Exam Bundle

This result would support third-party processor controls, a distinct governance need illustrated by: A business sends customer records to a hosted model provider without instructions on permitted processing or breach handling. For the reported cross-border processing issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.

This result would support sensitive biometric data, a distinct governance need illustrated by: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. For the reported cross-border processing issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported cross-border processing issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to multimodal capability decision, for which an example concern is: A document workflow requires understanding diagrams and photographs, but procurement tests only text-only model capability. It could be useful in that different situation, but it would not directly address the open-source license review deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Legal and technical reviews confirm permitted deployment and required obligations.

This response relates instead to on-premises option, for which an example concern is: An organization assumes moving an AI model on-premises automatically makes it safe despite missing patching and monitoring capabilities. It could be useful in that different situation, but it would not directly address the open-source license review deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Legal and technical reviews confirm permitted deployment and required obligations.

This response relates instead to classic versus generative choice, for which an example concern is: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. It could be useful in that different situation, but it would not directly address the open-source license review deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Legal and technical reviews confirm permitted deployment and required obligations.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported open-source license review issue at a large multibranch organization in Oslo, the relevant corrective action is: Evaluate the specific model license, usage conditions, provenance, and maintenance responsibilities. The offered observation does not establish whether that targeted control succeeded.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported open-source license review issue at a large multibranch organization in Oslo, the relevant corrective action is: Evaluate the specific model license, usage conditions, provenance, and maintenance responsibilities. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported open-source license review issue at a large multibranch organization in Oslo, the relevant corrective action is: Evaluate the specific model license, usage conditions, provenance, and maintenance responsibilities. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the model-card limitations deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Deployers can identify tested contexts, untested groups, and required safeguards before adoption.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the model-card limitations deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Deployers can identify tested contexts, untested groups, and required safeguards before adoption.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the model-card limitations deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Deployers can identify tested contexts, untested groups, and required safeguards before adoption.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported model-card limitations issue at a regional technology consortium in Auckland, the relevant corrective action is: Prepare a usable model card describing purpose, evaluations, limitations, and appropriate operating conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported model-card limitations issue at a regional technology consortium in Auckland, the relevant corrective action is: Prepare a usable model card describing purpose, evaluations, limitations, and appropriate operating conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support red-teaming schedule, a distinct governance need illustrated by: A conversational model passed one initial safety test but has never undergone adversarial probing after new tools were added. For the reported model-card limitations issue at a regional technology consortium in Auckland, the relevant corrective action is: Prepare a usable model card describing purpose, evaluations, limitations, and appropriate operating conditions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to technical documentation duty, for which an example concern is: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. It could be useful in that different situation, but it would not directly address the ai system transparency deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: A user-facing interaction clearly identifies AI involvement where legally required.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the ai system transparency deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: A user-facing interaction clearly identifies AI involvement where legally required.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the ai system transparency deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: A user-facing interaction clearly identifies AI involvement where legally required.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported ai system transparency issue at a recruitment services group in Dublin, the relevant corrective action is: Assess applicable AI-interaction disclosure duties and make any required disclosure understandable to users. The offered observation does not establish whether that targeted control succeeded.

This result would support conformity assessment planning, a distinct governance need illustrated by: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. For the reported ai system transparency issue at a recruitment services group in Dublin, the relevant corrective action is: Assess applicable AI-interaction disclosure duties and make any required disclosure understandable to users. The offered observation does not establish whether that targeted control succeeded.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported ai system transparency issue at a recruitment services group in Dublin, the relevant corrective action is: Assess applicable AI-interaction disclosure duties and make any required disclosure understandable to users. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the governance change management deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Change records show revised owners, risk classification, controls, and operational approval.

This response relates instead to supplier-vs-deployer expectations, for which an example concern is: A procurement contract labels the system seller as the only accountable party even when the customer will configure and operate the service. It could be useful in that different situation, but it would not directly address the governance change management deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Change records show revised owners, risk classification, controls, and operational approval.

This response relates instead to named decision owner, for which an example concern is: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. It could be useful in that different situation, but it would not directly address the governance change management deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Change records show revised owners, risk classification, controls, and operational approval.

This result would support enterprise inventory ownership, a distinct governance need illustrated by: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. For the reported governance change management issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Trigger formal governance review when AI capability, autonomy, or intended use materially changes. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported governance change management issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Trigger formal governance review when AI capability, autonomy, or intended use materially changes. The offered observation does not establish whether that targeted control succeeded.

This result would support stakeholder engagement, a distinct governance need illustrated by: A service is designed for vulnerable users while no representatives of the affected community participate in requirements or review. For the reported governance change management issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Trigger formal governance review when AI capability, autonomy, or intended use materially changes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic orchestration risk, for which an example concern is: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. It could be useful in that different situation, but it would not directly address the proprietary vendor model deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Due diligence documents service terms, change management, data controls, and exit feasibility.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the proprietary vendor model deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Due diligence documents service terms, change management, data controls, and exit feasibility.

This response relates instead to edge inference suitability, for which an example concern is: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. It could be useful in that different situation, but it would not directly address the proprietary vendor model deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Due diligence documents service terms, change management, data controls, and exit feasibility.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported proprietary vendor model issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported proprietary vendor model issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported proprietary vendor model issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.