitmentNo concern — fairness testing is universally generalisable

When should a harm block a launch?

Never — harms are always accepted with monitoringWhen it is severe and/or probable enough that available controls can't reduce it to an acceptable levelOnly if a regulator has already fined someone for itOnly for generative AI systems

Which best reflects the relationship between leadership commitment (Clause 5) and Annex A control selection?

Leadership commitment sets the direction and resourcing that makes meaningful Annex A control selection and operation possibleAnnex A controls are selected before any leadership involvementLeadership has no role in control selectionThey are entirely unrelated activities

What's the difference between certification and implementation?

Implementation is building the AIMS practices; certification is an optional external verification against the standardCertification must happen before any implementation workCertification guarantees fair AI outcomesThey're identical

What does MAP's 'context' work primarily protect against?

Marketing miscommunication onlyNothing — it's a formalityBuilding controls and tests for the wrong problem because the system's real use and risk weren't properly understood firstModel training costs

What does 'evidence' mean in a GRC context?

Something inspectable that demonstrates a control operated or a risk was properly assessedOnly relevant to court proceedingsA requirement only for third-party auditsA synonym for opinion

How does 'fairness' as a UK GDPR principle differ from simply having a lawful basis for processing?

Only lawfulness matters; fairness is not a separate UK GDPR principleThey are identical requirementsFairness concerns whether processing is reasonably expected and not unduly detrimental to the individual, which is a distinct question from whether a lawful basis technically existsFairness has no independent meaning beyond lawfulness

Which is the best way to describe the relationship between Clause 4 scoping work and later Clause 8 operational controls?

They are entirely disconnected activitiesClause 4 scope defines what Clause 8 operational controls actually need to cover — controls should map back to the defined scopeClause 8 controls should be defined before Clause 4 scopeScope has no bearing on which systems need operational controls

A company documents its AIMS scope, policy and objectives but has never run an impact assessment on any deployed system. Which standard's practice is missing?

None — impact assessment isn't part of any of these standardsISO/IEC 22989ISO/IEC 42001ISO/IEC 42005

What is a 'foundation model'?

A large model trained on broad data that can be adapted as a base for many downstream applicationsA model that only works offlineA synonym for a spam filterAny model under 1GB in size

'Release gates' in MANAGE function as:

A synonym for a risk register entryOptional suggestions with no real effectDefined checkpoints that must be passed before a system can be released or scaledOnly relevant to hardware releases

Which is a leadership responsibility under Clause 5, not a purely operational task?

Writing the model's codeResponding to individual support ticketsManually reviewing every AI outputSetting AI policy and assigning roles, authorities and resources

Why do 'tool permissions' need periodic review, not just a one-time setup?

As an agent's use case evolves, permissions granted for an earlier purpose may become excessive or stalePeriodic review only applies to human user accountsReviewing permissions is purely a cost-saving exercise with no security valueTool permissions never need to change once set

Between a small, single-purpose model and a large, general-purpose model, which factor most matters for a narrow, well-defined task?

A smaller, purpose-built model can often perform as well or better on a narrow task with lower cost and easier evaluationSmall models cannot be evaluated for accuracyLarge models are always cheaper to runAlways choose the largest model regardless of task

'Human oversight testing' evaluates:

Only the number of reviewers employedWhether a human technically exists in the workflowWhether human review is genuinely effective at catching errors and being able to change outcomesOnly staff satisfaction with the tool

Why does an evidence-pack index need to state each artefact's relevance to the final decision, not just its title?

Relevance statements are unnecessary paddingIt shows the reviewer why each artefact matters to the actual conclusion, not just that it existsTitles alone are always sufficient for an indexThis only matters for artefacts marked 'incomplete'

Why would 'supplier controls' appear within Clause 8 operation rather than only in Annex A's third-party theme?

Because managing suppliers is an ongoing operational activity (not just a one-time control selection), it belongs in Clause 8's operational scope tooClause 8 and Annex A never overlap in subject matterSupplier controls are exclusively a Clause 5 leadership matterSupplier controls have no place in Clause 8 at all

Which best describes 'needs and expectations' of interested parties in Clause 4 terms?

A fixed, universal list identical for every organisationA synonym for financial targetsWhat each interested party requires or expects from how the organisation governs AI, which the AIMS should account forOnly the needs of the AI development team

Clause 4 requires understanding which two categories of issues?

Financial and marketing issuesInternal and external issues affecting the AIMSOnly external issuesOnly issues raised by regulators

How should 'objectives and measurement' under Clause 6 be reviewed after a significant AI incident?

Objectives should never be revisited after an incidentThe incident should prompt a review of whether existing objectives and measures adequately addressed the risk that materialised, adjusting them if notIncidents are irrelevant to Clause 6 objective-settingOnly Clause 10 addresses incidents, with no link back to Clause 6 objectives

Segregation of duties in AI governance most directly reduces the risk of:

Slower model trainingOne person having unchecked control over both building and approving a systemHigher cloud hosting costsLonger documentation

What defines an 'AI agent' as distinct from a standard chatbot?

Chatbots always use larger models than agentsThere is no meaningful distinctionAgents are always faster than chatbotsAn agent can take actions via tools, not just generate text responses

A leader says: 'We just follow the law, we don't need frameworks.' What's the issue with this view?

There is no issue; law is always sufficientLaws often set outcomes without prescribing how to achieve them; frameworks give practical structure to meet those outcomesFrameworks are illegal to use alongside lawFrameworks always conflict with legal requirements

A 'localisation/geographic restriction policy' addresses:

Only marketing localisationOnly applies to hardwareOnly translation qualityRestricting where data or system operation occurs, often for legal or risk reasons

Why does this course emphasise that 'AI law is broader than privacy'?

Because other legal domains are always less important than privacyBecause privacy law is the only relevant domain in practiceBecause IP, equality, consumer, contract, liability and sector law can all independently create AI risk, beyond data protectionBecause privacy law doesn't apply to AI at all

How should 'wider legal issues' (beyond privacy) be handled in a capstone-style scenario?

Actively screened for — IP, equality, consumer protection, liability and sector duties can all be relevant depending on the factsAssumed to never apply to AI systemsOnly relevant for public-sector scenariosIgnored unless the question is explicitly about privacy

How does ISO/IEC 42005 relate to NIST AI RMF's MAP function?

42005 replaces MAP entirelyMAP is a certifiable standard like 42005They are unrelatedBoth involve understanding context and impacts on affected people, though structured differently

What is a 'management system' in the ISO sense, as distinct from a single policy document?

A one-time audit checklistA synonym for a policyA structured, repeatable set of interrelated processes an organisation uses to achieve objectives and manage risk, including planning, operation, evaluation and improvementOnly the software used to track compliance

How does a 'risk' differ from an 'incident'?

Risks only exist after an incident has happenedThey are identical termsA risk is a possible future event with uncertain outcome; an incident is something that has already occurredIncidents are always less serious than risks

Why is 'competence' under Clause 7 relevant specifically to people operating AI systems, not just general staff training?

Competence under Clause 7 only concerns senior leadershipAI-specific competence has no bearing on control effectivenessCompetence requirements are identical regardless of rolePeople need AI-specific understanding (e.g. of limitations, bias, oversight practices) to operate systems and controls effectively

What role does 'management oversight' play in an AI control environment?

Oversight only applies after a regulatory fineNone — controls run themselvesManagement is responsible for ensuring controls are resourced, monitored and acted uponOnly the board needs to be involved, never middle management

A hospital AI tool recommends a treatment priority but a clinician always follows it without independent judgement. What sector-specific issue does this raise?

A patient-safety and decision-support boundary issue, since the tool may be functioning as a de facto diagnostic decision-makerThis is a purely IT infrastructure issueThis only matters if the hospital is publicly fundedNo issue — following AI recommendations is always appropriate

What's a realistic consequence of poor supplier governance?

Supplier governance is optional for SaaS-based AI toolsNo consequence — suppliers are always trustworthyA supplier could change a model with no notice, degrading performance without the organisation knowingSupplier governance only affects cost, not risk

The OECD principle 'transparency and explainability' emphasises:

Keeping all AI system details secretProviding meaningful, accessible information about how a system works and whyOnly disclosing information to regulatorsApplies only to open-source models

Under the updated timeline enacted via the EU's 'Digital Omnibus' in 2026, when do Annex III high-risk use case obligations generally apply?

2 August 2026 as originally planned, unchanged2 December 20272 August 2028There is no defined date

What does the Act's 'cybersecurity' obligation for high-risk systems primarily address?

Cybersecurity is addressed solely by a separate, unrelated regulation with no AI Act linkPhysical building security onlyProtecting the AI system against attempts to exploit vulnerabilities that could compromise its behaviour or dataCybersecurity obligations apply only to GPAI models, not high-risk systems

What's the risk of skipping 'assumptions and constraints' documentation in MAP?

No risk — assumptions rarely matterKey unverified beliefs (e.g. about data quality or supplier practices) could quietly undermine the whole risk assessmentAssumptions are always self-evidently trueThis step is purely administrative

Which lawful basis is most likely appropriate for processing necessary to decide whether to enter a loan contract a customer has requested?

ConsentContractPublic taskLegitimate interests only, never contract

Why does US AI governance activity, per this course, include both federal and state-level components?

AI governance in the US has developed through a mix of federal initiatives and a growing patchwork of individual state lawsOnly federal law is relevant; states have no role in AI regulationUS states are legally barred from regulating AIThe US has no AI-specific governance activity at any level

What should an 'assurance dashboard' primarily show?

The org chartMarketing metricsControl health, open findings, trend and risk indicators at a glanceOnly the AI model's technical architecture

What should a management action plan for a finding always include?

Only a general statement of intentA specific action, an accountable owner, and a completion dateOnly the severity ratingThe auditor's personal opinion

How does a 'system card' differ from a 'model card'?

Model cards replace the need for testingThey are identical documentsA system card covers the broader AI system (architecture, data, safeguards); a model card focuses on a specific modelSystem cards only apply to hardware

A cited source doesn't actually support the claim made in the answer. This is a failure of:

Grounding and citation traceabilityDatabase rightsPurpose limitationData minimisation

What's a key governance trade-off between hosted and self-hosted deployment?

Self-hosting always eliminates the need for security controlsHosted deployment is always illegal under UK GDPRNo meaningful trade-off existsHosted deployment can mean less operational burden but less control over data location; self-hosting reverses that

Which best orders these from broadest to narrowest?

Deep learning > AI > generative AIMachine learning > AI > deep learningAI > machine learning > deep learning > generative AIGenerative AI > AI > machine learning

An umbrella (protection against a likely, low-severity event — rain) is often used to illustrate which risk concept?

That treatment should match the probability and severity of the specific risk, not be one-size-fits-allThat all risks should always be acceptedData minimisationRisk transfer only

A supplier's model was trained on scraped web content without clear licensing. This primarily raises a concern under:

Only procurement lawOnly health and safety lawCopyright and training data lawOnly employment law

What is an 'external communication plan' for AI incidents meant to define?

A synonym for the model cardNothing — communication should be improvisedWho is told what, when, by whom, and how uncertainty is acknowledged if a real-world impact occursOnly the internal engineering response

Why does 'AI ownership' need to be distinct from general IT ownership?

IT ownership is always sufficientAI ownership is a redundant conceptAI systems carry no distinct risk from other softwareAI systems raise specific risks (bias, hallucination, autonomy) that general IT ownership models may not cover

Self-check centre

Confidence