Free ISO 42001 LI Exam Flashcards

ISO/IEC 42001:2023 is the world's first international standard for an AI Management System (AIMS), published December 2023. It gives organizations a Plan-Do-Check-Act framework to responsibly develop, provide, or use AI systems while managing AI-specific risks.

ISO/IEC 22989 defines the core AI concepts and terminology used across the ISO/IEC 42001 family, giving Lead Implementers a shared vocabulary for terms like machine learning, AI system, and trustworthiness.

ISO/IEC 23053 provides a framework for describing machine learning (ML) systems using AI. It helps AIMS implementers classify and document the ML components inside an organization's AI system inventory.

ISO/IEC 23894 is the AI-specific risk management standard. Lead Implementers apply its guidance to identify, analyze, and evaluate AI risks — distinct from the societal-impact focus of an AI system impact assessment (ISO/IEC 42005).

ISO/IEC 5338 defines the AI system life cycle processes — from inception and design through deployment, operation, and retirement — which Annex A.6 controls reference when governing AI systems across their life cycle.

ISO/IEC 38507 provides guidance for governing-body (e.g., board of directors) oversight of AI use in an organization, linking AIMS leadership requirements (Clause 5) to enterprise-level AI governance.

ISO/IEC 42005 gives detailed guidance for conducting an AI system impact assessment — evaluating a system's effects on individuals, groups, and society — which the exam tests as a distinct process from an AI risk assessment.

The EU AI Act (Regulation 2024/1689) classifies AI systems into four tiers: Unacceptable risk (banned under Article 5), High-risk (Annex III systems, heavily regulated), Limited-risk (transparency duties only), and Minimal-risk (no specific obligation) — plus separate rules for general-purpose AI (GPAI).

ISO/IEC 42001 governs an AI Management System (AIMS) with Annex A controls addressing AI-specific risk, while ISO/IEC 27001 governs an Information Security Management System (ISMS) with Annex A controls addressing information security risk. Both share the Annex SL Clause 4-10 high-level structure.

PECB's ladder runs Provisional Implementer (no experience required) -> Implementer (2 years' work experience, 1 in AI management, plus 200 project hours) -> Lead Implementer (5 years' work experience, 2 in AI management, plus 300 project hours) -> Senior Lead Implementer (10 years' work experience, 7 in AI management, plus 1,000 project hours).

The exam has 80 multiple-choice questions, each with only 3 options (1 correct answer, 2 distractors), delivered open-book (the standard plus training materials and personal notes, no internet lookup) over 3 hours. A 70% score is required to pass, and questions appear both stand-alone and in 5-question scenario sets.

Clause 4: Context of the organization. Clause 5: Leadership. Clause 6: Planning. Clause 7: Support. Clause 8: Operation. Clause 9: Performance evaluation. Clause 10: Improvement. This is the same Annex SL harmonized structure shared by ISO/IEC 27001.

Annex A lists the 38 normative controls organizations must consider implementing (what to do); Annex B is informative and provides implementation guidance for those same controls (how to do it). Only Annex A drives the Statement of Applicability.

Annex C lists potential AI-related organizational objectives and risk sources for reference during risk assessment. Annex D provides sector-specific guidance for tailoring AIMS implementation to particular industries or use cases.

An AI risk assessment (ISO/IEC 23894 methodology) evaluates threats to the organization using likelihood x severity. An AI system impact assessment (ISO/IEC 42005 methodology) evaluates the AI system's effect on individuals, groups, and society — a distinction the exam tests heavily.

Before deploying a new or significantly changed AI system, the organization should conduct an AI system impact assessment to evaluate its potential effects on individuals and society, per Clause 6.1.4 and Annex A.5.

The SoA is a mandatory document listing every Annex A control, whether it is included or excluded, and the justification for each decision. It is a core Planning-domain deliverable and a key artifact reviewed during certification audits.

It must document a justification for excluding that control in the Statement of Applicability. Controls cannot simply be omitted — the exclusion rationale must be defensible and auditable.

A gap analysis compares the organization's current state against ISO/IEC 42001 requirements to identify missing policies, controls, or processes, forming the basis of the implementation roadmap.

The AI policy is a top-level management commitment statement that sets the organization's direction and principles for responsible AI use, required under Clause 5.2 and referenced by Annex A.2.

Common risk treatment options include: modify the risk (add controls), retain the risk (accept it), avoid the risk (discontinue the activity), or share the risk (e.g., insurance or third-party transfer). The chosen options become the risk treatment plan.

Internal context includes the organization's culture, governance structure, available resources, existing AI systems, and internal capabilities — a required input for Clause 4.1 context of the organization.

External context includes regulatory requirements (e.g., the EU AI Act), market conditions, competitor practices, and societal expectations around AI — a required input for Clause 4.1 alongside internal context.

Clause 4.2 requires identifying interested parties (employees, customers, regulators, affected individuals) and determining their relevant needs and expectations regarding the organization's AI systems.

AIMS objectives must be measurable (or capable of performance evaluation), consistent with the AI policy, and take applicable requirements into account — enabling later verification during monitoring and management review.

The project plan lays out the sequence, timeline, responsibilities, and resources needed to move from gap-analysis findings to a fully operating AIMS — the bridge between the Planning and Implementation domains.

An unacceptable AI risk requires a formal risk treatment plan — selecting and implementing additional controls, or another treatment option, before the AI system can proceed to deployment.

A.2 requires establishing and communicating AI-specific policies that translate the organization's top-level AI policy into operational direction for AI development, deployment, and use.

A.3 requires defining clear roles, responsibilities, and reporting lines for AI governance — for example, who owns AI risk decisions, who approves new AI systems, and who monitors compliance.

A.4 requires ensuring adequate resources — including compute, data, tooling, and skilled personnel — are allocated to develop, operate, and maintain AI systems responsibly.

A.5 operationalizes the impact-assessment process defined in Planning — requiring documented procedures for assessing effects on individuals and society before and during AI system deployment.

A.6 requires controls across the full AI system life cycle — design, development, verification/validation, deployment, operation, and decommissioning — including technical documentation and record-keeping aligned with EU AI Act Articles 11-12.

A.7 requires governance over the data used to train, validate, and operate AI systems — covering data quality, provenance, and management practices that reduce bias and error.

A.8 requires providing transparent information to affected parties — such as users and regulators — about how an AI system works, its limitations, and how to raise concerns.

A.9 requires controls ensuring AI systems are used responsibly within the organization, including human oversight, use-case restrictions, and safeguards against misuse — closely aligned with EU AI Act transparency and human-oversight obligations.

A.10 requires managing AI risk introduced by suppliers, vendors, and partners — including due diligence on third-party AI components and contractual controls over their use.

Pre-processing (reweighing or resampling training data before model training), in-processing (adversarial debiasing during training), and post-processing (adjusting decision thresholds after the model produces outputs).

LIME and SHAP are explainability techniques that approximate or attribute a model's predictions (local approximation vs. Shapley-value attribution). A model card documents a model's intended use and limitations; a datasheet documents the dataset used to train it.

AIMS metrics are performance indicators the organization defines to measure whether AI systems and the management system itself are operating as intended — feeding into internal audit and management review.

Drift monitoring detects when an AI model's input data (data drift) or the relationship between inputs and outputs (concept drift) changes over time, signaling that a model may need retraining or review to stay reliable and fair.

Bias can emerge or worsen after deployment as real-world data shifts, so ongoing bias monitoring in production complements the pre-deployment impact assessment and catches issues that only appear at scale.

ISO 19011 provides the guidelines for auditing management systems that AIMS internal audits (Clause 9.2) are based on, covering audit program management, auditor competence, and evidence-gathering.

Management review is top management's periodic evaluation of the AIMS's continuing suitability, adequacy, and effectiveness — considering audit results, AI risk changes, and performance against objectives.

A suitability review specifically asks whether the AI policy and AIMS scope still fit the organization's current AI landscape and external context — flagging when the AIMS needs to be re-scoped rather than just fine-tuned.

A nonconformity is any instance where an AIMS requirement — a clause requirement or an implemented Annex A control — is not met, triggering corrective action under Clause 10.1.

Root cause analysis identifies the underlying failure source behind a nonconformity — not just the symptom — so the corrective action addresses why the problem occurred and prevents recurrence.

Corrective action both fixes the immediate nonconformity and addresses its root cause to prevent recurrence, distinguishing it from a one-off fix that leaves the underlying issue unresolved.

Plan (set AIMS objectives) -> Do (implement the AIMS) -> Check (monitor and audit) -> Act (correct and improve) — the cycle that drives Clause 10's continual improvement requirement.

A major nonconformity reflects a systemic failure that blocks certification until resolved, while a minor nonconformity is an isolated lapse that can typically be addressed with an accepted corrective action plan.

Stage 1 reviews documentation readiness (often off-site); Stage 2 tests whether the AIMS is actually operating as documented (on-site evidence of implementation); an annual surveillance audit checks continued conformity; and a full recertification audit occurs every 3 years.