ISO-IEC-42001-Foundation GAICC ISO/IEC 42001 Foundation Exam
Exam detail Information
Certification body GAICC
Exam ISO/IEC 42001 Foundation
Standard ISO/IEC 42001:2023
Questions 40
Duration 60 minutes
Passing score 70%
Question format Multiple-choice and scenario-based
Delivery Online AI-proctored or approved test centre
Certification validity 3 years
Training requirement 16 contact hours
1. Exam overview and introduction
The ISO-IEC-42001-Foundation GAICC ISO/IEC 42001 Foundation Exam is designed to assess candidates’ understanding of ISO/IEC 42001, the international standard for Artificial Intelligence Management Systems (AIMS).
This certification introduces the principles, requirements, and practices organizations use to establish, implement, maintain, and continually improve an AI Management System. It helps learners understand how businesses can manage AI-related risks, promote responsible AI development, improve transparency, and establish governance throughout the AI lifecycle.
The ISO/IEC 42001 Foundation certification is suitable for IT professionals, AI practitioners, compliance specialists, information security professionals, auditors, project managers, consultants, and individuals interested in AI governance and responsible artificial intelligence.
Prepare for the ISO-IEC-42001-Foundation Exam with CertKingdom
CertKingdom provides ISO-IEC-42001-Foundation exam preparation resources designed to help candidates review important concepts and improve their understanding before attempting the certification exam.
Our preparation materials include practice questions, study resources, exam-focused explanations, and testing tools to support structured learning and revision.
Whether you are learning about AI governance for the first time or strengthening your understanding of AI management systems, CertKingdom offers resources to help organize your certification preparation.
2. Topics covered in ISO-IEC-42001-Foundation
The following subject areas provide a study framework based on the ISO/IEC 42001 standard. Confirm the precise examination objectives against the current GAICC exam syllabus.
1. Introduction to Artificial Intelligence Management Systems (AIMS).
2. Overview and purpose of ISO/IEC 42001.
3. Fundamental AI concepts and terminology.
4. AI governance principles and organizational responsibilities.
5. Context of the organization and interested parties.
6. Leadership, commitment, and AI management policies.
7. Planning and addressing AI-related risks and opportunities.
8. AI impact assessments and risk management.
9. Support, resources, competence, and awareness.
10. Documentation and information management.
11. Operational planning and control of AI systems.
12. AI system lifecycle management.
13. Performance evaluation and monitoring.
14. Internal audits and management reviews.
15. Nonconformity, corrective actions, and continual improvement.
16. Responsible AI, transparency, accountability, and human oversight.
Official GAICC exam content domains
The February 2026 GAICC Examination Content Outline identifies three major examination domains:
Exam domain Weight
Fundamentals of AI Governance and ISO/IEC 42001 Framework 40%
Core Components of the Artificial Intelligence Management System 40%
Responsible AI, Ethics, and Stakeholder Awareness 20%
Total 100%
The examination focuses on foundational knowledge and understanding rather than practical implementation or auditing. gaicc.org
3. What students search on Google, ChatGPT and other AI platforms
These are suggested search-intent questions based on common certification-preparation needs. They are not claimed to be verified Reddit or search-platform rankings.
1. What is the ISO-IEC-42001-Foundation GAICC certification?
2. How do I prepare for the ISO 42001 Foundation exam?
3. What are the topics covered in ISO 42001 Foundation?
4. Is ISO 42001 Foundation difficult?
5. What is the GAICC ISO 42001 Foundation exam format?
6. Where can I find ISO 42001 Foundation practice questions?
7. What is the passing score for the GAICC exam?
8. How much time is needed to prepare for ISO 42001 Foundation?
9. What are the benefits of ISO 42001 certification?
10. Which study materials are best for ISO 42001 Foundation?
1. Explain ISO/IEC 42001 in simple terms for beginners.
2. What is an Artificial Intelligence Management System (AIMS)?
3. Explain the main clauses of ISO 42001 with examples.
4. What is the difference between ISO 42001 and ISO 27001?
5. Explain AI governance, AI risk management, and responsible AI.
6. Create a study plan for the GAICC ISO 42001 Foundation exam.
7. Generate multiple-choice practice questions about ISO 42001.
8. Explain the Plan-Do-Check-Act cycle in ISO 42001.
9. What are the responsibilities of an AI governance professional?
10. Explain AI transparency, fairness, accountability, and bias.
1. Has anyone taken the GAICC ISO/IEC 42001 Foundation exam?
2. What should I study before attempting the exam?
3. Are the official GAICC training materials sufficient?
4. Which ISO 42001 topics should I prioritize?
5. Is previous AI experience necessary?
6. How useful is ISO 42001 Foundation for an IT career?
7. What is the difference between Foundation and Lead Implementer?
8. Are there any good ISO 42001 mock exams?
9. How can I understand the ISO 42001 clauses more easily?
10. What career opportunities are available after this certification?
– ISO 42001 Foundation full course for beginners.
– GAICC ISO 42001 Foundation exam preparation.
– ISO/IEC 42001 practice test with answers.
– AI Management System explained step by step.
– ISO 42001 certification study guide.
– ISO 42001 Foundation exam questions and explanations.
– Responsible AI and AI governance training.
– ISO 42001 Foundation mock test.
– ISO 42001 clauses 4 to 10 explained.
– How to pass the GAICC ISO 42001 Foundation exam.
Prepare for the GAICC ISO-IEC-42001-Foundation exam with CertKingdom practice questions, study materials, and exam preparation resources.
Examkingdom GAICC ISO-IEC-42001-Foundation Exam dumps Exam pdf
Best GAICC ISO-IEC-42001-Foundation dumps Downloads, GAICC ISO-IEC-42001-Foundation free Dumps at Certkingdom.com
QUESTION 1
A financial services organisation is establishing an AI management system to govern the use of machine
learning models in loan approval decisions. The organisation currently holds the role of AI producer
(developing models internally) and AI customer (deploying them in operations). During the initial scopesetting
phase under Clause 4.3, the organisation must determine which activities and AI systems fall within
the AIMS boundary. Which of the following factors should the organisation use to determine the scope?
A. The size of the organisation and the number of employees working on AI projects
B. The legal and regulatory requirements applicable to the organisation, its interested parties’ requirements, and the nature of the AI roles it holds
C. Whether the organisation has already obtained ISO 27001 certification for information security
D. The technical architecture and choice of machine learning frameworks used by the development team
E. The annual budget allocated to AI development and operational costs
Answer: B
Explanation:
The correct answer is: The legal and regulatory requirements applicable to the organisation, its
interested parties’ requirements, and the nature of the AI roles it holds.
Clause 4.3 requires organisations to determine the scope of the AI management system based on:
*External and internal issues relevant to the organisation’s purpose
*Requirements of interested parties (regulators, customers, employees, subjects of AI decisions)
*The AI roles the organisation holds, which directly determine which requirements and controls apply
In this scenario, the organisation’s dual role as both producer and customer means it must include both
development and deployment processes in scope. Regulatory requirements in financial services (such as fair
lending rules) and the requirements of loan applicants (as AI subjects) are central to scope determination.
Why the other options are incorrect:
*Organisation size: Scope is not determined by headcount or company size, but by the presence of AI
activities and interested parties who are affected.
*ISO 27001 certification status: While information security is important, the existence of other ISO
certifications does not determine AIMS scope. Scope is set independently based on AI governance requirements.
*Technical architecture: Framework choice is an implementation detail that follows after scope is
determined, not a determinant of scope itself.
*Budget allocation: Financial investment does not define the boundary of what must be governed;
governance scope is driven by risk and stakeholder exposure.
QUESTION 2
A healthcare organisation is preparing for ISO/IEC 42001 certification. It has documented its AI policy under
Clause 5.2 and assigned clear roles and responsibilities under Clause 5.3. The Chief Information Officer
believes the organisation has now fulfilled all leadership requirements in Clause 5.1. A compliance officer
points out that this interpretation may be incomplete. Which of the following statements best describes what
else Clause 5.1 requires of top management beyond a policy and role assignments?
A. Top management must also demonstrate leadership and commitment by allocating resources, ensuring
competence, establishing communication channels, and taking responsibility for the effectiveness of the AI management system
B. Top management must obtain ISO/IEC 42006 accreditation for their auditors before any certification audit can proceed
C. Top management must complete personal training certification as individuals before they can be considered compliant with Clause 5.1
D. Top management must establish a dedicated AI ethics committee separate from the main governing body to satisfy Clause 5.1 requirements
E. Top management must define climate change adaptation and mitigation strategies as part of their AI policy commitments
Answer: A
Explanation:
The correct answer is: Top management must also demonstrate leadership and commitment by
allocating resources, ensuring competence, establishing communication channels, and taking
responsibility for the effectiveness of the AI management system.
Clause 5.1 (Leadership and Commitment) requires top management to do more than create documents. The
standard demands active, demonstrable commitment including:
*Allocating necessary resources (people, budget, tools)
*Ensuring personnel have the competence to perform their AI governance roles
*Establishing internal and external communication mechanisms
*Taking personal accountability for the effectiveness of the AIMS
Policy and role definitions are necessary but not sufficient; they must be backed by visible resource
commitment and structural support from senior leadership.
Why the other options are incorrect:
*ISO/IEC 42006 accreditation: This applies to certification bodies that audit AIMS, not to the organisation’s
top management. It is a requirement for auditors, not for the certified organisation’s leadership.
*Personal training certification for individuals: ISO/IEC 42001 Foundation is an organisational
certification, not a personnel certification. Individuals do not need to hold a certificate; the organisation as a
whole is certified.
*Separate ethics committee: While responsible AI governance is important, the standard does not mandate
a separate ethics committee. Governance can be integrated with the existing governing body and top management structure.
*Climate change strategy in AI policy: While Clause 4.1 requires consideration of climate-related external
issues, detailed climate adaptation strategies are not a specific Clause 5.1 requirement. Climate is addressed
at the context level, not necessarily as a core policy commitment.
QUESTION 3
During a Stage 2 audit of an AI management system at a manufacturing company, the auditor examines
controls related to AI system impact assessment (Annex A, Clause A.5) and responsible use (Annex A, Clause
A.9). The auditor finds that the organisation has documented an impact assessment process that considers
fairness, transparency, and robustness. However, the auditor also discovers that the organisation treats
fairness and robustness as if they are interchangeable properties that can be optimised by a single metric.
When questioned, the organisation cannot explain why these properties sometimes conflict or require tradeoff
decisions. Which of the following correctly describes the auditor’s likely finding and the underlying reason?
A. This is a minor nonconformity because the organisation has an impact assessment process in place; the
auditor should recommend a follow-up training session on trustworthiness properties
B. This is a major nonconformity because Clause 6.1.4 requires impact assessment to address the
common trustworthiness properties and their potential conflicts; treating them as interchangeable
demonstrates inadequate understanding of responsible AI governance
C. This is not a nonconformity at all because the organisation has documented fairness, transparency, and
robustness in its impact assessment, which fulfils all Clause 6.1.4 requirements
D. This is a major nonconformity because the organisation failed to obtain guidance from ISO/IEC
42005:2025 before conducting its impact assessments
E. This is a minor nonconformity because robustness is not mentioned in Annex A.5 controls and therefore
should not have been included in the assessment
Answer: B
Explanation:
The correct answer is: This is a major nonconformity because Clause 6.1.4 requires impact
assessment to address the common trustworthiness properties and their potential conflicts;
treating them as interchangeable demonstrates inadequate understanding of responsible AI
governance.
The Foundation syllabus teaches that responsible AI, within the context of ISO/IEC 42001, is not merely an
ethical aspiration but an engineering discipline. The common trustworthiness properties (fairness,
transparency, explainability, robustness, and safety) are engineering properties that often conflict and require
deliberate trade-off decisions:
*Fairness vs. Robustness: Optimising a model for fairness (equal treatment across demographic groups)
may reduce robustness against adversarial inputs or edge cases.
*Transparency vs. Performance: Highly interpretable models are often less performant than black-box systems.
*Safety vs. Autonomy: Greater safety constraints may limit system autonomy and responsiveness.
An organisation that treats these as interchangeable or assumes a single metric satisfies all of them
demonstrates a fundamental misunderstanding of responsible AI governance. Clause 6.1.4 impact assessment
must explicitly consider these properties and acknowledge their tensions. This is a major nonconformity
because it goes to the heart of the management system’s ability to govern AI responsibly.
Why the other options are incorrect:
*Minor nonconformity / training recommendation: The deficiency is not a simple knowledge gap; it
reflects a structural weakness in the impact assessment process. A major nonconformity requires corrective
action (process redesign), not just training.
*Not a nonconformity: Documenting properties is necessary but insufficient. Understanding and managing
their conflicts is essential to Clause 6.1.4 compliance.
*Failure to reference ISO/IEC 42005:2025: ISO/IEC 42005 provides methodological guidance (a forwardlooking
enabler), but the Foundation certification tests clause-level requirements. Not citing 42005 is not itself
a 42001 nonconformity; however, the lack of understanding about property conflicts that 42005 addresses is the real issue.
*Robustness not in A.5: Robustness is a legitimate trustworthiness property to assess within impact
assessment controls and is addressed in the responsible use context.
QUESTION 4
A financial services organisation is establishing its AI management system and has identified that it uses AI
for credit risk assessment and customer-facing loan recommendation. The organisation also procures AIpowered
fraud detection services from a third-party vendor. During the scoping exercise under Clause 4.3,
the organisation must determine which AI systems fall within the scope of its AIMS. Which of the following
statements correctly describe how the organisation’s AI roles affect the scope of its AI management system?
A. As an AI customer for the fraud detection service, the organisation has full responsibility for the AI
system’s outputs and must include it in scope regardless of the vendor’s controls.
B. The organisation acts as an AI producer for both the credit risk assessment and loan recommendation
systems it develops internally, and as an AI customer for the third-party fraud detection service; the
scope should reflect each role separately and the differing applicability of controls.
C. Only AI systems where the organisation holds the AI producer role must be included in scope; AI
customer and AI partner roles fall outside the AIMS boundary.
D. All three systems must be included in scope with identical control requirements because the
organisation ultimately bears regulatory responsibility for all AI it deploys.
E. The organisation should exclude the fraud detection service from scope because it is a third-party
system and the organisation cannot enforce controls on external vendors.
Answer: B
Explanation:
The correct answer is the second option. Clause 4.3 and NOTE 1 to Clause 4.1 establish that an organisation
can hold multiple AI roles: producer (developing or commissioning AI systems), customer (procuring and using
AI systems), partner (collaborating on AI systems), subject (affected by AI), and relevant authority (regulating
AI). Each role carries different responsibilities and determines which requirements and controls apply. In this
scenario, the organisation is both a producer (credit systems) and a customer (fraud detection). The scope
must account for these distinct roles and the fact that applicability differs—for instance, controls around AI
system design and training apply to producer roles, while controls around vendor management and responsible
use apply to customer roles. The first option is incorrect because AI customers do not assume full responsibility
for vendor systems; they have specific customer-side responsibilities under the standard. The third option
oversimplifies by excluding customer roles entirely, which would create a non-conforming scope. The fourth
option incorrectly assumes all systems must have identical control application regardless of role. The fifth
option incorrectly assumes vendor systems can be excluded; the standard requires organisations to address
third-party AI within their scope through appropriate controls (such as A.2.3 alignment and vendor oversight).
QUESTION 5
An AI governance officer at a healthcare provider is reviewing Clause 2 (Normative references) and Clause 3
(Terms and definitions) of ISO/IEC 42001 to understand the standard’s foundational vocabulary and
dependencies. The officer notes that ISO/IEC 22989:2022 is referenced normatively, and that Clause 3 lists
26 defined terms. When conducting an audit, the auditor will need to verify the organisation’s understanding
of certain key concepts. Which of the following correctly identifies the normative reference and explains how
it relates to the standard’s definitions?
A. ISO/IEC 22989:2022 is the only normative reference in Clause 2, and ISO/IEC 42001 inherits the AI
vocabulary from it by reference rather than reprinting definitions, ensuring consistency across the ISO
AI standards family.
B. Clause 2 contains three normative references: ISO/IEC 22989:2022, ISO/IEC 23894:2023, and ISO/IEC
38507:2022; all three are essential for understanding AI governance requirements.
C. ISO/IEC 22989:2022 is listed in the Bibliography (an informative reference) rather than as a normative
reference, allowing organisations to use alternative AI vocabulary standards if preferred.
D. Clause 3 defines 26 terms in nine separate groups aligned with the nine control clauses in Annex A,
making it easy to map each term to its corresponding control.
E. The normative reference is ISO/IEC 23894:2023 for risk management; ISO/IEC 22989:2022 appears only
as a SOURCE attribution in Clause 3.
Answer: A
Explanation:
The correct answer is the first option. Clause 2 of ISO/IEC 42001 contains exactly one normative reference:
ISO/IEC 22989:2022 (Artificial intelligence — Concepts and terminology). By incorporating this normatively,
ISO/IEC 42001 ensures that the AI vocabulary used throughout the standard is consistent with the broader ISO
AI standards family. The standard does not reprint these definitions in Clause 3; instead, it defines only the 26
terms specific to management system requirements (3.1 to 3.26 as a flat list) and relies on ISO/IEC 22989:2022
for core AI concepts. The second option is incorrect; Clause 2 contains only one normative reference (the
enabler confirms this explicitly). ISO/IEC 23894 and ISO/IEC 38507 are guidance documents mentioned in the
broader standards family but are not normative references in Clause 2. The third option conflates the
Bibliography with the normative references section; ISO/IEC 22989 is normative, not informative. The fourth
option incorrectly describes the structure of Clause 3 as grouped; the enabler states Clause 3 is a flat list with
CertKingdom is an online certification exam preparation provider offering practice questions, study guides, and testing resources for IT and professional certifications.
1. Daniel Foster – United States
The ISO-IEC-42001-Foundation preparation materials helped me understand the fundamentals of AI governance and the purpose of an Artificial Intelligence Management System.
2. Olivia Bennett – United Kingdom
I found the study resources useful for reviewing ISO 42001 terminology, organizational context, and the main requirements of the standard.
3. Lucas Schneider – Germany
The practice questions helped me identify areas that required additional revision, especially AI risk management and governance principles.
4. Sophia Martin – France
The preparation materials provided a structured way to study responsible AI, transparency, and accountability.
5. Ethan Williams – Australia
I appreciated the organized study content covering the ISO 42001 framework and its relationship with other management standards.
6. Isabella Rossi – Italy
The exam preparation resources helped me review AI management system concepts and understand the importance of ethical AI practices.
7. Noah Anderson – Canada
The topic-based questions made it easier to revise AI governance fundamentals and important ISO 42001 concepts.
8. Amelia Johnson – New Zealand
I found the testing resources helpful for checking my understanding of AIMS requirements and the standard’s main clauses.
9. Alexander Müller – Switzerland
The study materials helped me organize my preparation around risk assessment, AI policies, and continual improvement.
10. Mia Thompson – Ireland
The practice exercises were useful for revising the key principles of responsible artificial intelligence and stakeholder awareness.
11. Benjamin Clark – Singapore
The preparation content covered important areas of AI governance, including transparency, fairness, and accountability.
12. Charlotte Evans – Netherlands
I liked the structured approach to studying ISO/IEC 42001. It helped me focus on the important foundation-level concepts.
13. William Taylor – Sweden
The exam preparation resources helped me understand AI management systems and the importance of organizational leadership.
14. Grace Wilson – United Arab Emirates
The practice materials provided a useful revision framework for ISO 42001, especially AI risk and impact assessment concepts.
15. James Cooper – South Africa
The study resources helped me review the examination domains and improve my understanding of responsible AI governance.
Looking for ISO 42001 Foundation exam preparation? Explore CertKingdom practice questions, study guides, and testing resources.
Q1. What is the GAICC ISO-IEC-42001-Foundation certification?
It is a foundation-level certification offered by the Global AI Certification Council (GAICC). It validates a candidate’s understanding of ISO/IEC 42001:2023 and Artificial Intelligence Management Systems.
Q2. What is the main purpose of ISO/IEC 42001?
ISO/IEC 42001 provides requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System within an organization.
Q3. How many questions are in the GAICC ISO 42001 Foundation exam?
According to the February 2026 GAICC examination outline, the exam contains 40 questions, including 35 scored questions and 5 unscored pre-test questions.
Q4. How much time is allowed for the exam?
Candidates receive 60 minutes to complete the examination.
Q5. What is the passing score for the GAICC ISO 42001 Foundation exam?
The published examination outline specifies a minimum scaled passing score of 70%.
Q6. What topics are covered in the ISO 42001 Foundation exam?
The examination covers three main domains: AI governance fundamentals, core AIMS components, and responsible AI, ethics, and stakeholder awareness.
Q7. Is previous AI experience required for this certification?
GAICC describes the Foundation certification as open entry without a professional experience requirement. However, candidates must meet its stated training eligibility requirements.
Q8. Is ISO 42001 Foundation suitable for beginners?
Yes. It is designed to introduce candidates to AI governance, management system requirements, responsible AI, and the fundamentals of ISO/IEC 42001.
Q9. What is an Artificial Intelligence Management System (AIMS)?
An AIMS is an organizational framework of policies, objectives, processes, and controls for managing the responsible development, provision, and use of AI systems.
Q10. What are the three examination domains?
– Fundamentals of AI Governance and ISO/IEC 42001 Framework – 40%.
– Core Components of AIMS – 40%.
– Responsible AI, Ethics, and Stakeholder Awareness – 20%.
Q11. What is the difference between ISO 42001 and ISO 27001?
ISO/IEC 42001 focuses on AI management systems and responsible AI governance, while ISO/IEC 27001 focuses on information security management systems.
Q12. What is the Plan-Do-Check-Act (PDCA) cycle in ISO 42001?
PDCA is a continual improvement approach involving planning objectives, implementing processes, evaluating performance, and taking corrective improvement actions.
Q13. What is the validity period of the GAICC ISO 42001 Foundation certification?
According to the GAICC examination outline, the certification is valid for three years, subject to its renewal requirements.
Q14. Where can I find ISO-IEC-42001-Foundation practice questions?
Candidates can use official GAICC training resources, ISO/IEC 42001 learning materials, mock examinations, and third-party preparation resources such as CertKingdom.
Q15. How can I prepare effectively for the ISO-IEC-42001-Foundation exam?
Review the official exam syllabus, understand all three examination domains, study ISO 42001 terminology and clauses, practice multiple-choice questions, and revise responsible AI and governance principles.
