Hard Difficulty Questions

Ensuring the AI can explain itself.

Why it fails: Accountability in the NIST AI RMF assigns defined responsibility for AI outcomes across the lifecycle, not self-explanation. Explainability belongs to the 'Explainable and Interpretable' characteristic, so this option answers a different trustworthiness concern. It tempts because transparency and accountability are often paired, but the stem asks what the principle addresses.

Making sure the model is free of bugs.

Why it fails: Accountability addresses who is answerable for an AI system's outcomes, including documentation, oversight and redress; bug-freeness is a software quality attribute. It is tempting because defect-free models are desirable, but bug elimination belongs to testing and validation, whereas accountability assigns human responsibility across the lifecycle.

Ensuring that the AI system is fast.

Why it fails: Accountability concerns assigning responsibility for AI outcomes, documenting decisions and enabling redress; processing speed is an engineering performance metric with no bearing on governance. It is tempting because faster systems are desirable, but speed belongs to operational requirements, whereas accountability addresses who answers for the system's effects.

The risk assessment template is 20 pages long.

Why it fails: Template length is a documentation usability issue, not a governance-structure failure; the ERM still assigns ownership and oversight. A 20-page template may suit heavily regulated sectors needing exhaustive capture, but structure concerns roles and accountability, not form length.

The AI risk register is updated annually instead of monthly.

Why it fails: Annual review is a cadence weakness, not a governance-structure failure; the register still exists with owners and escalation paths. Monthly updates suit fast-moving AI models, but governance structure concerns accountability, oversight bodies and decision rights, not refresh frequency.

The AI risk committee meets quarterly rather than monthly.

Why it fails: Quarterly meetings can still provide effective oversight; frequency alone does not evidence a governance failure. A genuine failure would be absent AI expertise, unclear accountability, or no reporting line to the board. It is tempting because meeting cadence is easy to measure, but governance adequacy depends on mandate and authority, not schedule.

Outsource all AI risk management to a third-party consultant.

Why it fails: Outsourcing transfers execution to a vendor while accountability for AI risk remains with the organisation's own board and ERM owners. It is tempting where internal AI expertise is thin, but third-party consultants support assessment; they cannot own the risk appetite, register entries or reporting lines that ERM integration requires.

Prohibit all AI initiatives that carry any inherent risk.

Why it fails: Prohibiting every initiative with inherent risk eliminates the residual-risk treatment and monitoring that ERM integration exists to provide. It is tempting as a defensive posture after an incident, yet ERM expects risks to be assessed, mitigated and accepted within appetite, not avoided wholesale.

Updating the SOC2 Type II report

Why it fails: A SOC 2 Type II report evidences controls over time for assurance purposes, not the contextual risk identification Map requires. Map demands documenting purpose, deployment context, and affected stakeholders. SOC 2 is tempting because it demonstrates governance maturity, but it reports on existing controls rather than framing the autonomous system's risk landscape.

Automating the model deployment pipeline

Why it fails: Automating deployment addresses operational efficiency, sitting outside the Map function's remit of establishing context and identifying risks. Map requires documenting intended purpose, affected populations, and risk tolerances. Pipeline automation is tempting as governance tooling, but it neither characterises the system nor enumerates its risks, which Map specifically requires.

Conducting a quarterly penetration test

Why it fails: Penetration testing validates security controls, aligning with the Measure or Manage functions, not Map. Mapping requires documenting context, purpose, and risk identification for the autonomous system. Penetration testing is tempting because it surfaces vulnerabilities, but it produces evidence after deployment rather than the contextual risk framing Map demands.

Automatic social media integration.

Why it fails: Social media integration has no bearing on documenting model validation, lineage, or audit evidence that regulators demand. It tempts because it sounds like broad platform connectivity, and would be relevant for customer engagement or sentiment monitoring, not regulatory model risk compliance.

The ability to run models on mobile devices.

Why it fails: Mobile inference addresses deployment location, not the governance evidence regulators require, such as model documentation, validation, and monitoring. It tempts because edge deployment is a real AI trend, and would be correct when models must run offline on devices.

The ability to add custom skins to the UI.

Why it fails: UI skins are cosmetic and produce no audit trail, validation records, or regulatory reporting capability. Custom skins tempt because branding matters in procurement demos, and would be a legitimate requirement for user-facing applications, but they satisfy no external MRM obligation.

They change too quickly to report

Why it fails: Reporting cadence is irrelevant; metrics can be logged and reported at any interval. The actual gap is scope: accuracy, precision and recall describe model behaviour, not fairness, privacy, security, drift or regulatory exposure. Metrics alone would suffice only for periodic model-performance reporting, not holistic risk management.

They are too difficult to calculate for small models

Why it fails: Calculation difficulty is unrelated; performance metrics are computable regardless of model size. Metrics such as accuracy or F1 capture only statistical behaviour on test data, omitting fairness, privacy, security, drift and governance exposure. Metrics alone would suffice only for narrow model-selection comparisons, not enterprise risk management.

They are too subjective

Why it fails: Performance metrics are quantitative and reproducible, so subjectivity is not the defect. They measure predictive quality on a dataset, not operational, ethical, legal or societal risk, which requires separate assessment. Metrics alone would be adequate only where the sole concern is comparative model accuracy under controlled conditions.

Model documentation compliance.

Why it fails: Shadow deployments compare a candidate model's live outputs with the incumbent's to catch behavioural regressions; documentation compliance is a governance process, not a runtime comparison. It is tempting because both support responsible release, and shadow deployment would be correct when assessing accuracy drift before full rollout.

Training data leakage.

Why it fails: Shadow deployments route a copy of live traffic to a candidate model and compare outputs, addressing behavioural divergence before promotion; training data leakage is handled by data governance controls. It is tempting because both concern model safety, and shadow deployment would be correct when validating prediction quality against production.

Hardware infrastructure costs.

Why it fails: Shadow deployments address the risk of a new model degrading production behaviour by running it alongside the live model and comparing outputs before promotion. Infrastructure cost is a deployment concern, but it is not the risk shadow deployment mitigates; cost management would be the focus when scaling serving capacity or choosing instance types.

Write separate code for training and inference to optimize for speed.

Why it fails: Separate training and inference code lets transformations drift apart, which is precisely the mechanism that produces skew. A single shared preprocessing pipeline guarantees identical feature computation at both stages. Separate code is justified when inference latency demands a distinct optimised implementation, but then outputs must be verified equivalent.

Use only raw data for both training and inference.

Why it fails: Raw data alone leaves feature engineering, encoding and scaling undefined, so training and inference transformations diverge. Shared preprocessing code applied identically in both paths is the practice that prevents skew. Using raw data suits exploratory analysis or models consuming unprocessed inputs, not production pipelines requiring consistent feature computation.

Train the model on the production server directly.

Why it fails: Training directly on the production server couples model fitting to live infrastructure, consuming serving capacity and exposing the pipeline to production data changes; it does nothing to align preprocessing logic. Training on a dedicated environment with a shared transformation pipeline prevents skew. Direct production training suits only tiny online-learning updates.

Wait for the quarterly board report to inform the board.

Why it fails: Deferring to a quarterly report leaves the biased model in production, breaching the Governance function's duty to escalate material AI risk promptly. It is tempting because board reporting is a real governance obligation, and it would be correct for routine updates rather than an active, discovered harm.

Fire the AI development team.

Why it fails: Dismissing the development team addresses no technical cause and removes the people able to remediate the model. It is tempting because accountability matters under AI governance, and disciplinary action would be correct only if investigation showed deliberate misconduct rather than a data-driven bias.

Retrain the model on the same data set to see if it fixes itself.

Why it fails: Retraining on the identical dataset reproduces the same statistical bias, so it cannot remediate the harm. It is tempting because retraining is a genuine mitigation, and it would be correct once the data has been rebalanced or corrected to remove the biased correlations.

The speed of the development team's sprint cycles

Why it fails: Sprint cadence measures delivery tempo, not the likelihood or impact of chatbot harms, so it cannot calibrate risk tolerance. Sprint speed is relevant to release planning; risk appetite requires factors such as data sensitivity, model failure impact and regulatory exposure.

The total cost of GPU infrastructure

Why it fails: GPU infrastructure cost is a budget input, not a measure of risk likelihood or impact, so it cannot define acceptable risk. Cost belongs in financial planning; risk appetite for a chatbot turns on harm severity, data sensitivity and regulatory exposure.

Number of users accessing the AI interface.

Why it fails: Interface access counts measure adoption, not whether the model maintains accuracy under distribution shift, drift or adversarial input. It is tempting because usage metrics are easy to collect and report, and would be correct for tracking engagement or capacity planning rather than robustness.

Total number of AI models currently in production.

Why it fails: Counting production models measures portfolio scale, revealing nothing about whether any individual model remains accurate as data drifts. It is tempting because inventory metrics are simple to track, and would be correct for capacity or lifecycle governance reporting rather than predicting robustness.

The budget spent on GPU cloud computing resources.

Why it fails: GPU spend is a cost input, not an outcome indicating whether model performance degrades over time or under changing data. It is tempting because infrastructure investment correlates loosely with capability, and would be correct for budgeting or cost-optimisation reporting rather than robustness governance.

To identify which employees have access to the AI system.

Why it fails: Access identification belongs to the Map function's context mapping and to identity governance tooling, not to Measure. Measure quantitatively assesses, analyses and tracks AI risks using metrics, test sets and benchmarks. The option tempts because access control feels risk-related, yet it addresses who may touch the system rather than quantifying how risky its behaviour is.

To set the budget for future AI projects.

Why it fails: Budgeting is a governance and resource-planning activity outside the AI RMF's Measure function, which quantifies risk through testing, metrics and evaluation. The confusion arises because risk management broadly informs investment decisions, but Measure produces empirical evidence about system performance and impacts, not financial forecasts for future projects.

To provide a score for the developers' performance.

Why it fails: Developer scoring is a human-resources performance activity, unrelated to Measure, which evaluates the AI system's risks via metrics, benchmarks and testing rather than staff output. The option tempts because measurement implies scoring something, but the AI RMF measures system trustworthiness characteristics and impacts, not individual personnel performance.

Hiring more documentation staff.

Why it fails: Hiring documentation staff addresses record-keeping, not adversarial manipulation such as data poisoning, evasion or prompt injection. It is tempting because governance and documentation underpin trustworthy AI, but that staffing supports compliance auditing rather than defending against deliberately crafted malicious inputs.

Using a more expensive cloud provider.

Why it fails: A pricier cloud provider changes cost, not the model's exposure to poisoning, evasion or prompt injection. It is tempting because vendor reputation is often conflated with security, but adversarial risk is mitigated through techniques like adversarial training, input validation and red teaming, not spending.

Include the number of GPU hours utilized.

Why it fails: GPU hours measure infrastructure consumption, not risk exposure or control effectiveness, so executives cannot link the figure to business impact or regulatory posture. It belongs on a capacity or FinOps dashboard, where tracking compute spend against budget is the actual objective.

Display the raw training error rates.

Why it fails: Raw training error rates are model-development telemetry, meaningless to executives without context on drift, bias or business impact. They belong in an ML engineering dashboard for tuning experiments, not in a governance view intended to secure funding and oversight.

Show a comparison of the organization's AI progress against competitors.

Why it fails: Competitor comparisons are external benchmarking, not monitoring of the organisation's own AI risk posture, so they give no actionable signal about incidents, controls or exposure. Such benchmarking fits strategic market analysis, not an operational risk dashboard requiring executive ownership.

To hide the failure from management

Why it fails: Concealing a production failure prevents the blameless review that identifies contributing causes and corrective actions. It tempts because teams fear reputational damage, but post-mortems exist to surface failures openly; hiding would only be defensible where disclosure is legally restricted, which is not the stated goal.

To fire the developer responsible

Why it fails: Terminating the developer substitutes individual blame for the systemic analysis a post-mortem requires, so the underlying cause persists. It tempts because accountability feels satisfying after an outage, yet the goal is a blameless review producing preventive actions; dismissal would only be warranted for deliberate misconduct, not model failure.

To delete all logs associated with the model

Why it fails: Deleting logs destroys the evidence needed to identify the root cause and prevent recurrence, which is the post-mortem's purpose. It tempts as a clean-up instinct after an incident, yet log retention is exactly what forensic review requires; deletion would be the correct action only under a formal data-retention or privacy policy.

The model physically degrades over time.

Why it fails: Decay is statistical: the model's predictive accuracy degrades as real-world data drifts from its training distribution, not through physical wear. Physical degradation describes hardware failure, which is the concern when the risk is infrastructure rather than model behaviour.

The model's code becomes deprecated due to language updates.

Why it fails: Decay concerns the model's relationship to changing input data, not the programming language or libraries used to build it. Code deprecation is the risk when a runtime or framework reaches end of support, which is a maintenance concern rather than a lifecycle accuracy issue.

The training hardware becomes too slow to run.

Why it fails: Model decay is performance degradation as real-world data drifts from training data, not hardware speed. Slower training hardware affects retraining duration, not inference accuracy. Confusing compute ageing with statistical drift misreads the lifecycle risk entirely; hardware refresh addresses throughput, whereas decay demands retraining or monitoring.

Retrain the model immediately.

Why it fails: Retraining immediately skips triage, impact assessment and root-cause analysis, and may reproduce the same bias. It is tempting because retraining is the eventual remediation, but incident response first requires containing the affected model, documenting findings and determining which data or design choices caused the disparity.

Delete all training data related to the demographic.

Why it fails: Deleting the demographic's training data destroys evidence and auditability while leaving the deployed model biased. It is tempting as a quick purge of the apparent cause, but response requires documenting findings, assessing impact and remediating the model under change control, not erasing records.

Issue a public press release.

Why it fails: A press release addresses reputation, not containment, eradication or notification obligations owed to affected individuals and regulators. It is tempting when disclosure duties feel urgent, but incident response prioritises assessing scope, halting harm and notifying regulators or affected parties through proper channels first.

Hardware failure in the training cluster.

Why it fails: Hardware failure in a training cluster is an availability concern mitigated by redundancy and checkpointing, not a model-behaviour risk. It would be the critical vigilance area for large offline training jobs; online learning's defining exposure is that the model keeps adapting to live input, so degradation comes from the data, not the hardware.

Data drift from batch updates.

Why it fails: Online learning updates continuously from streaming input, so drift arrives through the live data feed itself, not from periodic batch refreshes. Batch-update drift is the vigilance concern for models retrained on scheduled batches; here the exposure is unbounded, immediate distributional shift in the incoming stream.

Memory exhaustion due to high throughput.

Why it fails: Memory exhaustion from high throughput is a capacity and resource-planning issue addressed by scaling and backpressure, not a model-correctness risk. It would matter for high-volume inference serving; online learning's distinctive danger is that each incoming example immediately alters the model, so harmful or shifting input propagates without review.

Increase the retraining frequency of the pipeline.

Why it fails: Retraining might mask the drift without identifying the root cause.

Disable the data lineage capture to improve latency.

Why it fails: Disabling lineage reduces visibility into risk, it does not fix detection.

Switch the model to a higher-capacity compute instance.

Why it fails: Compute capacity does not impact the logical drift of the model.

Performing a red-teaming exercise on the model inputs.

Why it fails: This is part of the 'Measure' or 'Test' functions, not 'Govern'.

Configuring automated PII scrubbing in the data pipeline.

Why it fails: This is a technical implementation of the 'Manage' function.

Reviewing the training dataset for bias using statistical sampling.

Why it fails: This is a 'Measure' activity focused on data quality.