Exam Bundle

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported conformity assessment planning issue at a large multibranch organization in Oslo, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported conformity assessment planning issue at a large multibranch organization in Oslo, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported conformity assessment planning issue at a large multibranch organization in Oslo, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to multimodal capability decision, for which an example concern is: A document workflow requires understanding diagrams and photographs, but procurement tests only text-only model capability. It could be useful in that different situation, but it would not directly address the open-source license review deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Legal and technical reviews confirm permitted deployment and required obligations.

This response relates instead to on-premises option, for which an example concern is: An organization assumes moving an AI model on-premises automatically makes it safe despite missing patching and monitoring capabilities. It could be useful in that different situation, but it would not directly address the open-source license review deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Legal and technical reviews confirm permitted deployment and required obligations.

This response relates instead to classic versus generative choice, for which an example concern is: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. It could be useful in that different situation, but it would not directly address the open-source license review deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Legal and technical reviews confirm permitted deployment and required obligations.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported open-source license review issue at a regional technology consortium in Auckland, the relevant corrective action is: Evaluate the specific model license, usage conditions, provenance, and maintenance responsibilities. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported open-source license review issue at a regional technology consortium in Auckland, the relevant corrective action is: Evaluate the specific model license, usage conditions, provenance, and maintenance responsibilities. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported open-source license review issue at a regional technology consortium in Auckland, the relevant corrective action is: Evaluate the specific model license, usage conditions, provenance, and maintenance responsibilities. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to architecture security review, for which an example concern is: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. It could be useful in that different situation, but it would not directly address the human oversight by design deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: Usability tests show that reviewers can identify errors, correct outcomes, and stop unsafe processing.

This response relates instead to purpose and success definition, for which an example concern is: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. It could be useful in that different situation, but it would not directly address the human oversight by design deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: Usability tests show that reviewers can identify errors, correct outcomes, and stop unsafe processing.

This response relates instead to design decision trace, for which an example concern is: The model team cannot explain why a sensitive input feature was retained after a privacy objection. It could be useful in that different situation, but it would not directly address the human oversight by design deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: Usability tests show that reviewers can identify errors, correct outcomes, and stop unsafe processing.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported human oversight by design issue at a banking group in Zurich, the relevant corrective action is: Design meaningful review tools, information access, authority, and escalation before implementation. The offered observation does not establish whether that targeted control succeeded.

This result would support pilot containment, a distinct governance need illustrated by: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. For the reported human oversight by design issue at a banking group in Zurich, the relevant corrective action is: Design meaningful review tools, information access, authority, and escalation before implementation. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported human oversight by design issue at a banking group in Zurich, the relevant corrective action is: Design meaningful review tools, information access, authority, and escalation before implementation. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the automated decisions and contestability deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Records demonstrate necessary explanations, review routes, and lawful decision procedures.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the automated decisions and contestability deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Records demonstrate necessary explanations, review routes, and lawful decision procedures.

This response relates instead to lawful basis before training, for which an example concern is: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. It could be useful in that different situation, but it would not directly address the automated decisions and contestability deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Records demonstrate necessary explanations, review routes, and lawful decision procedures.

This result would support data-subject rights handling, a distinct governance need illustrated by: A requester seeks information about personal data used in an AI service, but the organization has no process for locating relevant data. For the reported automated decisions and contestability issue at a professional services group in London, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.

This result would support data minimization, a distinct governance need illustrated by: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. For the reported automated decisions and contestability issue at a professional services group in London, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported automated decisions and contestability issue at a professional services group in London, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the probabilistic output and review deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Repeated and edge-case tests reveal output variability and route uncertain decisions for human scrutiny.

This response relates instead to data dependency and drift, for which an example concern is: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. It could be useful in that different situation, but it would not directly address the probabilistic output and review deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Repeated and edge-case tests reveal output variability and route uncertain decisions for human scrutiny.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the probabilistic output and review deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Repeated and edge-case tests reveal output variability and route uncertain decisions for human scrutiny.

This result would support safety versus raw accuracy, a distinct governance need illustrated by: An industrial anomaly detector improves average accuracy but produces rare unsafe false negatives in a safety-critical process. For the reported probabilistic output and review issue at a technology services group in Stockholm, the relevant corrective action is: Establish testable quality thresholds and an exception-review path reflecting probabilistic outputs. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported probabilistic output and review issue at a technology services group in Stockholm, the relevant corrective action is: Establish testable quality thresholds and an exception-review path reflecting probabilistic outputs. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported probabilistic output and review issue at a technology services group in Stockholm, the relevant corrective action is: Establish testable quality thresholds and an exception-review path reflecting probabilistic outputs. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor audit rights, for which an example concern is: A provider refuses to furnish material security or risk-assessment evidence while the deployment poses serious compliance exposure. It could be useful in that different situation, but it would not directly address the vendor model changes deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Operational records identify material vendor updates and corresponding validation decisions.

This response relates instead to residual-risk acceptance, for which an example concern is: A third-party AI tool has known limitations, but nobody at the purchasing organization has formally accepted or rejected remaining risks. It could be useful in that different situation, but it would not directly address the vendor model changes deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Operational records identify material vendor updates and corresponding validation decisions.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the vendor model changes deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Operational records identify material vendor updates and corresponding validation decisions.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported vendor model changes issue at a global platform operator in Berlin, the relevant corrective action is: Require change management, notice, and reevaluation rights proportionate to deployment risk. The offered observation does not establish whether that targeted control succeeded.

This result would support subprocessor oversight, a distinct governance need illustrated by: A vendor may route prompts through undisclosed subcontractors, but the buyer's review covers only the contracting company. For the reported vendor model changes issue at a global platform operator in Berlin, the relevant corrective action is: Require change management, notice, and reevaluation rights proportionate to deployment risk. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported vendor model changes issue at a global platform operator in Berlin, the relevant corrective action is: Require change management, notice, and reevaluation rights proportionate to deployment risk. The offered observation does not establish whether that targeted control succeeded.