An IT director is finalising the certification scope statement for his organisation ' s AIMS. He has been told that ISO/IEC 42001 is built on the Harmonized Structure used by other ISO management system standards.
According to GAICC Foundation Module 2, which clauses of ISO/IEC 42001 contain the auditable management system requirements?

• A. Clauses 4 through 10, which carry the management system requirements that an external audit assesses for conformity against the standard.
• B. Clause 6 by itself, since it covers planning, risk assessment, and AI System Impact Assessment, which are the AI-specific elements that auditors evaluate.
• C. Clauses 1, 2, and 3, which together set scope, normative references, and terms-the binding requirements that an audit team checks for conformity.
• D. Annexes A, B, C, and D, which are the principal sources of audit findings during a Stage 2 certification audit against an ISO management system standard.

During a Foundation classroom exercise, learners are asked to sort four short documents into the categories defined by ISO/IEC 42001. One document is a one-page statement signed by the chief executive that sets direction for responsible AI use, commits to applicable requirements, and commits to continual improvement of the AIMS. Three other documents describe controls, model training procedures, and an incident log. Which categorisation of the signed one-page statement is BEST aligned with Clause 5.2?

• A. It is an AI system impact assessment summary, because it sets out the organisation ' s intended position on responsible AI use at a level that informs the impact-assessment scoring rubric for individual systems.
• B. It is an Annex A control implementation record, since it describes how the organisation intends to apply selected controls drawn from the Annex A reference set during the operational phase of the management system.
• C. It is the AI policy required by Clause 5.2, because top management has documented direction for AI, set a framework for objectives, and committed to satisfying applicable requirements and to continual improvement.
• D. It is a management-review output captured under Clause 9.3, since the chief executive has signed it and the document expresses commitments at a strategic level appropriate to a periodic review of the management system.

+-----------------------------------------------------------------------------------------------+
| Choosduct manager responsible for the deployed AI system, since they direct day-to- |
| day operations and have the most direct view of AI model behaviour and incidents. |
+-----------------------------------------------------------------------------------------------+ A compliance team is mapping ISO/IEC 42001 Clause 3 terms to everyday business language for an internal onboarding wiki. They are debating who counts as ' top management ' under the standard, because the term governs which roles inherit Clause 5.1 leadership duties. According to GAICC Foundation Module 3, which option BEST reflects the Clause 3 definition of top management?

• A. The person or group of people who directs and controls an organisation at the highest level and has the authority to delegate and provide resources within it.
• B. The product manager responsible for the deployed AI system, since they direct day-to-day operations and have the most direct view of AI model behaviour and incidents.
• C. The third-party certification body ' s lead auditor, since the auditor exercises decisive authority over whether the AIMS satisfies ISO/IEC 42001 during a Stage 2 audit.
• D. Any line manager with budget authority over an AI initiative, since top management refers to the manager who funds the AI project rather than to enterprise leadership.

A foundation case study describes a media company rolling out a generative-AI content-assistance tool. Four roles are listed: the chief executive, the head of editorial standards, an AI product manager, and the legal counsel. The workshop asks who should be assigned the responsibility for reporting AIMS performance to top management under ISO/IEC 42001. Which assignment is MOST consistent with Clause 5.3 ' s intent on roles, responsibilities, and authorities?

• A. Assign the reporting role to a specific named role inside the organisation with appropriate authority over the AIMS, such as the head of editorial standards or the AI product manager, and communicate that assignment so the reporting line is unambiguous.
• B. Assign the role to the chief executive personally, so that reporting on AIMS performance is delivered by the same person who chairs management review, on the basis that combining the two activities tightens accountability at the top of the organisation.
• C. Assign the reporting role to the external certification body during the audit cycle, since the certification body conducts independent verification of the AIMS and is therefore better placed than any internal role to report on AIMS performance for the period under review.
• D. Avoid assigning the reporting role to any single named individual, on the grounds that distributed accountability across the four listed roles strengthens internal checks and balances around AIMS performance reporting to top management.

A compliance manager is preparing a slide for the leadership team to explain the difference between accreditation and certification in the ISO/IEC 42001 ecosystem. She wants a one-sentence working definition of an accreditation body that aligns with GAICC Foundation Module 2. Which option is the BEST fit?

• A. An accreditation body is the internal audit function within an organisation that reviews the AIMS against ISO/IEC 42001 before any external certification audit is conducted.
• B. An accreditation body is the consulting firm engaged by an organisation to help draft its AI policy, conduct gap analyses, and prepare evidence packs for a Stage 1 audit.
• C. An accreditation body is the publisher of an ISO standard, responsible for drafting the requirements text, maintaining revisions, and updating the harmonised structure terms.
• D. An accreditation body is an authoritative third party that assesses and formally recognises the competence of certification bodies to audit against standards such as ISO/IEC 42001.