ai governance
AI security interview questions tagged ai governance, across every topic.
11 questions · 5 unlocked for you
Concepts behind "ai governance"
Explanations of the mechanisms these questions rely on.
Foundational
The NIST AI Risk Management FrameworkThe NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is a voluntary framework for managing risks from AI systems across their lifecycle. It organises the work into four functions: Govern (culture, policy, roles), Map (context and risks of each system), Measure (analysis and testing) and Manage (prioritising and treating risks). It describes characteristics of trustworthy AI, including security and resilience, and has companion profiles such as the Generative AI Profile (NIST AI 600-1). It does not certify anything; its value is a shared structure that engineering controls can hang from. AI Governance & Risk
Foundational
The EU AI Act for EngineersThe EU AI Act regulates AI systems by risk. A short list of practices is prohibited; high-risk systems, such as those used in employment, credit, education or critical infrastructure, must meet requirements including risk management, data governance, logging, human oversight, accuracy, robustness and cybersecurity; some systems carry transparency duties; and providers of general-purpose AI models have their own obligations. It applies to providers and deployers outside the EU when their systems are used in the EU. Dates have shifted: the 2026 Digital Omnibus moved most high-risk deadlines to December 2027 and August 2028. AI Governance & Risk
Foundational
ISO/IEC 42001ISO/IEC 42001:2023 specifies requirements for an AI management system: the policies, roles, processes and controls an organisation uses to develop, provide or use AI responsibly. It follows the same structure as ISO/IEC 27001, so organisations with an information security management system can extend it. It requires AI risk assessment and AI system impact assessment, includes a reference set of controls, and is certifiable by accredited bodies. Certification shows a functioning management system, not that every AI system is safe or legally compliant. AI Governance & Risk
Core
Assessing an AI System's RiskA practical AI risk assessment turns frameworks into a repeatable intake: register the use case, ask a small set of questions that decide risk (purpose and affected people, data, autonomy and actions, exposure to untrusted input, model source, regulatory category), assign a tier, apply the controls that tier requires, and record owners, residual risk and review dates. Done well, it is fast for low-risk uses and thorough for high-risk ones, and it produces the evidence that the NIST AI RMF, ISO/IEC 42001 and the EU AI Act all ask for. AI Governance & RiskSign in