50 QUESTIONS · ALL 24 WEEKS

Standard mixed check

A balanced cross-syllabus session with at least two questions drawn from every syllabus week. Questions are original practice material aligned to this course syllabus; they are not copied from, endorsed by or represented as questions from an official certification exam.

WEEK 17 · AI law & privacy · EU AI Act Foundations and Global AI Law Landscape

A retailer in the supply chain makes a high-risk AI system available on the EU market without being the original provider or importer. Which role does this describe?

Affected personProduct manufacturerDeployerDistributor

WEEK 23 · Controls, operations & judgement · Sector Case Studies and Practitioner Judgement

A recruitment vendor's fairness testing only used labour-market data from one country. What's the practitioner concern if the tool is deployed elsewhere?

This only matters for public-sector recruitmentNo concern — fairness testing is universally generalisableThe testing evidence may not generalise to a different population or labour-market contextTesting location is irrelevant to fairness conclusions

WEEK 2 · Foundations, harm & law · Responsible AI, Trustworthy AI & Harm

When should a harm block a launch?

Never — harms are always accepted with monitoringWhen it is severe and/or probable enough that available controls can't reduce it to an acceptable levelOnly if a regulator has already fined someone for itOnly for generative AI systems

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

Which best reflects the relationship between leadership commitment (Clause 5) and Annex A control selection?

They are entirely unrelated activitiesLeadership commitment sets the direction and resourcing that makes meaningful Annex A control selection and operation possibleAnnex A controls are selected before any leadership involvementLeadership has no role in control selection

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

What's the difference between certification and implementation?

They're identicalImplementation is building the AIMS practices; certification is an optional external verification against the standardCertification must happen before any implementation workCertification guarantees fair AI outcomes

WEEK 7 · NIST AI RMF · NIST MAP

What does MAP's 'context' work primarily protect against?

Model training costsMarketing miscommunication onlyNothing — it's a formalityBuilding controls and tests for the wrong problem because the system's real use and risk weren't properly understood first

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

What does 'evidence' mean in a GRC context?

Something inspectable that demonstrates a control operated or a risk was properly assessedOnly relevant to court proceedingsA requirement only for third-party auditsA synonym for opinion

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

How does 'fairness' as a UK GDPR principle differ from simply having a lawful basis for processing?

Only lawfulness matters; fairness is not a separate UK GDPR principleThey are identical requirementsFairness concerns whether processing is reasonably expected and not unduly detrimental to the individual, which is a distinct question from whether a lawful basis technically existsFairness has no independent meaning beyond lawfulness

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Which is the best way to describe the relationship between Clause 4 scoping work and later Clause 8 operational controls?

They are entirely disconnected activitiesClause 4 scope defines what Clause 8 operational controls actually need to cover — controls should map back to the defined scopeClause 8 controls should be defined before Clause 4 scopeScope has no bearing on which systems need operational controls

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

A company documents its AIMS scope, policy and objectives but has never run an impact assessment on any deployed system. Which standard's practice is missing?

None — impact assessment isn't part of any of these standardsISO/IEC 22989ISO/IEC 42001ISO/IEC 42005

WEEK 1 · Foundations, harm & law · AI Foundations for Governance

What is a 'foundation model'?

A synonym for a spam filterAny model under 1GB in sizeA large model trained on broad data that can be adapted as a base for many downstream applicationsA model that only works offline

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

'Release gates' in MANAGE function as:

Only relevant to hardware releasesA synonym for a risk register entryOptional suggestions with no real effectDefined checkpoints that must be passed before a system can be released or scaled

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

Which is a leadership responsibility under Clause 5, not a purely operational task?

Setting AI policy and assigning roles, authorities and resourcesWriting the model's codeResponding to individual support ticketsManually reviewing every AI output

WEEK 11 · GenAI & agent security · Agentic AI, Prompt Injection and AI Security Controls

Why do 'tool permissions' need periodic review, not just a one-time setup?

Reviewing permissions is purely a cost-saving exercise with no security valueTool permissions never need to change once setAs an agent's use case evolves, permissions granted for an earlier purpose may become excessive or stalePeriodic review only applies to human user accounts

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

Between a small, single-purpose model and a large, general-purpose model, which factor most matters for a narrow, well-defined task?

A smaller, purpose-built model can often perform as well or better on a narrow task with lower cost and easier evaluationSmall models cannot be evaluated for accuracyLarge models are always cheaper to runAlways choose the largest model regardless of task

WEEK 8 · NIST AI RMF · NIST MEASURE

'Human oversight testing' evaluates:

Whether human review is genuinely effective at catching errors and being able to change outcomesOnly staff satisfaction with the toolOnly the number of reviewers employedWhether a human technically exists in the workflow

WEEK 24 · Controls, operations & judgement · Mock Exam, Capstone Evidence Pack and Final Viva

Why does an evidence-pack index need to state each artefact's relevance to the final decision, not just its title?

This only matters for artefacts marked 'incomplete'Relevance statements are unnecessary paddingIt shows the reviewer why each artefact matters to the actual conclusion, not just that it existsTitles alone are always sufficient for an index

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Why would 'supplier controls' appear within Clause 8 operation rather than only in Annex A's third-party theme?

Because managing suppliers is an ongoing operational activity (not just a one-time control selection), it belongs in Clause 8's operational scope tooClause 8 and Annex A never overlap in subject matterSupplier controls are exclusively a Clause 5 leadership matterSupplier controls have no place in Clause 8 at all

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Which best describes 'needs and expectations' of interested parties in Clause 4 terms?

A fixed, universal list identical for every organisationA synonym for financial targetsWhat each interested party requires or expects from how the organisation governs AI, which the AIMS should account forOnly the needs of the AI development team

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Clause 4 requires understanding which two categories of issues?

Internal and external issues affecting the AIMSOnly external issuesOnly issues raised by regulatorsFinancial and marketing issues

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

How should 'objectives and measurement' under Clause 6 be reviewed after a significant AI incident?

Incidents are irrelevant to Clause 6 objective-settingOnly Clause 10 addresses incidents, with no link back to Clause 6 objectivesObjectives should never be revisited after an incidentThe incident should prompt a review of whether existing objectives and measures adequately addressed the risk that materialised, adjusting them if not

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

Segregation of duties in AI governance most directly reduces the risk of:

Slower model trainingOne person having unchecked control over both building and approving a systemHigher cloud hosting costsLonger documentation

WEEK 11 · GenAI & agent security · Agentic AI, Prompt Injection and AI Security Controls

What defines an 'AI agent' as distinct from a standard chatbot?

An agent can take actions via tools, not just generate text responsesChatbots always use larger models than agentsThere is no meaningful distinctionAgents are always faster than chatbots

WEEK 5 · NIST AI RMF · NIST AI RMF Overview and OECD AI Principles

A leader says: 'We just follow the law, we don't need frameworks.' What's the issue with this view?

There is no issue; law is always sufficientLaws often set outcomes without prescribing how to achieve them; frameworks give practical structure to meet those outcomesFrameworks are illegal to use alongside lawFrameworks always conflict with legal requirements

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

A 'localisation/geographic restriction policy' addresses:

Only applies to hardwareOnly translation qualityRestricting where data or system operation occurs, often for legal or risk reasonsOnly marketing localisation

WEEK 4 · Foundations, harm & law · AI and the Wider Legal Landscape

Why does this course emphasise that 'AI law is broader than privacy'?

Because other legal domains are always less important than privacyBecause privacy law is the only relevant domain in practiceBecause IP, equality, consumer, contract, liability and sector law can all independently create AI risk, beyond data protectionBecause privacy law doesn't apply to AI at all

WEEK 24 · Controls, operations & judgement · Mock Exam, Capstone Evidence Pack and Final Viva

How should 'wider legal issues' (beyond privacy) be handled in a capstone-style scenario?

Actively screened for — IP, equality, consumer protection, liability and sector duties can all be relevant depending on the factsAssumed to never apply to AI systemsOnly relevant for public-sector scenariosIgnored unless the question is explicitly about privacy

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

How does ISO/IEC 42005 relate to NIST AI RMF's MAP function?

MAP is a certifiable standard like 42005They are unrelatedBoth involve understanding context and impacts on affected people, though structured differently42005 replaces MAP entirely

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

What is a 'management system' in the ISO sense, as distinct from a single policy document?

A structured, repeatable set of interrelated processes an organisation uses to achieve objectives and manage risk, including planning, operation, evaluation and improvementOnly the software used to track complianceA one-time audit checklistA synonym for a policy

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

How does a 'risk' differ from an 'incident'?

Incidents are always less serious than risksRisks only exist after an incident has happenedThey are identical termsA risk is a possible future event with uncertain outcome; an incident is something that has already occurred

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Why is 'competence' under Clause 7 relevant specifically to people operating AI systems, not just general staff training?

Competence under Clause 7 only concerns senior leadershipAI-specific competence has no bearing on control effectivenessCompetence requirements are identical regardless of rolePeople need AI-specific understanding (e.g. of limitations, bias, oversight practices) to operate systems and controls effectively

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

What role does 'management oversight' play in an AI control environment?

Oversight only applies after a regulatory fineNone — controls run themselvesManagement is responsible for ensuring controls are resourced, monitored and acted uponOnly the board needs to be involved, never middle management

WEEK 23 · Controls, operations & judgement · Sector Case Studies and Practitioner Judgement

A hospital AI tool recommends a treatment priority but a clinician always follows it without independent judgement. What sector-specific issue does this raise?

This is a purely IT infrastructure issueThis only matters if the hospital is publicly fundedNo issue — following AI recommendations is always appropriateA patient-safety and decision-support boundary issue, since the tool may be functioning as a de facto diagnostic decision-maker

WEEK 6 · NIST AI RMF · NIST GOVERN

What's a realistic consequence of poor supplier governance?

Supplier governance only affects cost, not riskSupplier governance is optional for SaaS-based AI toolsNo consequence — suppliers are always trustworthyA supplier could change a model with no notice, degrading performance without the organisation knowing

WEEK 5 · NIST AI RMF · NIST AI RMF Overview and OECD AI Principles

The OECD principle 'transparency and explainability' emphasises:

Only disclosing information to regulatorsApplies only to open-source modelsKeeping all AI system details secretProviding meaningful, accessible information about how a system works and why

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

Under the updated timeline enacted via the EU's 'Digital Omnibus' in 2026, when do Annex III high-risk use case obligations generally apply?

2 August 2026 as originally planned, unchanged2 December 20272 August 2028There is no defined date

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

What does the Act's 'cybersecurity' obligation for high-risk systems primarily address?

Cybersecurity obligations apply only to GPAI models, not high-risk systemsCybersecurity is addressed solely by a separate, unrelated regulation with no AI Act linkPhysical building security onlyProtecting the AI system against attempts to exploit vulnerabilities that could compromise its behaviour or data

WEEK 7 · NIST AI RMF · NIST MAP

What's the risk of skipping 'assumptions and constraints' documentation in MAP?

No risk — assumptions rarely matterKey unverified beliefs (e.g. about data quality or supplier practices) could quietly undermine the whole risk assessmentAssumptions are always self-evidently trueThis step is purely administrative

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

Which lawful basis is most likely appropriate for processing necessary to decide whether to enter a loan contract a customer has requested?

ContractPublic taskLegitimate interests only, never contractConsent

WEEK 17 · AI law & privacy · EU AI Act Foundations and Global AI Law Landscape

Why does US AI governance activity, per this course, include both federal and state-level components?

AI governance in the US has developed through a mix of federal initiatives and a growing patchwork of individual state lawsOnly federal law is relevant; states have no role in AI regulationUS states are legally barred from regulating AIThe US has no AI-specific governance activity at any level

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What should an 'assurance dashboard' primarily show?

Control health, open findings, trend and risk indicators at a glanceOnly the AI model's technical architectureThe org chartMarketing metrics

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What should a management action plan for a finding always include?

Only the severity ratingThe auditor's personal opinionOnly a general statement of intentA specific action, an accountable owner, and a completion date

WEEK 8 · NIST AI RMF · NIST MEASURE

How does a 'system card' differ from a 'model card'?

System cards only apply to hardwareModel cards replace the need for testingThey are identical documentsA system card covers the broader AI system (architecture, data, safeguards); a model card focuses on a specific model

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

A cited source doesn't actually support the claim made in the answer. This is a failure of:

Database rightsPurpose limitationData minimisationGrounding and citation traceability

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What's a key governance trade-off between hosted and self-hosted deployment?

Self-hosting always eliminates the need for security controlsHosted deployment is always illegal under UK GDPRNo meaningful trade-off existsHosted deployment can mean less operational burden but less control over data location; self-hosting reverses that

WEEK 1 · Foundations, harm & law · AI Foundations for Governance

Which best orders these from broadest to narrowest?

AI > machine learning > deep learning > generative AIGenerative AI > AI > machine learningDeep learning > AI > generative AIMachine learning > AI > deep learning

WEEK 2 · Foundations, harm & law · Responsible AI, Trustworthy AI & Harm

An umbrella (protection against a likely, low-severity event — rain) is often used to illustrate which risk concept?

That treatment should match the probability and severity of the specific risk, not be one-size-fits-allThat all risks should always be acceptedData minimisationRisk transfer only

WEEK 4 · Foundations, harm & law · AI and the Wider Legal Landscape

A supplier's model was trained on scraped web content without clear licensing. This primarily raises a concern under:

Only health and safety lawCopyright and training data lawOnly employment lawOnly procurement law

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What is an 'external communication plan' for AI incidents meant to define?

Who is told what, when, by whom, and how uncertainty is acknowledged if a real-world impact occursOnly the internal engineering responseA synonym for the model cardNothing — communication should be improvised

WEEK 6 · NIST AI RMF · NIST GOVERN

Why does 'AI ownership' need to be distinct from general IT ownership?

AI systems raise specific risks (bias, hallucination, autonomy) that general IT ownership models may not coverIT ownership is always sufficientAI ownership is a redundant conceptAI systems carry no distinct risk from other software

Self-check centre

Confidence