Exam Bundle

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported proprietary vendor model issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported proprietary vendor model issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported proprietary vendor model issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the representative sampling deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Group-level evaluations include underrepresented speaker categories and documented gaps.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the representative sampling deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Group-level evaluations include underrepresented speaker categories and documented gaps.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the representative sampling deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Group-level evaluations include underrepresented speaker categories and documented gaps.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported representative sampling issue at a regional service provider in Singapore, the relevant corrective action is: Assess target-population representation and improve sampling or mitigation before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy-preserving data treatment, a distinct governance need illustrated by: A team keeps full identifiable transcripts in an experimental dataset despite the ability to meet its goal with less personal detail. For the reported representative sampling issue at a regional service provider in Singapore, the relevant corrective action is: Assess target-population representation and improve sampling or mitigation before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support data-use rights, a distinct governance need illustrated by: A developer acquires a large web corpus without assessing whether its license permits model training. For the reported representative sampling issue at a regional service provider in Singapore, the relevant corrective action is: Assess target-population representation and improve sampling or mitigation before deployment. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the technical documentation duty deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The compliance file supports review of intended purpose, design, tests, limitations, and applicable controls.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the technical documentation duty deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The compliance file supports review of intended purpose, design, tests, limitations, and applicable controls.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the technical documentation duty deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The compliance file supports review of intended purpose, design, tests, limitations, and applicable controls.

This result would support high-risk management system, a distinct governance need illustrated by: A provider of a potentially high-risk AI system cannot show a documented ongoing process for evaluating foreseeable risks. For the reported technical documentation duty issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Prepare required technical documentation and maintain it through relevant system changes. The offered observation does not establish whether that targeted control succeeded.

This result would support human oversight requirements, a distinct governance need illustrated by: A regulated high-risk model advises caseworkers, but they lack training or the practical authority to reject erroneous outputs. For the reported technical documentation duty issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Prepare required technical documentation and maintain it through relevant system changes. The offered observation does not establish whether that targeted control succeeded.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported technical documentation duty issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Prepare required technical documentation and maintain it through relevant system changes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the post-market monitoring plan deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The plan links live evidence to assigned review actions and retention requirements.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the post-market monitoring plan deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The plan links live evidence to assigned review actions and retention requirements.

This response relates instead to monitoring ownership, for which an example concern is: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. It could be useful in that different situation, but it would not directly address the post-market monitoring plan deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The plan links live evidence to assigned review actions and retention requirements.

This result would support threat modeling new data flow, a distinct governance need illustrated by: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. For the reported post-market monitoring plan issue at a professional services group in London, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.

This result would support downstream harm forecasts, a distinct governance need illustrated by: An innocuous text generator is integrated into a system that automatically sends consequential legal notices without reassessing impact. For the reported post-market monitoring plan issue at a professional services group in London, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.

This result would support regular control audit, a distinct governance need illustrated by: A deployed AI system has unchanged governance paperwork despite major operational changes and no control re-testing. For the reported post-market monitoring plan issue at a professional services group in London, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to data-use rights, for which an example concern is: A developer acquires a large web corpus without assessing whether its license permits model training. It could be useful in that different situation, but it would not directly address the dataset provenance deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A source-to-model trace identifies data origins, transformations, and impacted model versions.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the dataset provenance deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A source-to-model trace identifies data origins, transformations, and impacted model versions.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the dataset provenance deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A source-to-model trace identifies data origins, transformations, and impacted model versions.

This result would support class-imbalance testing, a distinct governance need illustrated by: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. For the reported dataset provenance issue at a regional technology consortium in Auckland, the relevant corrective action is: Establish dataset lineage and provenance through ingestion, transformation, and model training. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported dataset provenance issue at a regional technology consortium in Auckland, the relevant corrective action is: Establish dataset lineage and provenance through ingestion, transformation, and model training. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported dataset provenance issue at a regional technology consortium in Auckland, the relevant corrective action is: Establish dataset lineage and provenance through ingestion, transformation, and model training. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to stakeholder engagement, for which an example concern is: A service is designed for vulnerable users while no representatives of the affected community participate in requirements or review. It could be useful in that different situation, but it would not directly address the cross-functional review deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: Governance meeting records capture diverse review findings and accountable resolutions.

This response relates instead to enterprise inventory ownership, for which an example concern is: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. It could be useful in that different situation, but it would not directly address the cross-functional review deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: Governance meeting records capture diverse review findings and accountable resolutions.

This response relates instead to board-level oversight, for which an example concern is: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. It could be useful in that different situation, but it would not directly address the cross-functional review deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: Governance meeting records capture diverse review findings and accountable resolutions.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported cross-functional review issue at an insurance provider in Toronto, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.

This result would support named decision owner, a distinct governance need illustrated by: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. For the reported cross-functional review issue at an insurance provider in Toronto, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.

This result would support stakeholder engagement, a distinct governance need illustrated by: A service is designed for vulnerable users while no representatives of the affected community participate in requirements or review. For the reported cross-functional review issue at an insurance provider in Toronto, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.