Question 26
Elara, the Head of AI Governance, is conducting due diligence on a promising Generative AI startup that wants to partner with her enterprise. The startup has provided a self-assessment claiming they follow best-in-class security practices. However, Elara's procurement policy dictates that self-assessments are insufficient. She requires a specific external audit report that validates the vendor's security controls as the absolute baseline requirement for engagement. The internal guidelines explicitly classify this specific certification as table stakes meaning if the vendor cannot produce it, they are immediately disqualified regardless of their other features. Which certification is Elara enforcing as this minimum requirement?
Question 27
A shared services organization is automating a repetitive back-office task with a consistent process across departments. As the CIO, you need to approve an AI automation approach that aligns with uniform execution and integrates with existing systems, with exceptions managed separately outside the automation flow. Which AI automation approach should be selected for this consistent, structured process?
Question 28
A multinational logistics firm has moved well beyond its initial experimental phase. As the Chief Strategy Officer, you conduct an annual review and find that AI is no longer operating as a set of standalone applications. Instead, AI solutions are now deployed enterprise-wide and are deeply embedded into core business processes like inventory management and route optimization. Furthermore, you note that business outcomes are clearly defined, with specific performance metrics tied directly to revenue impact and customer experience. According to the maturity model, which stage is represented by this shift to enterprise-wide integration and measurable operational value?
Question 29
As the AI Platform Lead, you are auditing the reliability of your production systems. You observe that the engineering team has moved away from manual, ad-hoc model updates. The organization has established automated pipelines that now handle consistent model deployment, monitoring, retraining, and rollback. This transition has resulted in strong operational reliability and allows the team to manage large-scale deployments with minimal manual intervention. Which specific characteristic of the "Managed" maturity stage does this shift in operational capability represent?
Question 30
Vertex Insurance based in Munich, uses an automated system to calculate life insurance premiums. Their legal team has already completed a Data Protection Impact Assessment (DPIA) and verified that all applicant data is processed with explicit consent and strict purpose limitation. However, a regulatory audit halts the deployment. The auditor is not interested in the data inputs or user consent. Instead, they flag a violation regarding the engineering lifecycle. Specifically, Vertex failed to implement a post-market monitoring system to continuously log and analyze whether the model's error rates or bias metrics drift over time after the initial release. The auditor cites a lack of a Quality Management System (QMS) for the software itself. Which regulatory framework requires ongoing post-deployment monitoring and a formal quality management system for AI models, beyond initial data protection compliance?