NIST AI RMF Alignment CRAGE Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard

   A hospital network is implementing the NIST AI RMF for its diagnostic AI systems. The network has an existing patient-safety governance structure. The AI governance lead proposes creating a separate AI risk committee, but the chief medical officer argues that AI risks should be managed within the existing patient-safety committee. Which approach best aligns with the RMF's guidance on integration?

   • AIntegrate AI risk oversight into the existing patient-safety committee, adding AI-specific expertise as needed.
   • BWait for the AI vendor to provide a risk management framework before integrating.
   • CCreate a separate AI risk committee to ensure dedicated attention to AI risks.
   • DAssign AI risk oversight to the IT department because AI systems are technical.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   An e-commerce company is using the NIST AI RMF to assess risks of its recommendation engine. The risk team has completed the Map function and now needs to measure the identified risks. Which combination of approaches best reflects the Measure function's guidance?

   • ARely solely on quantitative metrics because they are objective and reproducible.
   • BDefer measurement until after a risk incident occurs to avoid unnecessary analysis.
   • CConduct only qualitative expert reviews to avoid the cost of data collection.
   • DUse both quantitative metrics, such as click-through rate disparities across user groups, and qualitative assessments, such as user feedback on recommendation relevance.
   Reveal Solution Discussion Select an answer first