AAISM states that when evaluating external AI vendors, independently issued third-party audit reports (SOC, ISO, AI assurance assessments) provide the strongest evidence of implemented controls because they are objective, repeatable, and externally verified.

For pre-delivery phishing detection and classification, the most appropriate capability is NLP- tokenization, feature extraction, semantic similarity, and supervised classifiers (e.g., transformer-based classifiers) tuned on phishing corpora and indicators. NLP models score messages and drive automated quarantine policies. An LLM (Option A) is a model type, not a specific blue-team feature; NLG (Option C) is for generation, not detection; RAG (Option D) augments responses with retrieved knowledge but does not by itself optimize classification and quarantine of phishing emails.
References:
AAISM Body of Knowledge: Defensive AI Use Cases; Text Classification Pipelines for Security Operations; Email Security and AI-Driven Triage.
AAISM Study Guide: NLP for Threat Detection; Model Evaluation for Precision/Recall in Security Classifiers; SOC Integration and Automated Containment.

AAISM frames bias risk primarily as a data problem. The most impactful mitigation is to ensure diversity and representativeness of training data sources, thereby reducing sampling bias and improving fairness across subpopulations.

AAISM positions model cards as standardized documentation artifacts that record intended use and out-of- scope use, training/evaluation data characteristics, performance metrics across groups, limitations/risks
, and governance controls/owners. Their purpose is transparency and assurance, not automated tuning or synthetic data generation. Visualization (A) may appear within a card, but the core role is structured documentation for governance, risk, and compliance.
References: AI Security Management (AAISM) Body of Knowledge - Documentation & Transparency Artifacts; Model Cards for Governance, Risk, and Assurance; Intended Use, Limitations, and Performance Disclosure.

AAISM emphasizes that the primary objective of responsible AI is to establish and maintain trust in AI-driven decisions and predictions. Trust is achieved through transparency, accountability, fairness, and governance. While confidentiality and integrity are critical technical objectives, they are not the overarching purpose of responsible AI service provision. Autonomy and learning ability are features of AI, but without trust, adoption and compliance falter. The correct answer is that responsible AI services must focus on building trust in AI outcomes.