Learn with GAICC : ISO-IEC-42001-Foundation training material for 100% pass

A workshop exercise asks foundation candidates to evaluate four candidate sentences for inclusion in a one- page AI policy at an e-commerce retailer. The retailer uses AI for product recommendations, fraud detection, and customer-service triage. The intent is to capture a single sentence that aligns with the four attributes Clause 5.2 requires. Which sentence is the BEST single-line expression of those Clause 5.2 attributes?

• A. The retailer commits to certifying every AI system it deploys against ISO/IEC 42001 within a twelve- month window, with surveillance audits scheduled annually thereafter under the chosen third-party certification body for each system in operation.
• B. The retailer ' s recommendation engine will be retrained every fortnight using the most recent behavioural data from logged-in customers, and the fraud-detection model will be retuned monthly to reflect emerging patterns of attempted account compromise.
• C. The retailer will appoint an AI ethics committee composed of representatives from product, engineering, legal, and marketing with quarterly meetings, decisions recorded, and an annual report submitted to the board ' s risk subcommittee.
• D. The retailer will manage its AI systems in a manner appropriate to its purpose, satisfy applicable requirements, set and pursue measurable AI objectives, and continually improve its AI management system in line with this policy.

A regional bank is preparing for its first ISO/IEC 42001 internal audit. The chief operating officer explains that the bank has an AIMS RACI matrix on a shared drive, but few staff have seen it; team leads in data science, risk, and customer operations are uncertain who is accountable for reporting AIMS performance to top management. The internal auditor flags this as a likely Clause 5.3 concern. Which corrective approach BEST addresses what Clause 5.3 actually requires?

• A. Formally assign and communicate the responsibilities and authorities for AIMS conformance and for performance reporting to top management, then confirm in writing that affected staff understand their specific role in the AI management system.
• B. Append the RACI matrix as an annex to the AI policy document and recirculate the combined policy for re-acknowledgement, since combining the two records will satisfy the documentation expectation under Clause 7.5 for related governance artefacts.
• C. Move the RACI matrix to a more secure folder, restrict edit rights to senior managers, and add a version history log so that change control over the matrix can be evidenced more cleanly during the next internal audit cycle.
• D. Schedule a workshop for the data-science team to revise the AI risk register, on the basis that stronger risk records will indirectly make AIMS roles and responsibilities easier for team leads to interpret in their day-to-day work.

A foundation case workshop closes with a scenario in which a charity is about to launch an AI tool that helps caseworkers prioritise vulnerable-client outreach. The AIMS lead is asked which set of considerations the launch checklist should reflect, drawing on the responsible-AI principles in ISO/IEC 42001 Annex B together with the relevant management-system clauses. Which response BEST integrates the standard ' s expectations for a deployment of this kind?

• A. Confirm that the vendor has provided a model card, treat that document as a complete responsible-AI record for the deployment, and rely on the vendor ' s representations rather than performing an internal review of the model ' s fitness for the charity ' s specific population of clients.
• B. Verify the model ' s predictive accuracy meets the agreed target, document the result in a one-page summary signed by the head of technology, and proceed to launch without further reference to other responsible-AI considerations for this charitable use case.
• C. Complete an AI System Impact Assessment under Clause 6.1.4 covering fairness, transparency, human oversight, privacy, and safety considerations, define acceptance criteria, assign role responsibilities, and gain documented approval before launch.
• D. Postpone any structured impact assessment until after the first quarter of operational data has been gathered, on the basis that the charity will be better placed to evaluate impact once real-world caseworker usage patterns and outcome distributions have been observed.

A documentation lead is preparing a one-page reference for new joiners that names the four annexes of ISO
/IEC 42001 and their purpose. She wants the description that aligns with GAICC Foundation Module 3.
Which option BEST matches the role of each annex in the standard?

• A. Annex A is a published list of certified consultants; Annex B is the official EU AI Act mapping; Annex C is a sample AI policy template; Annex D is the standard ' s revision history log.
• B. Annex A is the reference control set; Annex B is implementation guidance; Annex C catalogues AI- related objectives and risk sources; Annex D shows integration with other management system standards.
• C. Annex A maps ISO/IEC 42001 to ISO 9001 directly; Annex B is a vocabulary appendix; Annex C is a sample Statement of Applicability; Annex D is a glossary of regional AI regulations.
• D. Annex A is a list of accredited certification bodies; Annex B is a Stage 2 audit checklist; Annex C is a Statement of Applicability template; Annex D is a financial impact assessment model.

+-----------------------------------------------------------------------------------------------+
| Choosduct manager responsible for the deployed AI system, since they direct day-to- |
| day operations and have the most direct view of AI model behaviour and incidents. |
+-----------------------------------------------------------------------------------------------+ A compliance team is mapping ISO/IEC 42001 Clause 3 terms to everyday business language for an internal onboarding wiki. They are debating who counts as ' top management ' under the standard, because the term governs which roles inherit Clause 5.1 leadership duties. According to GAICC Foundation Module 3, which option BEST reflects the Clause 3 definition of top management?

• A. The product manager responsible for the deployed AI system, since they direct day-to-day operations and have the most direct view of AI model behaviour and incidents.
• B. The third-party certification body ' s lead auditor, since the auditor exercises decisive authority over whether the AIMS satisfies ISO/IEC 42001 during a Stage 2 audit.
• C. Any line manager with budget authority over an AI initiative, since top management refers to the manager who funds the AI project rather than to enterprise leadership.
• D. The person or group of people who directs and controls an organisation at the highest level and has the authority to delegate and provide resources within it.