Exam Bundle

This result would support vendor model changes, a distinct governance need illustrated by: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. For the reported subprocessor oversight issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported subprocessor oversight issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported subprocessor oversight issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to design decision trace, for which an example concern is: The model team cannot explain why a sensitive input feature was retained after a privacy objection. It could be useful in that different situation, but it would not directly address the human oversight by design deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: Usability tests show that reviewers can identify errors, correct outcomes, and stop unsafe processing.

This response relates instead to architecture security review, for which an example concern is: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. It could be useful in that different situation, but it would not directly address the human oversight by design deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: Usability tests show that reviewers can identify errors, correct outcomes, and stop unsafe processing.

This response relates instead to purpose and success definition, for which an example concern is: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. It could be useful in that different situation, but it would not directly address the human oversight by design deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: Usability tests show that reviewers can identify errors, correct outcomes, and stop unsafe processing.

This result would support pilot containment, a distinct governance need illustrated by: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. For the reported human oversight by design issue at an insurance provider in Toronto, the relevant corrective action is: Design meaningful review tools, information access, authority, and escalation before implementation. The offered observation does not establish whether that targeted control succeeded.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported human oversight by design issue at an insurance provider in Toronto, the relevant corrective action is: Design meaningful review tools, information access, authority, and escalation before implementation. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported human oversight by design issue at an insurance provider in Toronto, the relevant corrective action is: Design meaningful review tools, information access, authority, and escalation before implementation. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to consumer deception, for which an example concern is: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. It could be useful in that different situation, but it would not directly address the employment discrimination deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Independent outcome review assesses relevant disparities and corrects affected hiring decisions.

This response relates instead to confidential business material, for which an example concern is: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. It could be useful in that different situation, but it would not directly address the employment discrimination deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Independent outcome review assesses relevant disparities and corrects affected hiring decisions.

This response relates instead to credit fairness, for which an example concern is: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. It could be useful in that different situation, but it would not directly address the employment discrimination deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Independent outcome review assesses relevant disparities and corrects affected hiring decisions.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported employment discrimination issue at a multinational employer in Berlin, the relevant corrective action is: Test and mitigate unlawful discriminatory effects within the applicable employment-law context. The offered observation does not establish whether that targeted control succeeded.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported employment discrimination issue at a multinational employer in Berlin, the relevant corrective action is: Test and mitigate unlawful discriminatory effects within the applicable employment-law context. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported employment discrimination issue at a multinational employer in Berlin, the relevant corrective action is: Test and mitigate unlawful discriminatory effects within the applicable employment-law context. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the safety and reliability monitoring deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Dashboards show relevant error, harm, and reliability measures and trigger incident response.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the safety and reliability monitoring deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Dashboards show relevant error, harm, and reliability measures and trigger incident response.

This response relates instead to near-miss reporting, for which an example concern is: Users report several close calls where an AI system nearly caused harm, but incidents are recorded only when actual loss occurs. It could be useful in that different situation, but it would not directly address the safety and reliability monitoring deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Dashboards show relevant error, harm, and reliability measures and trigger incident response.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported safety and reliability monitoring issue at a professional services group in London, the relevant corrective action is: Monitor outcome quality and safety indicators alongside operational reliability. The offered observation does not establish whether that targeted control succeeded.

This result would support incident containment, a distinct governance need illustrated by: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. For the reported safety and reliability monitoring issue at a professional services group in London, the relevant corrective action is: Monitor outcome quality and safety indicators alongside operational reliability. The offered observation does not establish whether that targeted control succeeded.

This result would support near-miss reporting, a distinct governance need illustrated by: Users report several close calls where an AI system nearly caused harm, but incidents are recorded only when actual loss occurs. For the reported safety and reliability monitoring issue at a professional services group in London, the relevant corrective action is: Monitor outcome quality and safety indicators alongside operational reliability. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to versioned release artifacts, for which an example concern is: The team cannot tell whether production serves the approved model version or an experimental checkpoint. It could be useful in that different situation, but it would not directly address the release-readiness evidence deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Release records show test results and blocking issues resolved or explicitly held before launch.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the release-readiness evidence deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Release records show test results and blocking issues resolved or explicitly held before launch.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the release-readiness evidence deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Release records show test results and blocking issues resolved or explicitly held before launch.

This result would support safe rollback operations, a distinct governance need illustrated by: A new model release creates unacceptable errors, but operations lack a tested method to restore the previous safe version. For the reported release-readiness evidence issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require release-readiness review with documented criteria, risks, owners, and signoff status. The offered observation does not establish whether that targeted control succeeded.

This result would support versioned release artifacts, a distinct governance need illustrated by: The team cannot tell whether production serves the approved model version or an experimental checkpoint. For the reported release-readiness evidence issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require release-readiness review with documented criteria, risks, owners, and signoff status. The offered observation does not establish whether that targeted control succeeded.

This result would support feedback-to-maintenance loop, a distinct governance need illustrated by: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. For the reported release-readiness evidence issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require release-readiness review with documented criteria, risks, owners, and signoff status. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the enterprise inventory ownership deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The inventory links deployed systems to owners, purpose, data categories, and review status.

This response relates instead to cross-functional review, for which an example concern is: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. It could be useful in that different situation, but it would not directly address the enterprise inventory ownership deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The inventory links deployed systems to owners, purpose, data categories, and review status.

This response relates instead to board-level oversight, for which an example concern is: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. It could be useful in that different situation, but it would not directly address the enterprise inventory ownership deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The inventory links deployed systems to owners, purpose, data categories, and review status.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported enterprise inventory ownership issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported enterprise inventory ownership issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This result would support proportional control design, a distinct governance need illustrated by: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. For the reported enterprise inventory ownership issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.