Q01 T-01 Annex A treated as mandatory ISO/IEC 42001:2023 Annex A is labelled normative. An auditor reviewing the SoA finds the implementer has selected 23 of the listed Annex A controls. Per the standard, this is:
- A. A nonconformity - 'normative' means all listed controls must be implemented in conformant AIMSes
- B. A nonconformity - the standard requires at least 30 of the Annex A controls to be in scope
- C. Acceptable only if the certification body has approved the selection
- D. Acceptable - Annex A is a reference list; selection is driven by the AI risk and impact assessments under Clause 6.1.3, with exclusions justified in the SoA
+ Show my answer
+
Correct answer: D
ISO/IEC 42001:2023 Annex A is normative as a reference list, meaning the controls listed are the canonical set the organisation considers - not the set it must implement universally. Clause 6.1.3 drives selection from Annex A based on risk and impact assessment outcomes, with exclusions justified in the SoA. Option B is the textbook T-01 trap: 'normative' misread as 'mandatory in entirety'. Option C invents a quorum. Option D invents an approval gate the standard does not assign to the certification body.
ISO/IEC 42001:2023, Clause 6.1.3 (with Annex A)
Q02 T-02 Software lifecycle vs AIMS lifecycle An implementer is mapping the organisation's MLOps practices onto the ISO/IEC 42001 AIMS. The MLOps team operates in two-week sprints with continuous deployment. Per the standard, the implementer should:
- A. Map MLOps activities onto the AIMS AI lifecycle phases (design, development, deployment, operation); the sprint cadence is an internal practice, not an AIMS lifecycle phase
- B. Adopt the two-week sprint as the formal AIMS lifecycle cycle, since 42001 inherits whatever delivery cadence the implementing team uses
- C. Document MLOps separately from the AIMS - they are not compatible
- D. Replace MLOps with a waterfall AI lifecycle to align with the standard
+ Show my answer
+
Correct answer: A
ISO/IEC 42001:2023 with ISO/IEC 23894:2023 guidance frames the AIMS AI lifecycle as design, development, deployment, and operation - a governance framework, not a delivery cadence. MLOps and sprint cycles are internal delivery practices that operate within those phases. Option A maps the team's practices onto the standard's phases. Option B is the T-02 trap: confusing delivery cadence with the AIMS lifecycle. Option C wrongly forces a waterfall model. Option D severs MLOps from governance, which is precisely what 42001 prevents.
ISO/IEC 42001:2023 with ISO/IEC 23894:2023 (AI lifecycle guidance)
Q03 T-03 AI ethics policy vs AI management policy An organisation has two policy documents: an 'AI Ethics Policy' (board-approved, sets the organisation's ethical principles for AI use) and an 'AI Management Policy' (top-management-approved, operationalises Clause 5.2). Per ISO/IEC 42001:2023, the auditor should treat these as:
- A. Distinct documents with different scope, signatories, and review cadence; verify both are governed and that the Clause 5.2 AI policy commitments are explicitly addressed in at least one
- B. Only the AI Ethics Policy matters for audit, since 42001 inherits ethics framing from ISO/IEC 23894
- C. The same document with two titles; raise a finding if both exist
- D. Only the AI Management Policy matters; ethics policies are out of audit scope
+ Show my answer
+
Correct answer: A
ISO/IEC 42001:2023 Clause 5.2 requires the organisation to establish an AI policy at the management-system level (top-management-approved, addressing the AIMS commitments). Many organisations also publish AI ethics principles - these are distinct artefacts, with different scope and signatory. Option A keeps them distinct, which is correct. Option B collapses them - the T-03 trap. Option C bypasses the Clause 5.2 obligation. Option D removes the ethics document from scope when it sits within the AIMS.
ISO/IEC 42001:2023, Clause 5.2
Q04 T-01 Annex A treated as mandatory An organisation has excluded three Annex A controls from its 42001 implementation because they are not relevant to the AI systems in scope. Per the standard, the exclusions:
- A. Are not permitted - Annex A is normative, so all listed controls must be included
- B. Must be approved by the certification body in advance
- C. Are only permitted for AI systems with no consumer-facing outputs
- D. Must be justified in the SoA with reasons referencing the risk and impact assessment outcomes
+ Show my answer
+
Correct answer: D
Annex A is a normative reference list, not a blanket-mandatory set. Clause 6.1.3 d) requires the SoA to justify both inclusions AND exclusions of Annex A controls, with reasons tied to the risk and impact outcomes. Option A captures this. Option B is the T-01 trap: 'normative' misread as 'all controls mandatory'. Option C invents a certification-body approval gate. Option D introduces a consumer-output carve-out the standard does not contain.
ISO/IEC 42001:2023, Clause 6.1.3 d)
Q05 T-02 Software lifecycle vs AIMS lifecycle An implementer is placing a specific activity into a lifecycle phase. The activity is 'monitoring of model performance against agreed thresholds, with retraining triggered when thresholds are breached'. Per ISO/IEC 42001:2023 (with ISO/IEC 23894:2023 guidance), this activity belongs to the:
- A. Deployment phase - monitoring is a deployment-time concern
- B. Operation phase - the AI system is deployed and monitored against operational criteria
- C. Design phase - thresholds are set in the design specification
- D. Development phase - retraining is part of model development
+ Show my answer
+
Correct answer: B
ISO/IEC 42001:2023 with ISO/IEC 23894:2023 guidance frames operation as the phase covering deployed-system monitoring, performance evaluation, and the trigger logic for further action. Retraining triggered by performance breach is an operational control loop. Option B is the T-02 trap: placing an operational monitoring activity into development because retraining 'feels like' a development task. Option C misplaces threshold-evaluation into design (where thresholds are set, but not where they are evaluated in production). Option D treats deployment as a phase that includes ongoing monitoring, conflating deployment-the-event with operation-the-phase.
ISO/IEC 42001:2023 with ISO/IEC 23894:2023
Q06 T-03 AI ethics policy vs AI management policy Per ISO/IEC 42001:2023 Clause 5.2, the AI policy shall:
- A. Be appropriate to the organisation's purpose, provide a framework for AI objectives, include a commitment to satisfy applicable requirements, and include a commitment to continual improvement of the AIMS
- B. Whatever the organisation chooses - Clause 5.2 leaves AI policy content to the organisation's discretion
- C. Define the organisation's ethical principles for AI use, including fairness, accountability, transparency, and explainability
- D. Both - the AI policy must combine management-system commitments and ethical principles in a single document
+ Show my answer
+
Correct answer: A
Clause 5.2 lists specific content requirements for the AI policy (alignment to organisational purpose, framework for AI objectives, commitment to applicable requirements, continual improvement). Option A captures these. Option B describes ethical principles, which may sit in a separate AI Ethics document with different scope - the T-03 trap. Option C forces a combined document, which is not what the standard requires. Option D under-specifies the standard's actual requirements.
ISO/IEC 42001:2023, Clause 5.2
Q07 T-01 Annex A treated as mandatory An implementer is reviewing the structure of ISO/IEC 42001:2023. Which statement correctly describes Annex A and Annex B?
- A. Annex A is normative; Annex B is normative, and B items must appear in the SoA with the same inclusion/exclusion justification as Annex A
- B. Annex A is normative (reference controls); Annex B is normative implementation guidance, and Clause B.1 specifies that B items do not require SoA justification
- C. Both Annex A and Annex B are informative; the SoA covers only Clause 6 selections
- D. Annex A is normative; Annex B is informative implementation guidance
+ Show my answer
+
Correct answer: B
ISO/IEC 42001:2023 labels both Annex A and Annex B as normative. Annex A is the reference control catalogue (selection driven by risk and impact). Annex B is implementation guidance; Clause B.1 specifies that B items do not need SoA justification because they are guidance, not selectable controls. Option B is the common error - mislabelling B as informative because B.1 waives SoA justification (the waiver is a property of B.1's content, not a status change on Annex B). Option C wrongly demotes both. Option D wrongly extends SoA justification to B items.
ISO/IEC 42001:2023, Annexes A and B (with Clause B.1)
Q08 T-02 Software lifecycle vs AIMS lifecycle An implementer is documenting how the organisation handles training-data collection. Per ISO/IEC 23894:2023 lifecycle guidance referenced by ISO/IEC 42001:2023, training-data collection belongs primarily to the:
- A. Deployment phase - data is loaded when the system is deployed
- B. Operation phase - data is collected continuously during system use
- C. Design phase - data sources are specified in the design
- D. Development phase - data collection is part of building the AI system
+ Show my answer
+
Correct answer: D
ISO/IEC 23894:2023 AI lifecycle guidance, referenced by ISO/IEC 42001:2023, places training-data collection in the development phase - the phase where the model and its training corpus are built. Option B confuses inference-time data flow with training-data collection. Option C confuses specifying data sources (a design activity) with collecting them (a development activity). Option D conflates loading-into-production with collection. The T-02 trap is candidates mapping AI lifecycle phases onto whatever delivery-pipeline phase happens to touch the data at a given moment, rather than to the governance lifecycle the standard defines.
ISO/IEC 42001:2023 with ISO/IEC 23894:2023
Q09 T-03 AI ethics policy vs AI management policy An organisation has both an AI Policy (top-management-approved, Clause 5.2) and an AI Ethics Policy (board-approved, sets the organisation's ethical commitments). The AI Policy commits the AIMS to operate in accordance with the AI Ethics Policy. Per ISO/IEC 42001:2023, this arrangement is:
- A. Out of scope - the AI Ethics Policy is voluntary and the auditor should ignore it
- B. Non-conformant - the AI Ethics Policy must be top-management-approved, not board-approved
- C. Non-conformant - 42001 requires a single AI Policy, so the Ethics Policy should be merged into it
- D. Acceptable - the two documents are distinct and the cross-reference makes the relationship explicit; the auditor should verify both are governed
+ Show my answer
+
Correct answer: D
Clause 5.2 requires the organisation to establish an AI policy at the management-system level. The standard does not prevent the organisation from having additional policies (such as a board-approved Ethics Policy) - it requires the AIMS policy to exist and to meet the Clause 5.2 content requirements. A cross-reference where the AI Policy commits the AIMS to operate in accordance with the Ethics Policy is good governance. Option B is the T-03 trap: collapsing two distinct documents because both contain 'AI'. Option C invents an approval-level rule. Option D removes a referenced document from audit scope.
ISO/IEC 42001:2023, Clause 5.2
Q10 T-01 Annex A treated as mandatory An implementer has selected an Annex A control into the SoA but has not yet implemented it. The auditor sees this during a Stage 2 audit. Per ISO/IEC 42001:2023, the correct framing is:
- A. Each Annex A control included in the SoA must show its implementation status under Clause 6.1.3 d); 'selected but not implemented' is permitted only with a documented plan for implementation - otherwise it is a nonconformity
- B. Acceptable in all cases - Annex A controls are guidance, not requirements, so non-implementation is not a finding
- C. Acceptable - the SoA is a planning document, so implementation status is reviewed in surveillance audits only
- D. Always non-conformant - any Annex A control in the SoA must be fully implemented by the time of certification audit
+ Show my answer
+
Correct answer: A
Clause 6.1.3 d) requires the SoA to record implementation status for each selected control. A 'selected but not implemented' entry must have a documented implementation plan; otherwise it is a nonconformity because the organisation has identified the control as necessary but is not operating it. Option B mis-frames Annex A as guidance (the inverse of the T-01 trap). Option C is too absolute - the standard permits planned implementation. Option D removes implementation review from the initial audit, which contradicts Clause 9.2.
ISO/IEC 42001:2023, Clause 6.1.3 d)
