AI Governance and Responsible AI Leadership

97. A recruitment AI tool is found to score candidates from certain postcodes lower, and postcode correlates with a protected characteristic. Which response is most appropriate?

1. A Increase the training dataset size and redeploy without further analysis
2. B Treat it as a fairness and proxy-variable issue: assess the feature's role, remove or mitigate the proxy, and re-evaluate before continued use
3. C Disclose the behaviour in the terms of service and continue
4. D Continue using the tool because postcode is not itself a protected characteristic

98. An organization is establishing AI governance. Which structure most effectively balances innovation with risk control?

1. A No formal governance, relying on team judgement
2. B Governance owned solely by the engineering organization
3. C A cross-functional governance body defining risk tiers, with lighter approval for low-risk uses and structured review for high-risk decisions affecting people
4. D A single approval gate requiring executive sign-off for every AI use case

99. Under the AWS shared responsibility model applied to a generative AI application on Amazon Bedrock, which responsibility belongs to the customer?

1. A Patching the physical infrastructure hosting the models
2. B Securing the data centre facilities
3. C Maintaining the hypervisor underlying the service
4. D Deciding what data is sent in prompts, configuring guardrails, and controlling who may access the application

100. Which governance structure best balances speed with control across many AI initiatives?

1. A No central review, with each team self-certifying
2. B Risk-tiered review, with lightweight approval for low-risk uses and structured review for decisions materially affecting people
3. C A single committee reviewing every AI use case in detail
4. D Review only after an initiative reaches production

101. An AI system will influence decisions about individuals' access to a service. Which control should be mandatory?

1. A Quarterly sampling of outputs for quality
2. B A documented human review path with authority to override, and a record of the basis for each decision
3. C A higher confidence threshold before the model acts
4. D A disclaimer that AI was involved

102. A model uses a feature that correlates strongly with a protected characteristic although the characteristic itself is excluded. What is the governance concern?

1. A A performance concern only
2. B Proxy discrimination, where the outcome is effectively differentiated by the protected characteristic despite its formal exclusion
3. C An intellectual property concern
4. D No concern, because the characteristic was excluded

103. Which documentation most helps a reviewer decide whether a model is appropriate for a proposed new use?

1. A The model's source code repository
2. B A model card recording intended use, limitations, evaluation results, and known failure modes
3. C The training infrastructure cost report
4. D The number of parameters in the model

104. A third-party AI vendor processes customer data on the company's behalf. Which governance step is essential?

1. A Contractual and technical due diligence on how the vendor handles, retains, and uses that data, including whether it trains on it
2. B Checking the vendor's marketing claims about accuracy
3. C Verifying the vendor's user interface is accessible
4. D Confirming the vendor uses a well-known foundation model

105. An organization must prepare for regulatory scrutiny of its AI systems. Which practice most improves its position?

1. A Keeping AI use confidential to limit exposure
2. B Publishing the model weights
3. C Maintaining an inventory of AI systems with their risk classification, owners, data sources, and evaluation evidence
4. D Delegating all responsibility to the technology vendor

106. An AI incident occurs when a customer-facing assistant gives harmful advice. What should the organization have in place beforehand?

1. A A disclaimer in the terms of service
2. B An AI incident response process defining detection, escalation, containment, communication, and post-incident review
3. C A general IT outage runbook
4. D A quarterly model retraining schedule

107. Which measure best supports transparency with customers interacting with an AI assistant?

1. A Reporting the assistant's uptime
2. B Publishing the model's architecture
3. C Listing the AWS Regions used
4. D Clear disclosure that they are interacting with an AI system, and a route to reach a human

108. Which risk is specific to generative AI and requires explicit management in a customer-facing deployment?

1. A Hallucination, where the system produces fluent but unfounded content
2. B Software licence expiry
3. C Network latency
4. D Server capacity limits

109. A company is concerned about intellectual property in content produced by a generative system. What should it establish?

1. A Clear policy on ownership, permitted training and input data, and provider indemnification terms in the contract
2. B A rule that all AI output must be rewritten by a human
3. C A requirement to publish all AI-generated content
4. D A prohibition on using generative AI

110. A model in production was trained two years ago and the provider has announced its deprecation. What governance practice should have anticipated this?

1. A Avoiding managed models entirely
2. B Tracking model lifecycle and dependency risk in the AI inventory, with a planned migration and re-evaluation path
3. C Relying on the provider to maintain the model indefinitely
4. D Freezing the application so it never needs updating

111. Which practice most reduces the risk that employees paste confidential information into external AI tools?

1. A A policy prohibiting all AI use
2. B Relying on employees' judgement alone
3. C An approved-tool policy with sanctioned alternatives that meet the need, supported by training and technical controls
4. D Monitoring employees without providing alternatives

112. A board asks for regular reporting on AI risk. What content is most useful?

1. A The number of models deployed
2. B The inventory of systems by risk tier, incidents and near misses, control coverage, and open remediation items
3. C A summary of the underlying technology
4. D The total AI spend for the period

113. Which control addresses the risk that an AI system's performance degrades silently after deployment?

1. A An annual model review
2. B Continuous monitoring of output quality and input distribution, with thresholds that trigger review or retraining
3. C A disclaimer to users
4. D A thorough pre-deployment test suite

114. An AI system will make recommendations that materially affect individuals in more than one country. What should governance establish first?

1. A Which model has the highest benchmark score
2. B Which jurisdictions' requirements apply and what obligations they impose on the system's design, documentation, and oversight
3. C The user interface language
4. D The cheapest Region in which to run inference

115. Which statement about consent and data use is most accurate for training or customizing an AI model on customer data?

1. A The original purpose for which the data was collected constrains whether it may be used for model training
2. B Anonymizing data removes all obligations
3. C Consent is required only for generative use cases
4. D Any data the company holds may be used for any purpose

116. Which approach best manages the risk of over-reliance on an AI system by the people using it?

1. A Increase the system's accuracy until reliance is safe
2. B Require users to accept a liability waiver
3. C Design the interface to show uncertainty and sources, and train users on the system's known failure modes
4. D Remove all indication that AI is involved

117. An AI vendor will not disclose how its model was trained or evaluated. What should the strategist conclude?

1. A The vendor must be hiding a defect
2. B Non-disclosure is standard and carries no implication
3. C The organization cannot fully assess the risk, and this should be weighed explicitly in the decision and reflected in contractual protections
4. D Technical due diligence is unnecessary for purchased systems

118. Which practice supports accountability when an AI system contributes to a decision that is later challenged?

1. A Retaining the output for 30 days
2. B Recording the inputs, model and prompt versions, output, and the human decision made, in a retrievable form
3. C Recording the final decision only
4. D Relying on the model provider's logs

119. Which consideration belongs in an AI governance framework but is often omitted?

1. A A defined process for retiring or rolling back an AI system that is no longer performing or appropriate
2. B A list of approved model vendors
3. C A naming convention for models
4. D A budget approval threshold

120. An AI governance body is being formed. Which composition is most appropriate?

1. A Technical leaders only, since they understand how the systems work
2. B A single executive who makes all AI decisions
3. C Cross-functional representation including business, technical, legal, and compliance, with clear accountability
4. D Legal and compliance only, since the main risks are regulatory

121. Why does an organization apply a risk classification framework to its AI systems?

1. A To rank AI systems by how much compute they consume
2. B To determine which systems should be built first
3. C To decide which vendor to purchase from
4. D To direct governance effort toward the systems whose failure would cause the most harm

122. A business process that uses AI is subject to sector regulation. What should be established before the system is deployed?

1. A Which foundation model the system will use
2. B Which regulatory obligations apply and how the system will demonstrate compliance with them
3. C How many users the system will support at launch
4. D The system's expected response latency

123. At which stages of the AI lifecycle can bias be introduced?

1. A Only during model training
2. B Only after the system is deployed
3. C Only during data collection
4. D At several stages including data collection, labelling, model training, and deployment

124. An organization uses a generative AI system to produce marketing copy. Which intellectual property risk should be managed?

1. A The organization may lose the copyright to its own brand name
2. B The model's weights may become the organization's property
3. C Generated content may reproduce protected material, and ownership of the output may be unclear
4. D The vendor may claim ownership of the organization's customer data

125. A business decision must balance a model's accuracy against its explainability. Which consideration should drive the decision?

1. A Which model the technical team prefers
2. B Which model is cheaper to run
3. C Whether the decision's consequences and any regulatory obligation require an explanation that the more accurate model cannot provide
4. D Which model was released more recently

126. An AI system's outputs affect individuals differently depending on their demographic group. Which responsible AI principle is engaged?

1. A Transparency
2. B Robustness
3. C Fairness
4. D Privacy

127. A generative AI system must be prevented from producing content that breaches the organization's policy. Which control belongs in the design?

1. A A quarterly review of the system's outputs
2. B Automated guardrails evaluating input and output, with escalation to a human for cases the guardrail flags as uncertain
3. C An instruction in the system prompt
4. D A written policy circulated to the development team

128. An organization must decide where human oversight is required in an AI-enabled process. Which approach is appropriate?

1. A Remove oversight once the system reaches a target accuracy
2. B Place oversight where the consequence of an error is highest, rather than applying it uniformly
3. C Apply oversight only when a complaint is received
4. D Apply oversight to every decision the system makes

129. An AI governance framework must define accountability for a deployed system. Which element is required?

1. A A list of the technologies the system uses
2. B A named owner accountable for the system's behaviour, with defined escalation paths
3. C A record of the system's deployment date
4. D A count of the system's users

130. An AI system processes personal data in several jurisdictions with differing requirements. Which approach is appropriate?

1. A Identify the applicable requirements per jurisdiction and design controls meeting the strictest that applies to each data flow
2. B Defer the question until a regulator raises it
3. C Apply the least restrictive requirements to simplify the design
4. D Apply the requirements of the organization's home jurisdiction everywhere

131. An AI system's risk classification must determine the governance applied to it. Which factors should the classification consider?

1. A The cost of running the system
2. B The technology stack the system uses
3. C The consequence of an incorrect output, the sensitivity of the data involved, and the degree of autonomy the system has
4. D The number of users the system serves

132. Which governance practice applies across the whole AI lifecycle rather than at a single point?

1. A Auditing the system annually
2. B Reviewing the system at defined checkpoints from problem framing through data, development, deployment, and ongoing operation
3. C Approving the system before its initial launch
4. D Reviewing the system when it is decommissioned

133. An AI system's performance has degraded since deployment although its code has not changed. Which risk does this describe?

1. A A licensing expiry
2. B Model drift, where the relationship between inputs and outcomes changes over time
3. C A software defect introduced by a release
4. D An infrastructure capacity shortage

134. Employees are using public generative AI tools with company information. Which risk is most significant?

1. A Reduced employee productivity
2. B Confidential information leaving the organization's control and potentially being retained by a third party
3. C Slower response times for those employees
4. D Increased spend on the organization's cloud bill

135. An AI system's training data is found to contain content the organization does not have rights to use. Which risk does this create?

1. A Increased training cost
2. B Legal exposure from using the content and potentially from the model's outputs derived from it
3. C Reduced model accuracy
4. D Slower inference

136. An organization must decide what to monitor to detect emerging AI risks after deployment. Which combination is appropriate? (Select TWO.)

1. A The system's hourly infrastructure cost
2. B Patterns indicating misuse or attempts to manipulate the system
3. C The number of models the organization has deployed
4. D Output quality against a defined standard, so degradation is visible
5. E The total number of requests the system receives

137. An AI governance framework must define how exceptions to policy are handled.

1. A Handle exceptions informally as they arise
2. B Prohibit exceptions entirely
3. C Define who may approve an exception, on what basis, and for how long, with the exception recorded and reviewed
4. D Allow each business unit to approve its own exceptions

138. Which element must an AI governance framework define for a system that makes decisions affecting customers?

1. A The route by which an affected customer can contest a decision and obtain human review
2. B The model architecture the system uses
3. C The team that built the system
4. D The infrastructure the system runs on

139. Which enterprise risk arises when several business units deploy AI independently without coordination?

1. A Reduced model accuracy
2. B Higher infrastructure cost only
3. C Inconsistent controls and duplicated effort, with no single view of the organization's aggregate AI risk
4. D Slower model inference

140. An AI system's supplier has changed the underlying model without notice. Which risk does this create?

1. A The system will stop functioning entirely
2. B The system's behaviour may change without the organization's knowledge, invalidating prior evaluation and approval
3. C The system's data will be lost
4. D The system's infrastructure cost will increase