Week 6 self-check | AI GRCA Practice Lab

WEEK 6 · NIST AI RMF · NIST GOVERN

What's a realistic consequence of poor supplier governance?

Supplier governance only affects cost, not riskSupplier governance is optional for SaaS-based AI toolsNo consequence — suppliers are always trustworthyA supplier could change a model with no notice, degrading performance without the organisation knowing

WEEK 6 · NIST AI RMF · NIST GOVERN

Which is the best example of a 'developer' role, distinct from 'provider'?

The organisation marketing the finished AI product to customersThe team or organisation that builds the underlying model or system componentsThe end customer using the toolThe regulator overseeing the sector

WEEK 6 · NIST AI RMF · NIST GOVERN

How should 'approval gates' differ for a low-risk internal tool versus a high-risk customer-facing system?

Approval gates only apply to customer-facing systemsThey should be identical regardless of riskGates should be proportionate — more rigorous scrutiny and higher-level sign-off for higher-risk systemsLow-risk tools should have more gates than high-risk ones

WEEK 6 · NIST AI RMF · NIST GOVERN

What is the purpose of 'AI literacy and training' as a GOVERN activity?

Only developers need AI literacyIt's a nice-to-have with no real functionPolicies and controls only work if the people applying them understand the underlying AI riskTraining replaces the need for any policy

WEEK 6 · NIST AI RMF · NIST GOVERN

What distinguishes 'model ownership' from 'product ownership' in AI governance?

They are identical rolesModel ownership concerns the technical model itself; product ownership concerns the overall business offering built on itProduct ownership only applies to hardwareModel ownership is always more senior

WEEK 6 · NIST AI RMF · NIST GOVERN

Why does 'AI ownership' need to be distinct from general IT ownership?

AI systems raise specific risks (bias, hallucination, autonomy) that general IT ownership models may not coverIT ownership is always sufficientAI ownership is a redundant conceptAI systems carry no distinct risk from other software

WEEK 6 · NIST AI RMF · NIST GOVERN

In the developer/provider/deployer/user responsibility mapping, who is the 'deployer'?

Only the affected personThe software vendor's marketing teamThe person who trains the original modelThe organisation putting the AI system into use within its own operations

WEEK 6 · NIST AI RMF · NIST GOVERN

What is the primary purpose of the GOVERN function?

Establishing accountability, policy, ownership and risk culture for AIWriting release notesMapping affected peopleTesting model accuracy