Free readiness test
ISO/IEC 42001:2023 Lead Auditor: 40 free scenario questions
Plan, conduct and report audits of AI management systems against ISO/IEC 42001 and ISO 19011 principles.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
A telecom company seeks AIMS certification. Its context document states that it is only an 'AI customer' because all models come from vendors. During stage 1 you learn that the company fine-tunes a vendor's language model on its own call transcripts, wraps it in a customer-service assistant, and licenses that assistant to three regional operators under its own brand. It also uses an AI fraud-scoring service bought from a fintech. The AIMS manager argues that fine-tuning is 'configuration' and that the licensing deal is a commercial matter outside the AIMS. The AI policy, risk assessment and impact assessments all assume the customer role only. The regional operators' contracts promise 'responsible AI in line with ISO/IEC 42001', and one operator has already received complaints about the assistant giving incorrect billing advice.
What should the lead auditor conclude at stage 1?
- AThe customer role is acceptable, because the foundation model was developed by a vendor.
- BThe licensing deal should be excluded from the audit because it is a commercial arrangement.
- CThe organisation must obtain a separate certificate for each operator it licenses to.
- DRoles are incompletely determined; it is also a provider. Resolve before stage 2.