Free Advanced in AI Risk (AAIR) practice test: 30 questions with answers

An inventory with owners, purpose, data sources and risk ratings creates the baseline needed to manage AI risk. Buying a platform, unreported local deployments and deleting systems all move away from control.

Key risk indicators such as drift, incidents and overdue treatments show trends in AI risk control. Pilot counts, storage size and course attendance measure activity rather than risk control.

Due diligence on data handling, documentation and audit rights, with ongoing monitoring, manages third-party AI risk. Accepting standard terms, trusting brands and uploading confidential data all leave the organisation exposed.

AI risk training helps staff understand responsibilities, approved uses and the risks AI creates in their roles. It does not replace controls, approve unsanctioned model building or encourage use regardless of data sensitivity.

Named business and technical owners with documented responsibilities make accountability explicit. Automated logs, vendor-only accountability and availability-based ownership leave outcomes without a responsible person.

An AI acceptable use policy with approved tools, data classification and exception monitoring addresses the risk directly. Ignoring unapproved use, allowing it freely and banning all AI in the business do not manage the risk.

Containment, impact assessment, notification and lessons learned are core steps of AI incident response. Delayed reporting, deleting logs and retraining before investigating each undermine the response.

Executive sponsorship, clear ownership and integration with enterprise risk management determine programme effectiveness. Model counts, platform brand and team size do not decide whether risk is controlled.

Contractual and technical controls prohibiting training on the organisation's data unless approved reduce that risk. Sending data for training, unlimited vendor retention and uploading to public tools all expose confidential data.

Ranking risks by likelihood and impact against appetite focuses effort where it matters most. Treating all risks equally, ignoring unincidented risks and following media attention all misallocate effort.

Setting risk appetite and naming an accountable owner before deployment establishes the decision rights and risk thresholds the use case must meet. Launching first, relying on a marketing statement and training on data before review all bypass governance.

The NIST AI Risk Management Framework organises risk management around Govern, Map, Measure and Manage. ISO 9001, PCI DSS and ITIL address quality, payment card security and service management respectively.

ISO/IEC 42001 specifies requirements for an AI management system and supports certification. ISO 27001 covers information security, SOC 2 is an attestation report, and the GDPR is a privacy regulation.

An AI use-case inventory gives governance visibility of each AI system, its purpose, owner and risk level, which is the basis for oversight. Hardware specifications, marketing lists and historical source code do not provide that oversight.

A senior executive or risk committee with explicit accountability for AI risk decisions provides the oversight needed. A junior data scientist, a vendor and frontline users lack the authority or independence for executive accountability.

Defining risk thresholds per use case that trigger approval, monitoring or restriction links policy to the stated appetite. Publishing without criteria, team-set tolerances and vague policies do not connect policy to appetite.

The EU AI Act applies obligations by risk category, from unacceptable to minimal, with stronger obligations at higher tiers. PCI DSS, accounting standards and codes of conduct are not AI risk-tier regulations.

Including AI risk in board reporting with defined metrics, thresholds and escalation paths gives the board the information it needs to oversee the risk. Reporting only on request, leaving it to the data science team and treating it as technical all keep the board uninformed.

Clear ownership and decision rights, together with policies, standards and training for everyone involved, are core governance elements. Deployment without approval, vendor assurance alone and counting models do not govern AI risk.

Mapping use cases to applicable law and documenting the basis for risk classification and controls support compliance. Vendors do not carry compliance alone, local rules can apply regardless of training location, and waiting for detailed rules delays required assessment.

Data preparation and quality review, including representativeness and label checks, is where training-data bias is found and addressed before the model is built. Monitoring, retirement and naming all come later or do not examine the data.

Documenting features, reasoning and reason codes for each decision supports explanation to customers and reviewers. Hidden features, random outcomes and unexplained published weights do not explain decisions.

Ongoing drift and performance monitoring against thresholds, with alerts and review, detects drift early. A single launch check, disabled logging and unmotivated annual replacement do not detect drift.

A documented change assessment, covering data changes, validation and approval, controls retraining risk. Immediate retraining without review, notifying users afterwards and deleting the prior version each remove control.

Adversarial and stress testing with edge cases and unexpected inputs, documented for review, probes robustness. Training-data tests, developer confidence and borrowed success do not show how the model behaves under unusual inputs.

Documenting the decommissioning decision and its impact, and removing access while archiving records per policy, close the lifecycle properly. Running retired models, deleting audit trails and silent shutdowns all create risk or confusion.

Planning and design defines the intended use and risks before development begins. Retirement, operations and monitoring all come later in the lifecycle.

Tracking performance and drift against agreed thresholds throughout operation detects degradation. A one-time log read, switching off metrics and assuming stability because code is unchanged all miss degradation.

A model card records intended use, limitations, data characteristics, evaluation results and known risks. Slogans, lunch lists and electricity costs are not model documentation.

A deployment gate that requires a validation report and approval prevents unvalidated models reaching production. Direct pushes, Friday deployments and removing validation each remove the control.