Exam Bundle

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported applicable-role analysis issue at a technology services group in Stockholm, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.

This result would support conformity assessment planning, a distinct governance need illustrated by: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. For the reported applicable-role analysis issue at a technology services group in Stockholm, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported applicable-role analysis issue at a technology services group in Stockholm, the relevant corrective action is: Assess actual provider, deployer, importer, and distributor functions under the applicable legal framework. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to monitoring ownership, for which an example concern is: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. It could be useful in that different situation, but it would not directly address the agentic red-team testing deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Adversarial tests demonstrate containment of unsafe tool requests and documented fixes.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the agentic red-team testing deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Adversarial tests demonstrate containment of unsafe tool requests and documented fixes.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the agentic red-team testing deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Adversarial tests demonstrate containment of unsafe tool requests and documented fixes.

This result would support localization control, a distinct governance need illustrated by: A system is lawful in one region but its operating constraints are unsuitable in a newly entered jurisdiction. For the reported agentic red-team testing issue at a regional service provider in Singapore, the relevant corrective action is: Retest prompt injection, permission escalation, tool misuse, and cross-agent propagation. The offered observation does not establish whether that targeted control succeeded.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported agentic red-team testing issue at a regional service provider in Singapore, the relevant corrective action is: Retest prompt injection, permission escalation, tool misuse, and cross-agent propagation. The offered observation does not establish whether that targeted control succeeded.

This result would support deployment operating procedure, a distinct governance need illustrated by: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. For the reported agentic red-team testing issue at a regional service provider in Singapore, the relevant corrective action is: Retest prompt injection, permission escalation, tool misuse, and cross-agent propagation. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the concept drift deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Postchange validation detects changed predictive relationships and supports treatment decisions.

This response relates instead to feedback-to-maintenance loop, for which an example concern is: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. It could be useful in that different situation, but it would not directly address the concept drift deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Postchange validation detects changed predictive relationships and supports treatment decisions.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the concept drift deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Postchange validation detects changed predictive relationships and supports treatment decisions.

This result would support input data drift, a distinct governance need illustrated by: An AI service receives new types of cases over time, but only the model's uptime is monitored. For the reported concept drift issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Check outcome relationships and labeled performance over time for concept drift. The offered observation does not establish whether that targeted control succeeded.

This result would support safe rollback operations, a distinct governance need illustrated by: A new model release creates unacceptable errors, but operations lack a tested method to restore the previous safe version. For the reported concept drift issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Check outcome relationships and labeled performance over time for concept drift. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported concept drift issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Check outcome relationships and labeled performance over time for concept drift. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to copyright in training data, for which an example concern is: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. It could be useful in that different situation, but it would not directly address the product safety liability deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Product validation tests end-to-end safety and documents mitigations for foreseeable misuse.

This response relates instead to legal regime inventory, for which an example concern is: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. It could be useful in that different situation, but it would not directly address the product safety liability deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Product validation tests end-to-end safety and documents mitigations for foreseeable misuse.

This response relates instead to housing access equality, for which an example concern is: A property service uses a ranking algorithm that could disadvantage protected applicants and claims general AI policies are enough. It could be useful in that different situation, but it would not directly address the product safety liability deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Product validation tests end-to-end safety and documents mitigations for foreseeable misuse.

This result would support credit fairness, a distinct governance need illustrated by: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. For the reported product safety liability issue at a regional technology consortium in Auckland, the relevant corrective action is: Assess foreseeable product-level defects and safety risks from the integrated AI system. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported product safety liability issue at a regional technology consortium in Auckland, the relevant corrective action is: Assess foreseeable product-level defects and safety risks from the integrated AI system. The offered observation does not establish whether that targeted control succeeded.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported product safety liability issue at a regional technology consortium in Auckland, the relevant corrective action is: Assess foreseeable product-level defects and safety risks from the integrated AI system. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to supervised learning limits, for which an example concern is: A project promises highly reliable supervised predictions but has only unlabeled historical records and no ground-truth outcomes. It could be useful in that different situation, but it would not directly address the safety versus raw accuracy deficiency reported at an industrial manufacturer in Detroit. The targeted acceptance criterion here is: Risk analysis and safety tests quantify dangerous misses and define safe fallback behavior.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the safety versus raw accuracy deficiency reported at an industrial manufacturer in Detroit. The targeted acceptance criterion here is: Risk analysis and safety tests quantify dangerous misses and define safe fallback behavior.

This response relates instead to generative versus predictive scope, for which an example concern is: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. It could be useful in that different situation, but it would not directly address the safety versus raw accuracy deficiency reported at an industrial manufacturer in Detroit. The targeted acceptance criterion here is: Risk analysis and safety tests quantify dangerous misses and define safe fallback behavior.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported safety versus raw accuracy issue at an industrial manufacturer in Detroit, the relevant corrective action is: Assess severity-weighted failure modes rather than treating average accuracy as the only safety criterion. The offered observation does not establish whether that targeted control succeeded.

This result would support probabilistic output and review, a distinct governance need illustrated by: An executive assumes a generative classifier will return identical conclusions on every run and removes human checks for unusual outputs. For the reported safety versus raw accuracy issue at an industrial manufacturer in Detroit, the relevant corrective action is: Assess severity-weighted failure modes rather than treating average accuracy as the only safety criterion. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported safety versus raw accuracy issue at an industrial manufacturer in Detroit, the relevant corrective action is: Assess severity-weighted failure modes rather than treating average accuracy as the only safety criterion. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proprietary model self-deployment, for which an example concern is: A company builds and deploys its own AI product but assumes self-hosting eliminates provider-side documentation and safety duties. It could be useful in that different situation, but it would not directly address the subprocessor oversight deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Supplier records identify downstream processors and applicable oversight requirements.

This response relates instead to vendor audit rights, for which an example concern is: A provider refuses to furnish material security or risk-assessment evidence while the deployment poses serious compliance exposure. It could be useful in that different situation, but it would not directly address the subprocessor oversight deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Supplier records identify downstream processors and applicable oversight requirements.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the subprocessor oversight deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Supplier records identify downstream processors and applicable oversight requirements.

This result would support vendor model changes, a distinct governance need illustrated by: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. For the reported subprocessor oversight issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported subprocessor oversight issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported subprocessor oversight issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.