Title: Quiz 11 — AI Governance Frameworks: NIST AI RMF, ISO/IEC 42001, and the EU AI Act
Course: AIINFRA 302: AI Security, Guardrails & Governance > Section: Week 11 — AI Governance Frameworks: NIST AI RMF, ISO/IEC 42001, and the EU AI Act

Q: Which NIST AI RMF function is described as "cross-cutting" and touches all the others?
- MAP
- MEASURE
- GOVERN
- MANAGE
A: GOVERN

Q: As of this course, NIST has released a formal "AI RMF 2.0" that replaces the 1.0 framework.
- True
- False
A: False

Q: Which of the following is true about ISO/IEC 42001:2023?
- It is a binding law enforced by the EU
- It is a voluntary, certifiable AI management system standard
- It replaces the NIST AI RMF
- It only applies to GPAI model providers
A: It is a voluntary, certifiable AI management system standard

Q: Name the companion standard, released in 2025, that provides additional guidance specifically on AI impact assessments alongside ISO/IEC 42001.
Feedback: Sample/expected answer: ISO/IEC 42005:2025

Q: Under the EU AI Act, when did obligations for General-Purpose AI (GPAI) model providers take effect?
- 2 Feb 2025
- 2 Aug 2025
- 2 Aug 2026
- 2 Aug 2028
A: 2 Aug 2025

Q: The June 2026 Digital Omnibus extended the transition deadline for certain high-risk AI embedded in already-regulated products to 2 Aug 2028.
- True
- False
A: True

Q: A vendor tells you their product is "NIST AI RMF certified." What is wrong with this claim?
Feedback: Sample/expected answer: There is no such certification — NIST AI RMF is a voluntary framework with no certification program; only ISO/IEC 42001 offers certifiable status.

Q: A U.S.-based company deploys an AI hiring tool that screens job candidates located in the EU. Under the EU AI Act, is this company in scope?
- No, the Act only applies to companies headquartered in the EU
- No, the Act only applies to the original model provider, not deployers
- Yes, the Act is extraterritorial and covers deployers whose systems affect the EU market
- Yes, but only if the company has an EU subsidiary
A: Yes, the Act is extraterritorial and covers deployers whose systems affect the EU market