Exam Bundle

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported applicable-role analysis issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported applicable-role analysis issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.

This result would support conformity assessment planning, a distinct governance need illustrated by: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. For the reported applicable-role analysis issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to deployment operating procedure, for which an example concern is: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. It could be useful in that different situation, but it would not directly address the monitoring ownership deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Alert drills reach accountable people and produce documented triage decisions.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the monitoring ownership deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Alert drills reach accountable people and produce documented triage decisions.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the monitoring ownership deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Alert drills reach accountable people and produce documented triage decisions.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported monitoring ownership issue at a technology services group in Stockholm, the relevant corrective action is: Assign alert owners, severity thresholds, response expectations, and escalation procedures. The offered observation does not establish whether that targeted control succeeded.

This result would support human override in practice, a distinct governance need illustrated by: An automated decision tool has an override button, but users are penalized for clicking it and cannot access explanations. For the reported monitoring ownership issue at a technology services group in Stockholm, the relevant corrective action is: Assign alert owners, severity thresholds, response expectations, and escalation procedures. The offered observation does not establish whether that targeted control succeeded.

This result would support maintenance after drift, a distinct governance need illustrated by: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. For the reported monitoring ownership issue at a technology services group in Stockholm, the relevant corrective action is: Assign alert owners, severity thresholds, response expectations, and escalation procedures. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the dataset provenance deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: A source-to-model trace identifies data origins, transformations, and impacted model versions.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the dataset provenance deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: A source-to-model trace identifies data origins, transformations, and impacted model versions.

This response relates instead to data-use rights, for which an example concern is: A developer acquires a large web corpus without assessing whether its license permits model training. It could be useful in that different situation, but it would not directly address the dataset provenance deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: A source-to-model trace identifies data origins, transformations, and impacted model versions.

This result would support class-imbalance testing, a distinct governance need illustrated by: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. For the reported dataset provenance issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish dataset lineage and provenance through ingestion, transformation, and model training. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported dataset provenance issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish dataset lineage and provenance through ingestion, transformation, and model training. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported dataset provenance issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish dataset lineage and provenance through ingestion, transformation, and model training. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to confidential business material, for which an example concern is: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. It could be useful in that different situation, but it would not directly address the consumer deception deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Published consumer messages accurately state what was automated and what evidence exists.

This response relates instead to credit fairness, for which an example concern is: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. It could be useful in that different situation, but it would not directly address the consumer deception deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Published consumer messages accurately state what was automated and what evidence exists.

This response relates instead to copyright in training data, for which an example concern is: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. It could be useful in that different situation, but it would not directly address the consumer deception deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Published consumer messages accurately state what was automated and what evidence exists.

This result would support insurance underwriting fairness, a distinct governance need illustrated by: An insurer approves a pricing model without considering whether sensitive proxies violate applicable insurance discrimination rules. For the reported consumer deception issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require accurate marketing and output claims and prevent deceptive representations of AI capability. The offered observation does not establish whether that targeted control succeeded.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported consumer deception issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require accurate marketing and output claims and prevent deceptive representations of AI capability. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported consumer deception issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require accurate marketing and output claims and prevent deceptive representations of AI capability. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to lifecycle gate policy, for which an example concern is: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. It could be useful in that different situation, but it would not directly address the use-case assessment deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The intake decision compares AI and non-AI options before model selection.

This response relates instead to documentation and traceability, for which an example concern is: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. It could be useful in that different situation, but it would not directly address the use-case assessment deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The intake decision compares AI and non-AI options before model selection.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the use-case assessment deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The intake decision compares AI and non-AI options before model selection.

This result would support documentation and traceability, a distinct governance need illustrated by: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. For the reported use-case assessment issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require an initial use-case assessment documenting purpose, alternatives, affected groups, and intended outcomes. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported use-case assessment issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require an initial use-case assessment documenting purpose, alternatives, affected groups, and intended outcomes. The offered observation does not establish whether that targeted control succeeded.

This result would support ai incident response, a distinct governance need illustrated by: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. For the reported use-case assessment issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require an initial use-case assessment documenting purpose, alternatives, affected groups, and intended outcomes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the threat modeling new data flow deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Access-control and attack-simulation evidence covers the new retrieval connector.

This response relates instead to incident containment, for which an example concern is: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. It could be useful in that different situation, but it would not directly address the threat modeling new data flow deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Access-control and attack-simulation evidence covers the new retrieval connector.

This response relates instead to end-of-life and archival controls, for which an example concern is: A retired AI service remains reachable through an undocumented integration and continues receiving user data. It could be useful in that different situation, but it would not directly address the threat modeling new data flow deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Access-control and attack-simulation evidence covers the new retrieval connector.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported threat modeling new data flow issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported threat modeling new data flow issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.

This result would support regular control audit, a distinct governance need illustrated by: A deployed AI system has unchanged governance paperwork despite major operational changes and no control re-testing. For the reported threat modeling new data flow issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.