A new AIMS coordinator is asked to summarise the difference between an AI system and an AI System Impact Assessment (AI-SIA) for an internal awareness page. According to ISO/IEC 42001 Clause 3 and GAICC Foundation Module 3, which option BEST captures what an AI-SIA is?

• A. A financial cost-benefit analysis comparing the total cost of ownership of competing AI platforms during procurement, including licence and infrastructure costs.
• B. A periodic vulnerability scan of AI infrastructure used to identify security weaknesses in model-serving environments, container images, and supporting APIs.
• C. A formal process for identifying and evaluating the potential consequences of an AI system on individuals, groups, and society, including affected interested parties.
• D. A technical performance benchmark comparing model accuracy across vendor offerings, used to select the most suitable AI model for production deployment.

A small insurance firm is performing its first context analysis under Clause 4.1 of ISO/IEC 42001. The compliance lead lists the factors the team should consider. Which item BEST illustrates an EXTERNAL issue relevant to the AIMS, consistent with GAICC Foundation Module 4?

• A. The firm ' s internal organisational culture and the maturity of its data engineering team, both of which influence how AI projects are scoped and delivered.
• B. The current inventory of AI models deployed in the underwriting platform and the technical debt accumulated within the firm ' s own internal data pipelines over time.
• C. The composition of the firm ' s senior leadership team and the way responsibilities for AI initiatives are currently allocated across internal business units.
• D. The forthcoming enforcement of regional AI legislation, such as the EU AI Act, and evolving public expectations about transparency in automated insurance decisions.

A consultancy is helping a healthcare provider plan its ISO/IEC 42001 certification scope. The provider operates many business units but wants to certify only the AIMS covering its radiology AI triage service. The auditor warns that any exclusion from the certification scope must meet a specific expectation described in GAICC Foundation Module 2 and Clause 4.3. Which statement BEST captures that expectation?

• A. Exclusions are not permitted under ISO/IEC 42001, so the entire organisation must be brought into the certification scope before a Stage 1 audit can commence.
• B. Exclusions are decided exclusively by the certification body during the Stage 1 audit, based on a sampling review of the organisation ' s AI inventory and risk register.
• C. Exclusions must be supported by a documented justification linked to context, interested parties, and AI roles, rather than being stated without rationale in the scope statement.
• D. Exclusions may be declared at the discretion of top management and recorded in meeting minutes, with no further documentation required for the external certification audit.

A retail bank is preparing to deploy a new AI tool that ranks loan applicants by predicted creditworthiness.
The model was trained on five years of historical lending data drawn from a single metropolitan region.
Before go-live, the AIMS lead must propose a fairness check consistent with ISO/IEC 42001 expectations on responsible AI. Which approach BEST reflects the standard ' s intent for bias detection during AI system impact assessment?

• A. Wait for the first quarter of live decisions to accumulate, then run a retrospective fairness analysis on actual decision outcomes, since live data is more representative than any test data the bank could realistically assemble in a development environment.
• B. Document an assumption in the AI System Impact Assessment that historical lending data is representative of the wider applicant population and proceed to deployment, with no quantitative fairness testing of model outputs prior to release.
• C. Restrict the deployment to a single business unit for the first month, with no formal pre-launch fairness testing, and rely on customer complaints to surface unfair outcomes for downstream investigation by the responsible model team.
• D. Evaluate predicted-outcome disparities across protected groups using pre-defined fairness metrics, document the results in the AI System Impact Assessment, and confirm acceptance criteria are met before approving the model for deployment.

A new compliance analyst is reading ISO/IEC 42001 for the first time and asks her mentor what the acronym ' AIMS ' stands for in the context of this standard. According to Clause 3 and GAICC Foundation Module 3, which option provides the correct expansion?

• A. AI Monitoring and Surveillance-the runtime telemetry layer that watches deployed AI models for performance drift, anomalous outputs, and integrity breaches.
• B. AI Impact Mitigation Strategy-the documented plan describing how an organisation will treat residual AI risks identified through impact assessment activities.
• C. AI Management System-the set of interrelated elements an organisation uses to establish policies and objectives for its AI activities and the processes to achieve them.
• D. Audit Integrity Maintenance Schedule-the calendar that governs internal audit cadence, surveillance audits, and recertification audits across a three-year cycle.