AI Act / ISO 42001 / NIST AI RMF

AI Governance Professional

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

A cross-framework capstone spanning the EU AI Act, ISO/IEC 42001, and the NIST AI RMF for practitioners building enterprise AI governance programmes.

13 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 13

An organisation deploys a high-risk AI system in the EU and wants a single governance programme covering legal compliance and management-system assurance. Which combination is most directly relevant?

Only the NIST AI RMF, since it is legally binding in the EUThe EU AI Act (legal obligations) alongside ISO/IEC 42001 (certifiable AIMS) and, optionally, the NIST AI RMF (practical risk guidance)PCI DSS, since it is the leading AI governance standardGDPR alone, with no AI-specific framework needed

Question 2 of 13

How do the EU AI Act's risk tiers relate to ISO/IEC 42001's Clause 8.2 AI risk assessment?

Only prohibited-practice systems require any risk assessment under either frameworkISO/IEC 42001 certification automatically reclassifies a high-risk AI system as minimal-risk under the ActThe Act's risk classification (e.g. high-risk under Annex III) can inform how an organisation prioritises and scopes its AIMS risk assessment and control intensity for that specific systemThey are unrelated; ISO/IEC 42001 has no concept of risk-based prioritisation

Question 3 of 13

Which of the following are common building blocks across the AI Act, ISO/IEC 42001, and the NIST AI RMF, despite their different legal status?

Select all that apply.

Documentation supporting monitoring and continual improvementSome form of risk assessment tied to context/intended useHuman oversight or accountable ownership of AI decisionsA shared mandatory numeric risk score defined identically in all three

Question 4 of 13

A provider of a general-purpose AI model with systemic risk under the AI Act (Article 55) is also pursuing ISO/IEC 42001 certification. How might its AIMS help with Article 55 obligations?

It cannot help at all, since ISO/IEC 42001 has no relevance to GPAI providersGPAI providers are exempt from ISO/IEC 42001 by definitionArticle 55 obligations are automatically satisfied by any ISO certificationAIMS processes for risk assessment, incident tracking (Clause 8), and monitoring (Clause 9) can provide much of the underlying discipline needed to support Article 55's model evaluation and serious-incident reporting duties, though legal-specific obligations still need direct mapping

Question 5 of 13

How does the NIST AI RMF's Generative AI Profile relate to EU AI Act transparency obligations (e.g. Article 50) for a company operating in both the US and EU?

Only Article 5's prohibited practices are relevant to generative AIThe Generative AI Profile overrides EU law for EU operationsThey are entirely unrelated and cannot inform each otherThe Generative AI Profile's practical risk considerations (e.g. content provenance, disclosure of AI-generated content) can support operational practices that also help satisfy the Act's transparency obligations, even though the Profile itself is not EU law

Question 6 of 13

An organisation is designing its AI governance operating model. Which structure best reflects good practice across these frameworks?

Governance should be entirely outsourced with zero internal ownership or visibilityA layered model: board/top-management accountability (Govern/Clause 5), a cross-functional risk process (Map/Measure/Clause 8.2), and clear ownership of treatment and monitoring decisions (Manage/Clause 8-10)No governance structure is needed if the organisation has a privacy policyA single junior engineer personally responsible for all legal, risk, and technical decisions with no escalation path

Question 7 of 13

Which roles would typically need to collaborate in a mature enterprise AI governance programme spanning legal, technical, and risk-management framework requirements?

Select all that apply.

An unrelated facilities management vendorLegal/compliance (AI Act obligations)Risk management (Map/Measure/Manage-style activities and ISO 42001 Clause 8.2)Data science/ML engineering (technical risk, model behaviour)

Question 8 of 13

A company markets its AI product as 'AI Act compliant' solely because it holds ISO/IEC 42001 certification. What is the key issue with this claim?

There is no issue — the two are legally equivalent and interchangeableISO/IEC 42001 certification is legally impossible to obtain, so the claim must be falseThe AI Act does not apply to any certified organisation, making the claim accurate by definitionISO/IEC 42001 certification is a voluntary management-system standard that can support compliance but does not itself constitute legal certification of AI Act compliance, which is a distinct regulatory determination

Question 9 of 13

Why is 'human oversight' treated as a recurring theme across the AI Act (Article 14), ISO/IEC 42001 (competence/operational control), and the NIST AI RMF (Manage function)?

Human oversight is discouraged in all three frameworks in favour of full automationIt is coincidental and the frameworks do not actually share this themeBecause meaningful human involvement in reviewing, overseeing, or intervening in AI system decisions is widely recognised across legal and voluntary frameworks as a key risk-mitigation and accountability mechanismOnly the AI Act mentions human oversight; the other two frameworks are silent on it

Question 10 of 13

An enterprise AI governance programme needs to track which obligations apply to which AI systems across multiple frameworks. What is a sound design principle?

Avoid maintaining any inventory since AI systems change too often to trackMaintain the same undifferentiated checklist for every AI system regardless of risk, geography, or applicable frameworkMaintain an AI system inventory tagged with applicable frameworks, risk classification, and framework-specific obligations, enabling risk-based prioritisation and gap trackingRely solely on annual manual memory recall with no documentation

Question 11 of 13

A single well-designed AI risk register, mapped to relevant clauses/articles across the AI Act, ISO/IEC 42001, and the NIST AI RMF, can reduce duplicated effort compared to maintaining three fully independent, disconnected compliance programmes.

TrueFalse

Question 12 of 13

What is the primary reason a company might invest in AI governance capability beyond the strict minimum legal requirement in its home jurisdiction?

Only companies with no international customers need any AI governanceExceeding legal minimums is prohibited by the AI ActAI regulation is evolving rapidly and unevenly across jurisdictions, so building adaptable, framework-informed governance capability reduces the risk of costly retrofitting as new laws (or enforcement) emergeThere is never a good reason to exceed minimum legal requirements

Question 13 of 13

How should 'AI literacy' obligations under AI Act Article 4 interact with ISO/IEC 42001's Clause 7.2 competence requirements?

They address entirely unrelated topics with no overlapBoth are concerned with ensuring people involved with AI systems have sufficient understanding to make informed decisions and manage risk, so competence/training programmes can often be designed to satisfy both simultaneouslyAI literacy is a marketing term with no formal counterpart in either frameworkClause 7.2 only applies to competitors' staff, never the organisation's own

0 of 13 answered