Question 1

A new compliance analyst is reading ISO/IEC 42001 for the first time and asks her mentor what the acronym 'AIMS' stands for in the context of this standard. According to Clause 3 and GAICC Foundation Module 3, which option provides the correct expansion?

AAI Management System---the set of interrelated elements an organisation uses to establish policies and objectives for its AI activities and the processes to achieve them.

BAI Monitoring and Surveillance---the runtime telemetry layer that watches deployed AI models for performance drift, anomalous outputs, and integrity breaches.

CAI Impact Mitigation Strategy---the documented plan describing how an organisation will treat residual AI risks identified through impact assessment activities.

DAudit Integrity Maintenance Schedule---the calendar that governs internal audit cadence, surveillance audits, and recertification audits across a three-year cycle.

Answer : A

In accordance with ISO/IEC 42001 Clause 3 (Terms and definitions) and the Harmonized Structure common to all modern ISO management system standards, the acronym 'AIMS' formally stands for 'Artificial Intelligence Management System.' Clause 3 defines a management system as a set of interrelated or interacting elements of an organization to establish policies and objectives, as well as processes to achieve those objectives. Therefore, the AIMS encompasses the governance framework, policies, structural controls, operational lifecycles, risk management methodologies, impact assessment mechanisms, and continuous improvement loops established to direct, govern, and control an entity's AI-related undertakings. It must not be conflated with point-in-time runtime telemetry platforms (AI monitoring), risk treatment blueprints, or audit scheduling timelines.

Question 2

A documentation lead is preparing a one-page reference for new joiners that names the four annexes of ISO/IEC 42001 and their purpose. She wants the description that aligns with GAICC Foundation Module 3. Which option BEST matches the role of each annex in the standard?

AAnnex A is a published list of certified consultants; Annex B is the official EU AI Act mapping; Annex C is a sample AI policy template; Annex D is the standard's revision history log.

BAnnex A maps ISO/IEC 42001 to ISO 9001 directly; Annex B is a vocabulary appendix; Annex C is a sample Statement of Applicability; Annex D is a glossary of regional AI regulations.

CAnnex A is a list of accredited certification bodies; Annex B is a Stage 2 audit checklist; Annex C is a Statement of Applicability template; Annex D is a financial impact assessment model.

DAnnex A is the reference control set; Annex B is implementation guidance; Annex C catalogues AI-related objectives and risk sources; Annex D shows integration with other management system standards.

Answer : D

ISO/IEC 42001 contains four structured annexes designed to assist organizations in architecting and operationalizing their AIMS. Annex A provides the normative reference control set containing 38 control objectives and controls divided into domains (A.2 through A.10). Annex B provides informative guidance for implementing these controls, detailing best practices for human oversight, transparency, and data governance. Annex C catalogues potential AI-related organizational objectives, use cases, and distinct risk sources (such as algorithmic bias, safety failures, and intellectual property infringement). Finally, Annex D provides informative mapping and integration guidance, illustrating how ISO/IEC 42001 aligns with and complements other established management system standards like ISO 9001 (Quality) and ISO/IEC 27001 (Information Security).

===============

Question 3

A telecommunications operator is choosing between two architectures for a customer-service AI assistant. Option A retrains a very large foundation model weekly on internal data; Option B fine-tunes a substantially smaller model monthly. Both meet functional accuracy requirements. The AIMS lead is asked how ISO/IEC 42001 treats environmental considerations when an organisation selects an AI design. Which response BEST reflects the standard's intent?

AEnvironmental considerations sit outside the AIMS and belong with the corporate sustainability team, so the AI architecture decision should be driven purely by functional accuracy and time-to-market without consideration of energy or compute footprint.

BEnvironmental impact is among the considerations the AI System Impact Assessment is expected to address, so the operator should evaluate the energy and compute footprint of each option alongside functional performance before approving an architecture.

CEnvironmental impact should be evaluated by the cloud provider rather than the operator, since the provider operates the underlying infrastructure and is better placed than the operator to compare the relative carbon profiles of competing architectures.

DEnvironmental impact considerations apply solely to AI systems that perform climate-related functions such as emissions forecasting; for a customer service assistant the environmental dimension of architecture choice falls outside the relevant scope.

Answer : B

ISO/IEC 42001 establishes an operational framework that integrates societal and environmental dimensions directly into the engineering and procurement lifecycle of AI systems. Under Clause 6.1.4 (AI System Impact Assessment) and the reference controls in Annex A (specifically domain A.6 regarding resource management and AI lifecycle governance), organizations must assess the broader ramifications of system deployment. This includes evaluating the compute intensity, power consumption, data storage volume, and resulting carbon footprint of competing model designs. An organization cannot abdicate environmental due diligence to a hyperscaler or corporate sustainability committee; the AIMS requires technical decision-makers to evaluate whether excessive computational consumption is disproportionate to functional performance gains. Comparing retraining cadences and model parameter scale against sustainable resource objectives directly supports responsible AI development and lifecycle optimization.

===============

Question 4

A health-tech startup deploys a chatbot that answers patient questions about symptom management. Internally the team uses a large language model behind the chatbot but the public interface does not indicate that the responses are AI-generated. The product manager argues that disclosure would reduce user trust. The AI governance lead disagrees on responsible-AI grounds. Which response BEST reflects the transparency principle in ISO/IEC 42001 Annex B and related Annex A controls?

AWithhold the AI nature of the chatbot from users to preserve trust during the launch period, on the basis that disclosing AI involvement could discourage patients from using a tool that the team believes will benefit them medically over time.

BDisclose to users that the chatbot is an AI system, describe its intended purpose and limitations in plain language, and make this information accessible at the point of interaction so that users can make informed choices about using it.

CPublish a detailed technical specification of the model architecture and training procedure on the company's developer blog and treat that publication as sufficient transparency for end users who interact with the chatbot through the patient-facing interface.

DAdd a footnote to the corporate website's privacy policy stating that the company uses AI in some of its products, without further disclosure inside the chatbot interface itself, so that transparency is technically addressed at the organisation level.

Answer : B

Under ISO/IEC 42001 Annex B (Transparency and Explainability) and the control objectives outlined in Annex A (specifically domain A.8 regarding AI system operation and transparency to interested parties), deploying an AI interface that conceals its non-human nature from end-users directly contravenes responsible AI requirements. In healthcare and clinical-adjacent workflows, end-users make critical personal decisions based on system responses. Transparency requires that individuals interacting directly with an AI system are explicitly notified that they are engaging with artificial intelligence, unless obvious from context. Furthermore, disclosure must be meaningful: it should articulate the system's intended purpose, its technical and diagnostic limitations, and points of contact for human escalation, delivered in plain, accessible language directly at the interface level. Concealing AI operation, burying disclaimers within obscure corporate privacy policies, or relying solely on technical engineering blog posts fails the standard's transparency mandate.

===============

Question 5

An AIMS project team is drafting the interested-parties register required under Clause 4.2. A team member suggests limiting the register to paying customers and regulators. The compliance lead pushes back, citing the breadth of interested parties expected under GAICC Foundation Module 4. Which option BEST captures the range of interested parties Clause 4.2 expects?

ACustomers and competent regulatory authorities, since interested parties under Clause 4.2 are deliberately restricted to entities with formal commercial or statutory relationships.

BA broad range that includes customers, regulators, employees, data subjects, suppliers, the public, and communities affected by the organisation's AI activities.

CTop management and members of the AI governance committee, since interested parties under Clause 4.2 refers to the internal leadership group accountable for the AIMS.

DExternal certification body auditors and the accreditation body, since interested parties under Clause 4.2 captures the assurance ecosystem that audits the AIMS.

Answer : B

ISO/IEC 42001 Clause 4.2 establishes a broad mandate for stakeholder identification that aligns with the pervasive, societal impact of artificial intelligence. Unlike traditional technical standards that focus narrowly on immediate clients and statutory authorities, an AIMS must account for a wide continuum of interested parties. This scope encompasses direct customers, regulatory bodies, internal staff, external suppliers, end-users, individuals whose personal data or intellectual property is ingested for model training, and wider communities or vulnerable groups that can be impacted by automated outputs and classifications. Failing to incorporate non-contractual parties---such as individuals evaluated by automated screening tools---creates blind spots in risk assessment, violating the intent of Clauses 4.2, 6.1.2, and 6.1.4.

===============

Free GAICC ISO/IEC 42001 Foundation (ISO-IEC-42001-Foundation) Practice Questions

GAICC ISO-IEC-42001-Foundation Sample Exam Questions

Question 1

Question 2

Question 3

Question 4

Question 5