GAICC ISO/IEC 42001 Foundation : ISO-IEC-42001-Foundation

A municipal council trains an AI tool to predict pothole locations using crowdsourced reports submitted through a smartphone app. After deployment, the tool consistently recommends maintenance in wealthier suburbs where smartphone uptake is highest, while under-recommending in lower-income areas where reports are sparse. A foundation learner is asked which type of bias BEST describes what is occurring and which responsible-AI consideration is most directly affected.

• A. Sample selection bias, because the training data systematically over-represents neighbourhoods with higher smartphone uptake and under-represents others, distorting the fairness of the maintenance outcomes the model recommends.
• B. Confirmation bias, because the council ' s road maintenance team trusts the tool more than it should, and that trust reinforces the existing recommendation pattern through downstream operational scheduling that follows the tool ' s outputs.
• C. Label bias, because the council misclassified individual reports during the training data labelling stage, and the resulting label errors propagated into the model ' s prediction patterns across the different neighbourhoods served by the council.
• D. Automation bias, because human operators defer to the AI tool ' s recommendations without applying their own knowledge of which neighbourhoods would benefit from inspection regardless of whether residents reported damage through the app.

A retail bank is preparing to deploy a new AI tool that ranks loan applicants by predicted creditworthiness.
The model was trained on five years of historical lending data drawn from a single metropolitan region.
Before go-live, the AIMS lead must propose a fairness check consistent with ISO/IEC 42001 expectations on responsible AI. Which approach BEST reflects the standard ' s intent for bias detection during AI system impact assessment?

• A. Document an assumption in the AI System Impact Assessment that historical lending data is representative of the wider applicant population and proceed to deployment, with no quantitative fairness testing of model outputs prior to release.
• B. Evaluate predicted-outcome disparities across protected groups using pre-defined fairness metrics, document the results in the AI System Impact Assessment, and confirm acceptance criteria are met before approving the model for deployment.
• C. Restrict the deployment to a single business unit for the first month, with no formal pre-launch fairness testing, and rely on customer complaints to surface unfair outcomes for downstream investigation by the responsible model team.
• D. Wait for the first quarter of live decisions to accumulate, then run a retrospective fairness analysis on actual decision outcomes, since live data is more representative than any test data the bank could realistically assemble in a development environment.

A compliance manager is preparing a slide for the leadership team to explain the difference between accreditation and certification in the ISO/IEC 42001 ecosystem. She wants a one-sentence working definition of an accreditation body that aligns with GAICC Foundation Module 2. Which option is the BEST fit?

• A. An accreditation body is the internal audit function within an organisation that reviews the AIMS against ISO/IEC 42001 before any external certification audit is conducted.
• B. An accreditation body is the publisher of an ISO standard, responsible for drafting the requirements text, maintaining revisions, and updating the harmonised structure terms.
• C. An accreditation body is an authoritative third party that assesses and formally recognises the competence of certification bodies to audit against standards such as ISO/IEC 42001.
• D. An accreditation body is the consulting firm engaged by an organisation to help draft its AI policy, conduct gap analyses, and prepare evidence packs for a Stage 1 audit.

An education provider uses an AI plagiarism-detection tool supplied by a third-party vendor. A student is flagged incorrectly and appeals. The teacher refers the matter to the IT helpdesk, the helpdesk refers it to the procurement team, procurement refers it to the vendor, and the vendor refers it back to the institution. The student receives no clear response for several weeks. Which issue BEST reflects an accountability weakness under the responsible-AI principles in ISO/IEC 42001?

• A. The student should be required to escalate the appeal through a formal external regulator rather than through the institution, as external regulators are better placed than internal staff to adjudicate AI- related complaints raised by individual learners.
• B. No specific role inside the institution has been assigned responsibility for AI-system outcomes experienced by users, so the appeal cannot be addressed end to end-a gap inconsistent with the accountability principle and with Clause 5.3 role assignment.
• C. Accountability is adequate because each team in the referral chain followed its own internal procedure, and procedural compliance by individual teams demonstrates that responsibility has been appropriately distributed across the institution.
• D. The vendor should be considered solely accountable for the misclassification because the model was developed and trained externally, and the institution is therefore a passive consumer of the vendor ' s pre-built classification capability for student submissions.

A start-up founder argues that ISO/IEC 42001 is irrelevant to her company because it neither develops AI models nor sells AI products-it merely uses a third-party generative AI assistant to draft customer support replies. The compliance lead disagrees and points to the standard ' s scope as described in the GAICC Foundation materials. Which statement BEST captures who ISO/IEC 42001 is intended for?

• A. Enterprises above a defined revenue threshold, since the cost and complexity of an AI management system is disproportionate for smaller firms or early-stage start-ups.
• B. Any organisation that develops, provides, or uses AI systems, irrespective of size, sector, or AI maturity, including those that consume AI through third-party tools.
• C. Public-sector bodies subject to AI legislation, since voluntary management system standards are intended for regulated entities rather than commercial start-ups.
• D. Organisations that build and train their own AI models from scratch, since the standard targets AI developers rather than downstream users of third-party vendor tools.