CY0-001 AI governance, risk, and compliance explained

AI governance, risk, and compliance is worth 19% of CY0-001 — around eleven questions. CompTIA frames it as navigating global governance frameworks to ensure ethical and compliant AI adoption. In practice this domain asks a simple question in many forms: who is accountable, what did you write down, and who checked it?

It is also the most answerable domain on the exam, because the correct answers follow a pattern once you see it.

The pattern behind the answers

Across almost every GRC question, the right answer involves one of four things:

1. Knowing what you have. An inventory of AI systems, what they do and what data they touch. You cannot govern what you have not catalogued.
2. Assessing before deploying. An impact assessment carried out ahead of go-live, not after an incident.
3. Keeping a human in the loop. Meaningful oversight of consequential decisions, with the authority to override.
4. Writing it down. Documentation, audit trails and provenance that let someone reconstruct what happened later.

If an option contains one of those and the others do not, it is usually correct.

AI impact assessments

The single most testable artefact in the domain. An impact assessment, performed before deployment, records:

• The system’s purpose and intended use
• The data it uses and where that data came from
• Its known limitations and how it can fail
• Who is affected, and how they are protected
• Who is accountable for it

Do not confuse it with a penetration test, a vulnerability scan or a risk register entry. A scan finds technical flaws; an impact assessment documents purpose, effect and accountability. Questions deliberately place those side by side.

Risk management for AI

AI risk is ordinary risk management with AI-specific sources. Expect to reason about:

• Identification — what could go wrong, including bias, inaccuracy, misuse, leakage and dependency on a vendor.
• Assessment — likelihood and impact, with the wrinkle that AI failures are often probabilistic rather than binary.
• Treatment — the usual four: mitigate, transfer, accept, avoid. Accepting a risk is a legitimate answer when it is documented and owned.
• Ownership — a named accountable person, not “the AI team”.
• Monitoring — risk changes as the model, the data and the usage drift.

Two AI-specific ideas worth knowing by name: drift, where performance degrades as the world moves away from the training data, and shadow AI, where staff use tools nobody approved. Shadow AI is an inventory problem, which loops back to point one.

Frameworks and obligations

You are not expected to recite any framework clause by clause. You are expected to know the shape of what they require, which is remarkably consistent:

• Maintain an inventory of systems and classify them by risk
• Assess impact before deployment, proportionate to that risk
• Ensure human oversight of consequential decisions
• Document data sources, limitations and testing
• Be transparent with people affected by automated decisions
• Keep records that support an audit afterwards

Higher-risk uses — employment, credit, healthcare, anything affecting rights — attract heavier obligations. A question that specifies a sensitive domain is signalling that more, not less, governance is expected.

Ethics as an operational requirement

Fairness, transparency and accountability appear here as things you implement rather than things you believe: bias testing before and after deployment, explanations for affected people, appeal routes, and a named owner. When a question asks what you should do about an ethical concern, the answer is a process, not a principle.

Sample questions

What to practise

Write the four-point pattern at the top of this page on a card: inventory, assess before deploying, human in the loop, write it down. In the exam, read each GRC question and ask which of the four is missing from the scenario. That is usually the answer.