A mid-sized SaaS company has implemented its AIMS and now wants to obtain certification against ISO/IEC
42001. The CISO asks which standard governs the bodies that will conduct the external certification audit, so she can check the credentials of the shortlisted firms. Which standard is the right reference?

• A. ISO/IEC 27001, which sets requirements for information security management systems and is widely used by SaaS vendors that also pursue ISO/IEC 42001.
• B. ISO/IEC 17021-1, which sets requirements for bodies providing audit and certification of management systems and applies to ISO/IEC 42001 certification bodies.
• C. ISO/IEC 22989, which provides AI vocabulary and concepts and is the normative reference cited inside ISO/IEC 42001 for terminology used during audits.
• D. ISO/IEC 38507, which sets governance implications of AI use for governing bodies and supports board- level oversight in organisations adopting ISO/IEC 42001.

A documentation lead is preparing a one-page reference for new joiners that names the four annexes of ISO
/IEC 42001 and their purpose. She wants the description that aligns with GAICC Foundation Module 3.
Which option BEST matches the role of each annex in the standard?

• A. Annex A is a list of accredited certification bodies; Annex B is a Stage 2 audit checklist; Annex C is a Statement of Applicability template; Annex D is a financial impact assessment model.
• B. Annex A maps ISO/IEC 42001 to ISO 9001 directly; Annex B is a vocabulary appendix; Annex C is a sample Statement of Applicability; Annex D is a glossary of regional AI regulations.
• C. Annex A is the reference control set; Annex B is implementation guidance; Annex C catalogues AI- related objectives and risk sources; Annex D shows integration with other management system standards.
• D. Annex A is a published list of certified consultants; Annex B is the official EU AI Act mapping; Annex C is a sample AI policy template; Annex D is the standard ' s revision history log.

A foundation workshop case describes a small financial-advisory firm that has just signed its AI policy. The compliance officer asks what the firm should do next to translate the policy into operational practice for a new portfolio-recommendation AI tool the firm is preparing to deploy. Which next step BEST reflects how ISO
/IEC 42001 expects policy to connect to planning and operations for a specific AI system?

• A. Print and laminate the signed policy for display in the office reception area, then distribute copies to each adviser ' s desk so that the document is visible during client meetings held in the firm ' s premises across the next quarter.
• B. Defer further action until the firm has accumulated several months of live experience with the portfolio- recommendation tool, on the basis that risk and impact assessments are more accurate when informed by post-deployment operational data points.
• C. Conduct an AI risk assessment under Clause 6.1.2 and an AI System Impact Assessment under Clause
  6.1.4 for the portfolio-recommendation tool, then plan risk treatment with controls aligned to the policy' s commitments.
• D. Re-sign the AI policy in front of staff at the next quarterly town-hall meeting to demonstrate leadership commitment, on the basis that visible re-signing reinforces the message conveyed by the original signature at policy adoption.

A new compliance analyst is reading ISO/IEC 42001 for the first time and asks her mentor what the acronym ' AIMS ' stands for in the context of this standard. According to Clause 3 and GAICC Foundation Module 3, which option provides the correct expansion?

• A. AI Monitoring and Surveillance-the runtime telemetry layer that watches deployed AI models for performance drift, anomalous outputs, and integrity breaches.
• B. AI Impact Mitigation Strategy-the documented plan describing how an organisation will treat residual AI risks identified through impact assessment activities.
• C. AI Management System-the set of interrelated elements an organisation uses to establish policies and objectives for its AI activities and the processes to achieve them.
• D. Audit Integrity Maintenance Schedule-the calendar that governs internal audit cadence, surveillance audits, and recertification audits across a three-year cycle.

An education provider uses an AI plagiarism-detection tool supplied by a third-party vendor. A student is flagged incorrectly and appeals. The teacher refers the matter to the IT helpdesk, the helpdesk refers it to the procurement team, procurement refers it to the vendor, and the vendor refers it back to the institution. The student receives no clear response for several weeks. Which issue BEST reflects an accountability weakness under the responsible-AI principles in ISO/IEC 42001?

• A. Accountability is adequate because each team in the referral chain followed its own internal procedure, and procedural compliance by individual teams demonstrates that responsibility has been appropriately distributed across the institution.
• B. No specific role inside the institution has been assigned responsibility for AI-system outcomes experienced by users, so the appeal cannot be addressed end to end-a gap inconsistent with the accountability principle and with Clause 5.3 role assignment.
• C. The vendor should be considered solely accountable for the misclassification because the model was developed and trained externally, and the institution is therefore a passive consumer of the vendor ' s pre-built classification capability for student submissions.
• D. The student should be required to escalate the appeal through a formal external regulator rather than through the institution, as external regulators are better placed than internal staff to adjudicate AI- related complaints raised by individual learners.