ISTQB® CT-GenAI chapter 5: deploying generative AI in a test organization

In short

Chapter 5 of the ISTQB® CT-GenAI v1.1 syllabus zooms out: once testers know how to use generative AI, how does the test organization adopt it in a controlled way? It covers the risks of shadow AI, the key aspects of a strategy, the criteria for choosing a model, the adoption phases, and then change management: skills, building team capability and how roles evolve. It is the shortest chapter in the syllabus, at 80 minutes of training.

It speaks to test managers as much as to testers: questions often concern an organizational decision rather than a test task.

What the exam expects

Chapter 5 accounts for 7 of the 40 questions, worth 7 points: 4 K1 questions (remember) and 3 K2 questions (understand). It has more K1 questions than any other chapter, so precise recall of the vocabulary pays off fastest here.

Objective	Level	Questions	What you need to be able to do
GenAI-5.1.1	K1	1	Recall the risks of shadow AI
GenAI-5.1.2	K2	1	Explain the key aspects of a generative AI strategy for testing
GenAI-5.1.3	K2	1	Summarize the criteria for selecting an LLM or SLM for test tasks
GenAI-5.1.4	K1	1	Recall the phases of generative AI adoption
GenAI-5.2.1	K2	1	Explain the skills and knowledge testers need
GenAI-5.2.2	K1	1	Recall strategies for building AI skills in test teams
GenAI-5.2.3	K1	1	Recognize how test processes and responsibilities shift

Key concepts

Shadow AI. The use of AI tools the organization has not approved, for example a tester pasting production logs into a personal assistant. The syllabus names three risks: information security and data privacy weaknesses, compliance and regulatory issues, and unclear intellectual property due to vague licensing terms. The answer is not a ban, but a strategy and a managed rollout.

The strategy. It starts from measurable test objectives (productivity, cycle time, quality), then selects models aligned with those objectives and compatible with the existing infrastructure. It relies on high-quality, protected input data, team training, effectiveness metrics, and usage rules: sensitive data, transparency about what was generated, and review of generated testware before it is accepted.

Choosing an LLM or SLM. Four criteria: model performance on your own test tasks (public benchmarks focused on testing are rare), fine-tuning potential, recurring cost (licensing and operations), and the community and support available.

Three adoption phases. Discovery: raise awareness, train, give access to models, experiment. Initiation and usage definition: identify and prioritize use cases, evaluate tooling, build expertise. Utilization and iteration: full integration, continuous monitoring, measuring the transformation. Phases can run in parallel for different use cases, and team concerns (about jobs in particular) need to be addressed early.

Skills. Prompt engineering, understanding context windows, methods for reviewing output, knowledge of the risks and their mitigations, sanitizing sensitive data before sharing it, and choosing right-sized models to limit cost and energy use. Test and domain expertise remain essential to judge what the model produces.

Building teams and evolving roles. Hands-on learning across several models, structured learning paths, peer learning, communities of practice and libraries of prompt patterns. The tester becomes an AI-assisted test specialist who guides and verifies generated testware. The test manager takes on AI-based test strategy and risk management, governance, and leads hybrid teams of people and agents.

Common pitfalls

• Making up phase names. "Pilot", "industrialization" or "rollout" sound right but are not in the syllabus. Learn the three exact names, and remember that prioritizing use cases belongs to the second phase.
• Reducing shadow AI to a security problem. Compliance and intellectual property are also among the risks you need to recall.
• Assuming open source models are free. Even without license fees, there are recurring operating costs: infrastructure, maintenance, staff.
• Giving the tester the test manager's responsibilities. Maintaining the prompt library is the tester's job; defining governance and the AI-based test strategy is the test manager's.

How to study it

One to two hours is usually enough, with a focus on active recall. Make a sheet with the exact lists: three shadow AI risks, four selection criteria, three adoption phases. Then apply them to your own team: which AI tools are being used today without any framework? Which phase are you in for test analysis, and which for test automation? This quick team assessment locks in the vocabulary far better than rereading.

Measure your level with the free level check. The certification guide recaps all five chapters, the exam guide details the scoring, and the full course works through each objective with organizational scenarios. For a concrete take on objective GenAI-5.1.1, read shadow AI in QA teams. If you are shaping your QA career path, our article on becoming a software tester gives the wider context.

Frequently asked questions

Is chapter 5 only for test managers?

No. It concerns every profile, because a tester needs to understand why using an unapproved tool is a problem, which skills to develop and how their own role is changing. Some questions take the test manager's point of view, but they stay at K1 or K2 level and do not require management experience.

Which lists should I know by heart?

The three shadow AI risks, the four criteria for selecting an LLM or SLM, and the three adoption phases, with their exact names. These are K1 or K2 objectives where a wrong option may borrow plausible project-management vocabulary that is not in the syllabus.

How does chapter 5 connect to the others?

It reuses almost everything before it: the chapter 2 metrics to measure effectiveness, the chapter 3 risks and regulations to set usage rules, and the fine-tuning and usage modes from chapter 4 to choose a model. Studying it last helps consolidate the whole syllabus.