ISO 23894

ISO/IEC 23894 Advanced

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Complex AI risk management scenarios: cascading risk, third-party model risk, and integrating 23894 guidance across a risk-management ecosystem.

10 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 10

An organisation integrates a third-party foundation model into several downstream products. How should AI risk management approach 'inherited' risk from the base model?

Downstream risk assessment should consider risks inherited from the base model (e.g. known limitations, bias, robustness issues) alongside risks introduced by the specific fine-tuning/deployment contextOnly the vendor's own risk assessment needs to be consulted, with no independent evaluationInherited risk can be ignored entirely since the vendor is responsibleFoundation models carry no risk once released publicly

Question 2 of 10

What is 'cascading risk' in the context of interconnected AI systems, and why is it relevant to AI risk management guidance?

A term with no established meaningRisk that propagates from one system or component to dependent downstream systems, relevant because AI systems are often embedded in larger pipelines where a failure in one component can affect othersA risk that only applies to physical infrastructure, never softwareA risk category that ISO 31000-aligned guidance explicitly excludes

Question 3 of 10

Which of the following considerations are important when establishing risk criteria for an AI system used in a high-stakes context (e.g. credit decisions)?

Select all that apply.

Legal and regulatory obligations relevant to the use caseThe organisation's tolerance for reputational riskThe potential severity of harm to affected individualsThe internal office seating chart

Question 4 of 10

How might an organisation use scenario analysis as part of AI risk identification for a novel AI use case with limited historical incident data?

Scenario analysis replaces the need for any risk treatmentScenario analysis is inapplicable to AI risk managementOnly quantitative, data-driven analysis is permitted under the guidanceScenario analysis can help surface plausible risk events and their potential consequences even where historical data is sparse, complementing data-driven risk analysis

Question 5 of 10

A risk owner accepts residual risk for an AI system without documenting the rationale. What governance weakness does this illustrate?

It undermines accountability and traceability, both of which the recording and reporting guidance is intended to supportNo weakness — undocumented acceptance is best practiceRisk acceptance never needs a designated ownerDocumentation is only relevant for risks that are treated, never accepted

Question 6 of 10

ISO/IEC 23894 guidance is intended to be adaptable, recognising that organisations differ in size, sector, and the maturity of their AI risk management practices.

TrueFalse

Question 7 of 10

Why might 'risk communication' with affected individuals or the public be a more prominent consideration for certain AI use cases than for typical IT risk management?

It is never more prominent — the considerations are identicalCommunication with affected individuals is explicitly out of scope for any AI risk guidanceOnly regulators are considered 'affected parties' under any circumstancesSome AI systems can materially affect individuals' rights, opportunities or wellbeing (e.g. in hiring, lending, or public services), making transparency and communication with affected parties more significant

Question 8 of 10

How should an organisation reassess AI risk when a deployed model exhibits performance drift detected through monitoring?

Only the engineering team needs to be aware, with no risk governance involvementDetected drift should trigger a reassessment of whether existing risk evaluations, controls and residual risk acceptance remain valid, consistent with the monitoring-and-review step feeding back into the risk management processDrift detection has no bearing on risk assessmentThe original risk assessment remains valid indefinitely regardless of drift

Question 9 of 10

Which functions within an organisation might reasonably be involved in AI risk management activities for a significant AI system, reflecting the guidance's emphasis on broad stakeholder involvement?

Select all that apply.

The organisation's payroll processing vendor, unrelated to the AI systemLegal and complianceData science / engineeringBusiness owners of the affected process

Question 10 of 10

What is the value of applying ISO/IEC 23894 guidance even where an organisation is not pursuing ISO/IEC 42001 certification?

There is no value without pursuing certificationGuidance documents have no practical application outside formal auditsThe risk management guidance can be applied standalone to strengthen AI governance practices and risk documentation, independent of pursuing a certifiable management systemISO/IEC 23894 cannot be used unless ISO/IEC 42001 certification is also obtained

0 of 10 answered