Exam Bundle

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported risk register treatment issue at a software services vendor in Lisbon, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.

This result would support contract change monitoring, a distinct governance need illustrated by: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. For the reported risk register treatment issue at a software services vendor in Lisbon, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported risk register treatment issue at a software services vendor in Lisbon, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the lawful basis before training deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The processing record states the legal basis, purpose assessment, and safeguards before training begins.

This response relates instead to automated decisions and contestability, for which an example concern is: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. It could be useful in that different situation, but it would not directly address the lawful basis before training deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The processing record states the legal basis, purpose assessment, and safeguards before training begins.

This response relates instead to data minimization, for which an example concern is: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. It could be useful in that different situation, but it would not directly address the lawful basis before training deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The processing record states the legal basis, purpose assessment, and safeguards before training begins.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported lawful basis before training issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess and document an applicable legal basis and compatible purpose before collecting or reusing personal data. The offered observation does not establish whether that targeted control succeeded.

This result would support purpose limitation, a distinct governance need illustrated by: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. For the reported lawful basis before training issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess and document an applicable legal basis and compatible purpose before collecting or reusing personal data. The offered observation does not establish whether that targeted control succeeded.

This result would support sensitive biometric data, a distinct governance need illustrated by: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. For the reported lawful basis before training issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess and document an applicable legal basis and compatible purpose before collecting or reusing personal data. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the root-cause collaboration deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The investigation links observed harm to evidenced failure contributors and corrective actions.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the root-cause collaboration deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The investigation links observed harm to evidenced failure contributors and corrective actions.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the root-cause collaboration deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The investigation links observed harm to evidenced failure contributors and corrective actions.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported root-cause collaboration issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Conduct multidisciplinary root-cause review across data, model, interface, and human process. The offered observation does not establish whether that targeted control succeeded.

This result would support incident classification, a distinct governance need illustrated by: An AI response causes an unsafe operational action, but support treats it as a cosmetic content-quality bug. For the reported root-cause collaboration issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Conduct multidisciplinary root-cause review across data, model, interface, and human process. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported root-cause collaboration issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Conduct multidisciplinary root-cause review across data, model, interface, and human process. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the agentic orchestration risk deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Simulations show unauthorized actions and cascading tool failures are bounded and recoverable.

This response relates instead to edge inference suitability, for which an example concern is: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. It could be useful in that different situation, but it would not directly address the agentic orchestration risk deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Simulations show unauthorized actions and cascading tool failures are bounded and recoverable.

This response relates instead to proprietary vendor model, for which an example concern is: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. It could be useful in that different situation, but it would not directly address the agentic orchestration risk deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Simulations show unauthorized actions and cascading tool failures are bounded and recoverable.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported agentic orchestration risk issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess agentic autonomy, tool permissions, approval checkpoints, and containment before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported agentic orchestration risk issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess agentic autonomy, tool permissions, approval checkpoints, and containment before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support edge inference suitability, a distinct governance need illustrated by: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. For the reported agentic orchestration risk issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess agentic autonomy, tool permissions, approval checkpoints, and containment before deployment. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the risk register treatment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Priority risks have tracked treatments and accountable residual-risk decisions.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the risk register treatment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Priority risks have tracked treatments and accountable residual-risk decisions.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the risk register treatment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Priority risks have tracked treatments and accountable residual-risk decisions.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported risk register treatment issue at an international services company in Helsinki, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.

This result would support contract change monitoring, a distinct governance need illustrated by: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. For the reported risk register treatment issue at an international services company in Helsinki, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported risk register treatment issue at an international services company in Helsinki, the relevant corrective action is: Maintain an AI risk register with ownership, severity, treatment choices, and review cadence. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to gpai model responsibilities, for which an example concern is: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. It could be useful in that different situation, but it would not directly address the applicable-role analysis deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The regulatory responsibility map reflects real activities and any changes to the system.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the applicable-role analysis deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The regulatory responsibility map reflects real activities and any changes to the system.

This response relates instead to risk-tier classification, for which an example concern is: A company considers all AI equally regulated without checking whether a use fits prohibited, high-risk, or transparency-focused categories. It could be useful in that different situation, but it would not directly address the applicable-role analysis deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The regulatory responsibility map reflects real activities and any changes to the system.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported applicable-role analysis issue at a technology services group in Stockholm, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.

This result would support conformity assessment planning, a distinct governance need illustrated by: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. For the reported applicable-role analysis issue at a technology services group in Stockholm, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported applicable-role analysis issue at a technology services group in Stockholm, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.