Exam Bundle

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported enterprise inventory ownership issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported enterprise inventory ownership issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This result would support proportional control design, a distinct governance need illustrated by: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. For the reported enterprise inventory ownership issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the iso terminology and impact scope deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The standards register assigns each referenced standard to its actual governance purpose.

This response relates instead to iso 42001 aims, for which an example concern is: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. It could be useful in that different situation, but it would not directly address the iso terminology and impact scope deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The standards register assigns each referenced standard to its actual governance purpose.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the iso terminology and impact scope deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The standards register assigns each referenced standard to its actual governance purpose.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported iso terminology and impact scope issue at a technology services group in Stockholm, the relevant corrective action is: Map AI terminology needs to ISO/IEC 22989 and AI-system impact assessment to ISO/IEC 42005. The offered observation does not establish whether that targeted control succeeded.

This result would support oecd trustworthy ai principles, a distinct governance need illustrated by: An organization claims the OECD Principles are a legally binding certification rather than a policy recommendation about trustworthy AI. For the reported iso terminology and impact scope issue at a technology services group in Stockholm, the relevant corrective action is: Map AI terminology needs to ISO/IEC 22989 and AI-system impact assessment to ISO/IEC 42005. The offered observation does not establish whether that targeted control succeeded.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported iso terminology and impact scope issue at a technology services group in Stockholm, the relevant corrective action is: Map AI terminology needs to ISO/IEC 22989 and AI-system impact assessment to ISO/IEC 42005. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to safe rollback operations, for which an example concern is: A new model release creates unacceptable errors, but operations lack a tested method to restore the previous safe version. It could be useful in that different situation, but it would not directly address the retraining governance deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Every replacement version passes predetermined tests and retains a recoverable predecessor.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the retraining governance deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Every replacement version passes predetermined tests and retains a recoverable predecessor.

This response relates instead to threat-model maintenance, for which an example concern is: An agent's tool access expands beyond its original design, but the security threat model is still based on a text-only chatbot. It could be useful in that different situation, but it would not directly address the retraining governance deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Every replacement version passes predetermined tests and retains a recoverable predecessor.

This result would support external transparency materials, a distinct governance need illustrated by: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. For the reported retraining governance issue at a regional technology consortium in Auckland, the relevant corrective action is: Apply controlled retraining, validation, approval, and rollback procedures to updated models. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported retraining governance issue at a regional technology consortium in Auckland, the relevant corrective action is: Apply controlled retraining, validation, approval, and rollback procedures to updated models. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported retraining governance issue at a regional technology consortium in Auckland, the relevant corrective action is: Apply controlled retraining, validation, approval, and rollback procedures to updated models. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the deployment operating procedure deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Operational staff demonstrate correct use and escalation under representative scenarios.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the deployment operating procedure deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Operational staff demonstrate correct use and escalation under representative scenarios.

This response relates instead to monitoring ownership, for which an example concern is: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. It could be useful in that different situation, but it would not directly address the deployment operating procedure deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Operational staff demonstrate correct use and escalation under representative scenarios.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported deployment operating procedure issue at a regional technology consortium in Auckland, the relevant corrective action is: Publish risk-based deployment procedures, approved uses, human oversight, and escalation instructions. The offered observation does not establish whether that targeted control succeeded.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported deployment operating procedure issue at a regional technology consortium in Auckland, the relevant corrective action is: Publish risk-based deployment procedures, approved uses, human oversight, and escalation instructions. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported deployment operating procedure issue at a regional technology consortium in Auckland, the relevant corrective action is: Publish risk-based deployment procedures, approved uses, human oversight, and escalation instructions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the data dependency and drift deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Segmented validation reveals whether the new population meets defined performance and fairness thresholds.

This response relates instead to generative versus predictive scope, for which an example concern is: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. It could be useful in that different situation, but it would not directly address the data dependency and drift deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Segmented validation reveals whether the new population meets defined performance and fairness thresholds.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the data dependency and drift deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Segmented validation reveals whether the new population meets defined performance and fairness thresholds.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported data dependency and drift issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Examine representation and distribution shift before expanding the system to new populations. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported data dependency and drift issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Examine representation and distribution shift before expanding the system to new populations. The offered observation does not establish whether that targeted control succeeded.

This result would support generative versus predictive scope, a distinct governance need illustrated by: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. For the reported data dependency and drift issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Examine representation and distribution shift before expanding the system to new populations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to lawful basis before training, for which an example concern is: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. It could be useful in that different situation, but it would not directly address the cross-border processing deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The data-flow register and transfer assessment cover vendors, destinations, and applicable safeguards.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the cross-border processing deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The data-flow register and transfer assessment cover vendors, destinations, and applicable safeguards.

This response relates instead to sensitive biometric data, for which an example concern is: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. It could be useful in that different situation, but it would not directly address the cross-border processing deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The data-flow register and transfer assessment cover vendors, destinations, and applicable safeguards.

This result would support third-party processor controls, a distinct governance need illustrated by: A business sends customer records to a hosted model provider without instructions on permitted processing or breach handling. For the reported cross-border processing issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.

This result would support sensitive biometric data, a distinct governance need illustrated by: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. For the reported cross-border processing issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported cross-border processing issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.