A board director asks: ' Why should we invest in ISO/IEC 42001 certification rather than simply publishing an internal AI ethics statement? ' The Chief AI Officer responds by listing the drivers that motivated publication of the standard. Which option BEST summarises the main drivers behind ISO/IEC 42001 as presented in GAICC Foundation Module 1?

• A. A directive from the International Telecommunication Union requiring each member state to publish a national AI register before the end of 2026, with a binding regional reporting cycle.
• B. A specific request from the World Trade Organization to harmonise tariff treatment for AI-enabled goods and services across the major trading blocs by the end of the year 2026.
• C. Pressure from professional indemnity insurers, who require ISO/IEC 42001 certification as a precondition for issuing technology errors-and-omissions policies to AI software vendors worldwide.
• D. Converging regulatory, commercial, reputational, and operational pressures around AI-including new AI laws, procurement scrutiny, public AI failures, and consequential AI decisions.

+-----------------------------------------------------------------------------------------------+
| Choosduct manager responsible for the deployed AI system, since they direct day-to- |
| day operations and have the most direct view of AI model behaviour and incidents. |
+-----------------------------------------------------------------------------------------------+ A compliance team is mapping ISO/IEC 42001 Clause 3 terms to everyday business language for an internal onboarding wiki. They are debating who counts as ' top management ' under the standard, because the term governs which roles inherit Clause 5.1 leadership duties. According to GAICC Foundation Module 3, which option BEST reflects the Clause 3 definition of top management?

• A. The person or group of people who directs and controls an organisation at the highest level and has the authority to delegate and provide resources within it.
• B. The third-party certification body ' s lead auditor, since the auditor exercises decisive authority over whether the AIMS satisfies ISO/IEC 42001 during a Stage 2 audit.
• C. The product manager responsible for the deployed AI system, since they direct day-to-day operations and have the most direct view of AI model behaviour and incidents.
• D. Any line manager with budget authority over an AI initiative, since top management refers to the manager who funds the AI project rather than to enterprise leadership.

A logistics company has implemented an AI system that recommends staffing levels for warehouse shifts. The user interface shows each recommendation with an ' Approve ' button. In practice, shift managers approve every recommendation within seconds because the system rarely surfaces context, and the interface does not let managers see the inputs that drove the decision. Reviewing this for responsible-AI conformance, which observation BEST reflects the human-oversight principle from ISO/IEC 42001 Annex B?

• A. The approve-button workflow satisfies human-oversight expectations because a human is in the loop for every staffing decision, and the speed of approvals reflects the efficiency gains of well-designed AI tooling rather than a control weakness in the deployed interface.
• B. Human oversight should be removed in favour of fully automated approvals on grounds of consistency, with sample audits performed monthly by the operations team to verify that the system ' s recommendations remain reasonable across the warehouse network over time.
• C. The oversight is not meaningful because managers lack the information and context needed to challenge or override the recommendation, so the design provides the appearance of human control without the substance Annex B ' s human-oversight principle expects.
• D. Human oversight is not engaged here because shift staffing is a low-risk operational decision; Annex B
  ' s oversight principle applies primarily to high-risk AI systems such as those that affect safety or fundamental rights, so the interface design issue is immaterial.

A travel platform plans to train a recommendation model on five years of customer booking history, including names, contact details, and trip itineraries. The data-protection officer raises concerns about training-data use.
The AI governance lead is asked how ISO/IEC 42001 treats the relationship between AI management and personal-data protection. Which response BEST reflects the standard ' s intent on privacy as a responsible-AI consideration?

• A. The AIMS should record an exception noting that training data is exempt from privacy review on grounds of model improvement, since pursuit of model accuracy provides a legitimate operational basis for the platform ' s use of historical booking information in training.
• B. Personal-data protection is a relevant input to the AI System Impact Assessment under Clause 6.1.4, and the AIMS should coordinate with applicable privacy obligations rather than treating data protection as a separate concern outside the scope of AI governance.
• C. Personal-data protection sits entirely outside the AIMS because ISO/IEC 42001 governs AI systems and applicable privacy laws govern personal data, so the two regimes operate independently with no expectation of coordination across them.
• D. The AI governance lead should remove privacy considerations from the AI System Impact Assessment scope and refer them to the privacy officer for a parallel assessment, with no formal linkage between the two assessment processes maintained within the AIMS records.

A small insurance firm is performing its first context analysis under Clause 4.1 of ISO/IEC 42001. The compliance lead lists the factors the team should consider. Which item BEST illustrates an EXTERNAL issue relevant to the AIMS, consistent with GAICC Foundation Module 4?

• A. The forthcoming enforcement of regional AI legislation, such as the EU AI Act, and evolving public expectations about transparency in automated insurance decisions.
• B. The firm ' s internal organisational culture and the maturity of its data engineering team, both of which influence how AI projects are scoped and delivered.
• C. The composition of the firm ' s senior leadership team and the way responsibilities for AI initiatives are currently allocated across internal business units.
• D. The current inventory of AI models deployed in the underwriting platform and the technical debt accumulated within the firm ' s own internal data pipelines over time.