A start-up founder argues that ISO/IEC 42001 is irrelevant to her company because it neither develops AI models nor sells AI products-it merely uses a third-party generative AI assistant to draft customer support replies. The compliance lead disagrees and points to the standard ' s scope as described in the GAICC Foundation materials. Which statement BEST captures who ISO/IEC 42001 is intended for?

• A. Organisations that build and train their own AI models from scratch, since the standard targets AI developers rather than downstream users of third-party vendor tools.
• B. Public-sector bodies subject to AI legislation, since voluntary management system standards are intended for regulated entities rather than commercial start-ups.
• C. Any organisation that develops, provides, or uses AI systems, irrespective of size, sector, or AI maturity, including those that consume AI through third-party tools.
• D. Enterprises above a defined revenue threshold, since the cost and complexity of an AI management system is disproportionate for smaller firms or early-stage start-ups.

A regional bank is preparing for its first ISO/IEC 42001 internal audit. The chief operating officer explains that the bank has an AIMS RACI matrix on a shared drive, but few staff have seen it; team leads in data science, risk, and customer operations are uncertain who is accountable for reporting AIMS performance to top management. The internal auditor flags this as a likely Clause 5.3 concern. Which corrective approach BEST addresses what Clause 5.3 actually requires?

• A. Move the RACI matrix to a more secure folder, restrict edit rights to senior managers, and add a version history log so that change control over the matrix can be evidenced more cleanly during the next internal audit cycle.
• B. Schedule a workshop for the data-science team to revise the AI risk register, on the basis that stronger risk records will indirectly make AIMS roles and responsibilities easier for team leads to interpret in their day-to-day work.
• C. Formally assign and communicate the responsibilities and authorities for AIMS conformance and for performance reporting to top management, then confirm in writing that affected staff understand their specific role in the AI management system.
• D. Append the RACI matrix as an annex to the AI policy document and recirculate the combined policy for re-acknowledgement, since combining the two records will satisfy the documentation expectation under Clause 7.5 for related governance artefacts.

A small insurance firm is performing its first context analysis under Clause 4.1 of ISO/IEC 42001. The compliance lead lists the factors the team should consider. Which item BEST illustrates an EXTERNAL issue relevant to the AIMS, consistent with GAICC Foundation Module 4?

• A. The composition of the firm ' s senior leadership team and the way responsibilities for AI initiatives are currently allocated across internal business units.
• B. The forthcoming enforcement of regional AI legislation, such as the EU AI Act, and evolving public expectations about transparency in automated insurance decisions.
• C. The firm ' s internal organisational culture and the maturity of its data engineering team, both of which influence how AI projects are scoped and delivered.
• D. The current inventory of AI models deployed in the underwriting platform and the technical debt accumulated within the firm ' s own internal data pipelines over time.

A foundation case study describes a media company rolling out a generative-AI content-assistance tool. Four roles are listed: the chief executive, the head of editorial standards, an AI product manager, and the legal counsel. The workshop asks who should be assigned the responsibility for reporting AIMS performance to top management under ISO/IEC 42001. Which assignment is MOST consistent with Clause 5.3 ' s intent on roles, responsibilities, and authorities?

• A. Avoid assigning the reporting role to any single named individual, on the grounds that distributed accountability across the four listed roles strengthens internal checks and balances around AIMS performance reporting to top management.
• B. Assign the role to the chief executive personally, so that reporting on AIMS performance is delivered by the same person who chairs management review, on the basis that combining the two activities tightens accountability at the top of the organisation.
• C. Assign the reporting role to the external certification body during the audit cycle, since the certification body conducts independent verification of the AIMS and is therefore better placed than any internal role to report on AIMS performance for the period under review.
• D. Assign the reporting role to a specific named role inside the organisation with appropriate authority over the AIMS, such as the head of editorial standards or the AI product manager, and communicate that assignment so the reporting line is unambiguous.

+-----------------------------------------------------------------------------------------------+
| Choose one answer. Only a single option is correct. |
| |
| ( ) A normative catalogue of mandatory AI controls that an organisation must implement in |
| full to achieve certification, regardless of its context or risk profile. |
| |
| ( ) An informative reference set of AI controls that organisations select from during risk |
| treatment, and document inclusion or exclusion via the Statement of Applicability. |
| |
| ( ) A glossary of AI ethics principles drawn from regional regulations such as the EU AI Act |
| intended to guide ethical conduct rather than operational AIMS controls. |
| |
| ( ) A list of recommended external auditors and consultants accredited by ISO and IEC to |
| support implementation of an AI management system in regulated sectors. |
+-----------------------------------------------------------------------------------------------+ A trainee auditor is preparing notes on the structure of ISO/IEC 42001 and wants to describe the role of Annex A. Her mentor reminds her to use the definition consistent with GAICC Foundation Module 3 and Clause 6.1.3. Which description of Annex A is the MOST accurate?

• A. A list of recommended external auditors and consultants accredited by ISO and IEC to support implementation of an AI management system in regulated sectors.
• B. A normative catalogue of mandatory AI controls that an organisation must implement in full to achieve certification, regardless of its context or risk profile.
• C. An informative reference set of AI controls that organisations select from during risk treatment, and document inclusion or exclusion via the Statement of Applicability.
• D. A glossary of AI ethics principles drawn from regional regulations such as the EU AI Act intended to guide ethical conduct rather than operational AIMS controls.