Exam Bundle

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported cross-functional review issue at an insurance provider in Toronto, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.

This result would support named decision owner, a distinct governance need illustrated by: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. For the reported cross-functional review issue at an insurance provider in Toronto, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.

This result would support stakeholder engagement, a distinct governance need illustrated by: A service is designed for vulnerable users while no representatives of the affected community participate in requirements or review. For the reported cross-functional review issue at an insurance provider in Toronto, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the human oversight requirements deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Operators can understand limitations, intervene, and stop or disregard problematic recommendations.

This response relates instead to deployer operational duties, for which an example concern is: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. It could be useful in that different situation, but it would not directly address the human oversight requirements deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Operators can understand limitations, intervene, and stop or disregard problematic recommendations.

This response relates instead to prohibited uses review, for which an example concern is: A procurement team plans an AI capability that may fall under a legally prohibited practice without screening its purpose or context. It could be useful in that different situation, but it would not directly address the human oversight requirements deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Operators can understand limitations, intervene, and stop or disregard problematic recommendations.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported human oversight requirements issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Implement legally appropriate human oversight capability and train authorized operators. The offered observation does not establish whether that targeted control succeeded.

This result would support training-data governance duty, a distinct governance need illustrated by: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. For the reported human oversight requirements issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Implement legally appropriate human oversight capability and train authorized operators. The offered observation does not establish whether that targeted control succeeded.

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported human oversight requirements issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Implement legally appropriate human oversight capability and train authorized operators. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the reliability regression tests deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Upgrade reports compare old and new releases on the same safety-critical benchmarks.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the reliability regression tests deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Upgrade reports compare old and new releases on the same safety-critical benchmarks.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the reliability regression tests deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Upgrade reports compare old and new releases on the same safety-critical benchmarks.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported reliability regression tests issue at a professional services group in London, the relevant corrective action is: Retain risk-based regression test suites covering prior critical failure modes. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported reliability regression tests issue at a professional services group in London, the relevant corrective action is: Retain risk-based regression test suites covering prior critical failure modes. The offered observation does not establish whether that targeted control succeeded.

This result would support red-teaming schedule, a distinct governance need illustrated by: A conversational model passed one initial safety test but has never undergone adversarial probing after new tools were added. For the reported reliability regression tests issue at a professional services group in London, the relevant corrective action is: Retain risk-based regression test suites covering prior critical failure modes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proprietary model self-deployment, for which an example concern is: A company builds and deploys its own AI product but assumes self-hosting eliminates provider-side documentation and safety duties. It could be useful in that different situation, but it would not directly address the subprocessor oversight deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Supplier records identify downstream processors and applicable oversight requirements.

This response relates instead to vendor audit rights, for which an example concern is: A provider refuses to furnish material security or risk-assessment evidence while the deployment poses serious compliance exposure. It could be useful in that different situation, but it would not directly address the subprocessor oversight deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Supplier records identify downstream processors and applicable oversight requirements.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the subprocessor oversight deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Supplier records identify downstream processors and applicable oversight requirements.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported subprocessor oversight issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support vendor model changes, a distinct governance need illustrated by: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. For the reported subprocessor oversight issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported subprocessor oversight issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate subprocessor transparency, approval or notification mechanisms, and contractual accountability. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to third-party procurement due diligence, for which an example concern is: Procurement buys a model API based only on its benchmark score without reviewing data reuse or subcontractor risks. It could be useful in that different situation, but it would not directly address the contract change monitoring deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The contract register contains versioned terms, notifications, and remediation decisions.

This response relates instead to documentation and traceability, for which an example concern is: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. It could be useful in that different situation, but it would not directly address the contract change monitoring deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The contract register contains versioned terms, notifications, and remediation decisions.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the contract change monitoring deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The contract register contains versioned terms, notifications, and remediation decisions.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported contract change monitoring issue at a regional service provider in Singapore, the relevant corrective action is: Require contractual change notification and reassessment of material supplier and processing changes. The offered observation does not establish whether that targeted control succeeded.

This result would support third-party procurement due diligence, a distinct governance need illustrated by: Procurement buys a model API based only on its benchmark score without reviewing data reuse or subcontractor risks. For the reported contract change monitoring issue at a regional service provider in Singapore, the relevant corrective action is: Require contractual change notification and reassessment of material supplier and processing changes. The offered observation does not establish whether that targeted control succeeded.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported contract change monitoring issue at a regional service provider in Singapore, the relevant corrective action is: Require contractual change notification and reassessment of material supplier and processing changes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to training-data governance duty, for which an example concern is: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. It could be useful in that different situation, but it would not directly address the conformity assessment planning deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A completed assessment and associated evidence are available before the relevant release gate.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the conformity assessment planning deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A completed assessment and associated evidence are available before the relevant release gate.

This response relates instead to regulatory incident reporting, for which an example concern is: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. It could be useful in that different situation, but it would not directly address the conformity assessment planning deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A completed assessment and associated evidence are available before the relevant release gate.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported conformity assessment planning issue at a large multibranch organization in Oslo, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported conformity assessment planning issue at a large multibranch organization in Oslo, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported conformity assessment planning issue at a large multibranch organization in Oslo, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.