ISO 23894

ISO/IEC 23894 Practitioner

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Applying structured AI risk management in practice: sources of risk, stakeholder communication, and recording/reporting.

11 questions · 75% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 11

Which of the following are examples of AI-specific sources of risk that ISO/IEC 23894 guidance highlights, beyond generic IT risk sources?

Select all that apply.

Lack of transparency/explainability in a model's decision-makingThe organisation's office lease termsData quality and representativeness used to train a modelComplexity and evolving behaviour of AI systems over their lifecycle

Question 2 of 11

How does ISO/IEC 23894 suggest organisations should approach 'communication and consultation' regarding AI risk?

Communication and consultation with internal and external stakeholders should occur throughout the risk management process, informed by their perspectivesCommunication should be avoided to prevent liabilityConsultation is only required once, after the AI system has already been deployedOnly the AI development team should ever be consulted

Question 3 of 11

What is the purpose of 'recording and reporting' AI risk management activities under Clause 6.6-related guidance?

To communicate risk management activities and outcomes, support decision-making, and provide a basis for improving the processTo eliminate the need for any monitoringIt has no defined purpose beyond bureaucracyOnly external regulators are permitted to see these records

Question 4 of 11

How should risk criteria be established when applying ISO/IEC 23894-aligned AI risk management?

Criteria must be identical across every organisation with no customisationRisk criteria are irrelevant to AI risk managementOnly financial criteria may be used, never ethical or societal onesCriteria should reflect the organisation's values, objectives and resources, and be consistent with its risk management framework, then used to evaluate the significance of risk

Question 5 of 11

ISO/IEC 23894 explicitly recognises that AI risk can affect not only the organisation itself but also individuals and society more broadly.

TrueFalse

Question 6 of 11

How does 'risk treatment' typically interact with 'residual risk' in an AI context?

After treatment, some residual risk generally remains, which should be identified, evaluated, and where appropriate accepted by an authorised partyResidual risk is not a meaningful concept in AI risk managementResidual risk only matters for financial risk, not AI riskRisk treatment always eliminates all risk completely, leaving no residual risk

Question 7 of 11

Why is 'monitoring and review' particularly emphasised for AI systems compared to some traditional IT systems?

It is not particularly emphasised — AI and traditional IT are treated identicallyAI systems can exhibit changing behaviour over time (e.g. through retraining, drift, or changing inputs), so risk profiles may shift after initial deploymentMonitoring is only relevant to hardware, not software-based AI systemsTraditional IT systems never require monitoring

Question 8 of 11

What role can a documented AI risk register play in supporting both ISO/IEC 23894-aligned practice and ISO/IEC 42001 AIMS Clause 8.2?

A risk register is only relevant to financial auditsA shared, structured risk register can serve as a practical artefact linking detailed AI risk management guidance (23894) with the broader AI management system requirements (42001)No role — the two are entirely separate with nothing shared between themRisk registers are prohibited from being reused across frameworks

Question 9 of 11

Which of the following are examples of risk treatment options an organisation might apply to a high-risk AI system under this guidance?

Select all that apply.

Adding human review/oversight for high-stakes decisionsImproving training data quality and diversityLimiting the system's deployment context to reduce exposureIgnoring the risk since the system already works most of the time

Question 10 of 11

What is the relationship between 'risk appetite' and AI risk treatment decisions?

Risk appetite has no bearing on AI risk treatmentAn organisation's risk appetite (how much risk it is willing to accept) informs which risk treatment options are acceptable and when residual risk can be formally acceptedRisk appetite only applies to financial institutionsRisk appetite is fixed by ISO/IEC 23894 itself with no organisational discretion

Question 11 of 11

Under ISO/IEC 23894-aligned practice, risk assessment for an AI system should generally be revisited when there is a significant change to the system, its context of use, or its data.

TrueFalse

0 of 11 answered