Exam Bundle

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported threat modeling new data flow issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported threat modeling new data flow issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.

This result would support regular control audit, a distinct governance need illustrated by: A deployed AI system has unchanged governance paperwork despite major operational changes and no control re-testing. For the reported threat modeling new data flow issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to feedback-to-maintenance loop, for which an example concern is: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. It could be useful in that different situation, but it would not directly address the external transparency materials deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Recipients receive usable descriptions of permitted use, known risks, and escalation paths.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the external transparency materials deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Recipients receive usable descriptions of permitted use, known risks, and escalation paths.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the external transparency materials deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Recipients receive usable descriptions of permitted use, known risks, and escalation paths.

This result would support incident classification, a distinct governance need illustrated by: An AI response causes an unsafe operational action, but support treats it as a cosmetic content-quality bug. For the reported external transparency materials issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Supply required use instructions and transparent system documentation appropriate to the applicable role. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported external transparency materials issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Supply required use instructions and transparent system documentation appropriate to the applicable role. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported external transparency materials issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Supply required use instructions and transparent system documentation appropriate to the applicable role. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to product safety liability, for which an example concern is: A manufacturer integrates AI into a safety device but evaluates only the vendor's standalone model accuracy. It could be useful in that different situation, but it would not directly address the copyright in training data deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The provenance log records rights or applicable legal justification for each copyrighted source class.

This response relates instead to housing access equality, for which an example concern is: A property service uses a ranking algorithm that could disadvantage protected applicants and claims general AI policies are enough. It could be useful in that different situation, but it would not directly address the copyright in training data deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The provenance log records rights or applicable legal justification for each copyrighted source class.

This response relates instead to confidential business material, for which an example concern is: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. It could be useful in that different situation, but it would not directly address the copyright in training data deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The provenance log records rights or applicable legal justification for each copyrighted source class.

This result would support insurance underwriting fairness, a distinct governance need illustrated by: An insurer approves a pricing model without considering whether sensitive proxies violate applicable insurance discrimination rules. For the reported copyright in training data issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported copyright in training data issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.

This result would support legal regime inventory, a distinct governance need illustrated by: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. For the reported copyright in training data issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the localization control deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Jurisdiction tests confirm features and processing comply with the applicable local restrictions.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the localization control deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Jurisdiction tests confirm features and processing comply with the applicable local restrictions.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the localization control deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Jurisdiction tests confirm features and processing comply with the applicable local restrictions.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported localization control issue at an international services company in Helsinki, the relevant corrective action is: Implement location-specific configuration and controls after evaluating local legal and social context. The offered observation does not establish whether that targeted control succeeded.

This result would support downstream harm forecasts, a distinct governance need illustrated by: An innocuous text generator is integrated into a system that automatically sends consequential legal notices without reassessing impact. For the reported localization control issue at an international services company in Helsinki, the relevant corrective action is: Implement location-specific configuration and controls after evaluating local legal and social context. The offered observation does not establish whether that targeted control succeeded.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported localization control issue at an international services company in Helsinki, the relevant corrective action is: Implement location-specific configuration and controls after evaluating local legal and social context. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the red-teaming schedule deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Exercise reports identify exploits, mitigations, and retest results for updated functionality.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the red-teaming schedule deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Exercise reports identify exploits, mitigations, and retest results for updated functionality.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the red-teaming schedule deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Exercise reports identify exploits, mitigations, and retest results for updated functionality.

This result would support threat-model maintenance, a distinct governance need illustrated by: An agent's tool access expands beyond its original design, but the security threat model is still based on a text-only chatbot. For the reported red-teaming schedule issue at a regional service provider in Singapore, the relevant corrective action is: Schedule risk-appropriate red teaming after material capability changes and periodically thereafter. The offered observation does not establish whether that targeted control succeeded.

This result would support reliability regression tests, a distinct governance need illustrated by: Every model upgrade is assessed only on new features and ignores whether previously safe behavior has regressed. For the reported red-teaming schedule issue at a regional service provider in Singapore, the relevant corrective action is: Schedule risk-appropriate red teaming after material capability changes and periodically thereafter. The offered observation does not establish whether that targeted control succeeded.

This result would support model-card limitations, a distinct governance need illustrated by: A deployer receives a new model but cannot find its intended uses, benchmark limits, or known failure populations. For the reported red-teaming schedule issue at a regional service provider in Singapore, the relevant corrective action is: Schedule risk-appropriate red teaming after material capability changes and periodically thereafter. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the risk register treatment deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Priority risks have tracked treatments and accountable residual-risk decisions.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the risk register treatment deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Priority risks have tracked treatments and accountable residual-risk decisions.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the risk register treatment deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Priority risks have tracked treatments and accountable residual-risk decisions.

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported risk register treatment issue at a software services vendor in Lisbon, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.

This result would support contract change monitoring, a distinct governance need illustrated by: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. For the reported risk register treatment issue at a software services vendor in Lisbon, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported risk register treatment issue at a software services vendor in Lisbon, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.