AI Governance, Risk Management, and Compliance
Free CSA Trusted AI Safety Expert (TAISE) practice — 6 questions on AI Governance, Risk Management, and Compliance, with explanations. No sign-up. Full 12-question mixed test →
An HR technology vendor sells a resume-screening AI tool to a company for employment decisions. Under the EU AI Act, this system is classified as high-risk under Annex III. Which entity bears primary responsibility for conducting the conformity assessment and preparing the Annex IV technical documentation before the system is placed on the market?
Under the EU AI Act, 'provider' obligations include conducting the conformity assessment, affixing CE marking, and maintaining Annex IV technical documentation before the high-risk system is placed on the market. The vendor that develops and markets the tool is the provider.
An organization wants a certifiable management-system standard for AI governance — one where an accredited third-party body can issue a formal certification, analogous to ISO/IEC 27001 for information security. Which framework should it implement?
ISO/IEC 42001 defines an AI Management System (AIMS) and is structured for third-party accredited certification, mirroring ISO/IEC 27001's ISMS model.
A team is applying the NIST AI RMF to a new generative AI deployment. Before quantifying any specific risk metrics, they need to catalog the system's intended purpose, context of use, and impacted stakeholders. Which NIST AI RMF function covers this activity?
The Map function establishes context — intended use, stakeholders, and categorization of risks — as a prerequisite to the Measure function, which performs quantitative/qualitative risk analysis.
During an internal AI audit, the security team must verify that model training data lineage and provenance tracking controls are implemented. In the CSA AI Controls Matrix (AICM), which control domain most directly addresses this requirement?
The AICM includes a dedicated domain covering traceability of training data sources, transformations, and provenance records — directly mapping to this control requirement.
Under the EU AI Act's risk-tiering structure, which classification applies to AI practices such as social scoring by public authorities — practices that are prohibited outright regardless of any safeguards the provider implements?
Unacceptable-risk practices (Article 5), including public-authority social scoring, are banned outright — no amount of technical or procedural mitigation makes them legal under the Act.
A provider trains and releases a general-purpose AI (GPAI) model whose training compute exceeds the 10^25 FLOPs threshold, triggering the EU AI Act's 'systemic risk' classification. Beyond the baseline GPAI transparency requirements, which additional obligation specifically applies to this provider?
Article 51-55 obligations for GPAI models with systemic risk include adversarial testing, model evaluation, cybersecurity safeguards, and mandatory serious-incident reporting to the AI Office — on top of standard GPAI documentation/transparency duties.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →