iSQI CT-GenAI - ISTQB Certified Tester Testing with Generative AI (CT-GenAI) v1.0

ISO/IEC 42001:2023is the international standard for an AI Management System (AIMS). It is designed to help organizations develop, provide, or use AI systems responsibly by providing a certifiable framework of requirements and controls. In a software testing context, this standard is vital for establishing governance, ensuring that GenAI tools are used consistently and ethically across the lifecycle.NIST AI RMF 1.0(Option B) is a highly respected framework, but it is a set of voluntary guidelines for managing risk, not a "requirement standard" for a management system.ISO/IEC 23053:2022(Option C) provides a general framework for AI using machine learning but lacks the comprehensive "management system" scope found in 42001. Finally, theEU AI Act(Option D) is a regulation (law), not a technical standard. For a test organization looking to align its GenAI strategy with international best practices and achieve formal certification, ISO/IEC 42001 is the definitive standard to follow, as it covers the organizational processes, data handling, and risk management necessary for high-quality AI operations.

In structured prompt engineering, theRolecomponent (also known as a Persona) is used to set the perspective, expertise, and tone of the LLM’s response. By assigning the role of a "senior test manager," the tester instructs the model to adopt the specific domain knowledge, vocabulary, and professional standards associated with that position. This technique is highly effective because LLMs are trained on vast datasets containing diverse professional documents; invoking a specific persona helps the model narrow its "latent space" to retrieve information relevant to that specific field. For instance, a senior test manager persona will prioritize risk management, resource allocation, and high-level strategy, whereas a "junior developer" persona might focus more on syntax and local unit tests. WhileContext(Option B) provides the background of the project andInstruction(Option A) defines the specific task to be performed, theRoleserves as the foundation for how those instructions are interpreted. This ensures the generated testware aligns with the expected professional seniority and organizational maturity required for high-stakes environments like a payments platform.

Hallucinations—where an LLM generates factually incorrect or nonsensical information—occur primarily when the model lacks sufficient specific information and "fills in the gaps" using probabilistic patterns from its training data. The most effective mitigation strategy is "grounding," which involves providing the model with detailed, project-specific context. By including technical specifications, existing API schemas, business rules, and identified constraints within the prompt, the tester restricts the model’s operational space to the "project realities." This ensures the model does not have to guess or improvise details about the System Under Test (SUT). In contrast, randomizing prompts (Option B) or relying on generic examples (Option C) increases the likelihood of inconsistent and inaccurate outputs. Furthermore, using "longer" or higher temperature settings (Option D) actually encourages creativity and randomness, which is the opposite of the precision required for testing and significantly increases the risk of hallucinations. Therefore, rich contextual grounding is the technical foundation for reliable AI-assisted test analysis.

In professional Generative AI applications, thesystem prompt(sometimes called the system message) is the foundational set of instructions that defines the AI's persona, boundaries, and overall behavior. In a testing workflow, this is typically defined by atester or test engineerwho is configuring the AI assistant for a specific project. Unlike the user prompt, which changes with every interaction, the system prompt remains relatively static and acts as a "guardrail" to ensure the model stays in its role (e.g., "You are an expert in ISO 26262 automotive testing standards"). By defining the system prompt, the tester ensures that the model consistently uses specific terminology, adheres to data privacy constraints, and formats its output according to the team's requirements. While end users (Option B) provide the task-specific input, they do not usually have the permissions or technical need to alter the underlying system-level instructions. Similarly, while CI servers (Option C) might trigger the prompt, they do not "define" the human-centric logic contained within it. Properly crafting the system prompt is a core part of setting up an AI-augmented test environment.

It is important to distinguish between a general-purposeChatbotand a specializedLLM applicationwithin a testing framework. A chatbot is primarily designed for multi-turn, conversational interactions where the user can ask questions and receive answers in a natural language format. While useful for general queries, it often lacks the specialized workflow integration needed for rigorous testing. Conversely,LLM applications(or "LLM-powered tools") are built with a specific "scope" in mind, such as automated test generation, code analysis, or requirement mapping. These applications often use the LLM as an underlying engine but surround it with specific UI components, data connectors (like RAG), and fixed task-oriented prompts to achieve a defined testing outcome. While chatbots are "free-form," LLM apps are "capability-driven." This distinction is key for organizations defining a GenAI strategy; simply providing a chatbot to testers is rarely sufficient. Instead, organizations should develop or adopt LLM applications that integrate directly into the CI/CD pipeline and provide structured, actionable test artifacts that support defined quality engineering tasks.

Vision-Language Models (VLMs)represent a specialized subset of multimodal Large Language Models. Their defining characteristic is the ability to process, understand, and reason across both textual and visual modalities simultaneously. In the field of software testing, VLMs are revolutionary because they allow the AI to "see" a User Interface (UI). A tester can provide a screenshot of a web page alongside a natural language prompt, and the VLM can identify UI elements, detect visual regressions, or even validate that the visual layout matches a design specification. They are not a "superset" (Option C) of multimodal AI, but rather a specific implementation of it focused on the intersection of sight and language. Unlike traditional OCR or pixel-comparison tools used in legacy UI automation (Option B), VLMs understand thecontextof what they see—for instance, identifying a "broken" button icon that a human would recognize but a rule-based script might miss. This integration of visual and textual data is what makes them a vital component of modern, AI-augmented Quality Assurance strategies.

A/B testing, also known as split testing, is a systematic empirical method used to compare two versions of a prompt (Version A and Version B) to determine which one performs better based on predefined evaluation metrics. In the realm of LLMs, where outputs can be stochastic (probabilistic), A/B testing is essential for mitigating inconsistency. When a team encounters vague or varying results for a user story, simply modifying the prompt iteratively (Option B) may improve the result but does not provide a statistical or objective basis for why one version is superior. Byrunning A/B tests, testers can evaluate prompts against specific KPIs such as accuracy, relevance, format adherence, or the absence of hallucinations. This process involves sending the same input data through both prompt versions multiple times and scoring the outputs. The version that consistently yields the "stronger wording" or more precise testware is then selected as the production standard. This data-driven approach is a cornerstone of prompt engineering in professional environments, ensuring that the most effective linguistic structures are utilized to maximize the model's performance and reliability.

Embeddingsare a fundamental concept in modern Natural Language Processing (NLP) and LLMs. They are high-dimensional numerical vectors—essentially lists of numbers—that represent the meaning (semantics) of a piece of text (a word, sentence, or document). Unlike traditional keyword matching, which looks for identical strings of characters, embeddings allow the model to understand the "closeness" of concepts. For example, in a vector space, the word "bug" would be mathematically closer to "defect" or "error" than to "feature" or "requirement." This captures the semantic relationship between terms. This technology is the backbone of Retrieval-Augmented Generation (RAG) used in testing: when a tester queries a documentation set, the system converts the query into an embedding and looks for other chunks of text with similar vector values. This allows the AI to retrieve relevant context even if the exact keywords do not match. It is not about logical rules (Option C) or groups of tokens (Option A), but rather a mathematical representation of language that enables machines to process human meaning.

LLMOps(Large Language Model Operations) is the set of practices used to manage the lifecycle of LLMs in production. When an organization integrates an AI chatbot into its test processes, the primary operational concern ismaintaining data privacy and minimizing security risks, especially if using third-party APIs. Unlike traditional software, LLMs are "black boxes" that process every piece of data sent to them. A core LLMOps responsibility is ensuring that any "Prompt Data" (code, requirements, or logs) is not used by the provider to train their public models and that the communication channels are fully secured. While scalability (Option A) and latency (Option C) are important technical metrics, they are secondary to the catastrophic legal and reputational risk of a data breach. LLMOps in a testing context involves implementing data masking tools, monitoring for "Prompt Injection" attacks, and managing the "Grounding" data in vector databases to ensure it remains current and protected. This ensures the AI remains a safe and reliable asset within the enterprise testing ecosystem, rather than a liability for the organization’s intellectual property.