GAICC ISO/IEC 42001 Foundation : ISO-IEC-42001-Foundation

An education provider uses an AI plagiarism-detection tool supplied by a third-party vendor. A student is flagged incorrectly and appeals. The teacher refers the matter to the IT helpdesk, the helpdesk refers it to the procurement team, procurement refers it to the vendor, and the vendor refers it back to the institution. The student receives no clear response for several weeks. Which issue BEST reflects an accountability weakness under the responsible-AI principles in ISO/IEC 42001?

• A. The vendor should be considered solely accountable for the misclassification because the model was developed and trained externally, and the institution is therefore a passive consumer of the vendor ' s pre-built classification capability for student submissions.
• B. No specific role inside the institution has been assigned responsibility for AI-system outcomes experienced by users, so the appeal cannot be addressed end to end-a gap inconsistent with the accountability principle and with Clause 5.3 role assignment.
• C. Accountability is adequate because each team in the referral chain followed its own internal procedure, and procedural compliance by individual teams demonstrates that responsibility has been appropriately distributed across the institution.
• D. The student should be required to escalate the appeal through a formal external regulator rather than through the institution, as external regulators are better placed than internal staff to adjudicate AI- related complaints raised by individual learners.

A logistics company has implemented an AI system that recommends staffing levels for warehouse shifts. The user interface shows each recommendation with an ' Approve ' button. In practice, shift managers approve every recommendation within seconds because the system rarely surfaces context, and the interface does not let managers see the inputs that drove the decision. Reviewing this for responsible-AI conformance, which observation BEST reflects the human-oversight principle from ISO/IEC 42001 Annex B?

• A. Human oversight should be removed in favour of fully automated approvals on grounds of consistency, with sample audits performed monthly by the operations team to verify that the system ' s recommendations remain reasonable across the warehouse network over time.
• B. The approve-button workflow satisfies human-oversight expectations because a human is in the loop for every staffing decision, and the speed of approvals reflects the efficiency gains of well-designed AI tooling rather than a control weakness in the deployed interface.
• C. The oversight is not meaningful because managers lack the information and context needed to challenge or override the recommendation, so the design provides the appearance of human control without the substance Annex B ' s human-oversight principle expects.
• D. Human oversight is not engaged here because shift staffing is a low-risk operational decision; Annex B
  ' s oversight principle applies primarily to high-risk AI systems such as those that affect safety or fundamental rights, so the interface design issue is immaterial.

A foundation workshop case describes a small financial-advisory firm that has just signed its AI policy. The compliance officer asks what the firm should do next to translate the policy into operational practice for a new portfolio-recommendation AI tool the firm is preparing to deploy. Which next step BEST reflects how ISO
/IEC 42001 expects policy to connect to planning and operations for a specific AI system?

• A. Re-sign the AI policy in front of staff at the next quarterly town-hall meeting to demonstrate leadership commitment, on the basis that visible re-signing reinforces the message conveyed by the original signature at policy adoption.
• B. Print and laminate the signed policy for display in the office reception area, then distribute copies to each adviser ' s desk so that the document is visible during client meetings held in the firm ' s premises across the next quarter.
• C. Conduct an AI risk assessment under Clause 6.1.2 and an AI System Impact Assessment under Clause
  6.1.4 for the portfolio-recommendation tool, then plan risk treatment with controls aligned to the policy' s commitments.
• D. Defer further action until the firm has accumulated several months of live experience with the portfolio- recommendation tool, on the basis that risk and impact assessments are more accurate when informed by post-deployment operational data points.

A board director asks: ' Why should we invest in ISO/IEC 42001 certification rather than simply publishing an internal AI ethics statement? ' The Chief AI Officer responds by listing the drivers that motivated publication of the standard. Which option BEST summarises the main drivers behind ISO/IEC 42001 as presented in GAICC Foundation Module 1?

• A. Converging regulatory, commercial, reputational, and operational pressures around AI-including new AI laws, procurement scrutiny, public AI failures, and consequential AI decisions.
• B. Pressure from professional indemnity insurers, who require ISO/IEC 42001 certification as a precondition for issuing technology errors-and-omissions policies to AI software vendors worldwide.
• C. A directive from the International Telecommunication Union requiring each member state to publish a national AI register before the end of 2026, with a binding regional reporting cycle.
• D. A specific request from the World Trade Organization to harmonise tariff treatment for AI-enabled goods and services across the major trading blocs by the end of the year 2026.

+-----------------------------------------------------------------------------------------------+
| Choosduct manager responsible for the deployed AI system, since they direct day-to- |
| day operations and have the most direct view of AI model behaviour and incidents. |
+-----------------------------------------------------------------------------------------------+ A compliance team is mapping ISO/IEC 42001 Clause 3 terms to everyday business language for an internal onboarding wiki. They are debating who counts as ' top management ' under the standard, because the term governs which roles inherit Clause 5.1 leadership duties. According to GAICC Foundation Module 3, which option BEST reflects the Clause 3 definition of top management?

• A. The person or group of people who directs and controls an organisation at the highest level and has the authority to delegate and provide resources within it.
• B. Any line manager with budget authority over an AI initiative, since top management refers to the manager who funds the AI project rather than to enterprise leadership.
• C. The third-party certification body ' s lead auditor, since the auditor exercises decisive authority over whether the AIMS satisfies ISO/IEC 42001 during a Stage 2 audit.
• D. The product manager responsible for the deployed AI system, since they direct day-to-day operations and have the most direct view of AI model behaviour and incidents.