Exam Bundle

This result would support safety and reliability monitoring, a distinct governance need illustrated by: An AI-powered workflow is monitored only for uptime while harmful errors can occur even when the service is available. For the reported incident containment issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Activate risk-proportionate containment such as blocking affected features or restricting access. The offered observation does not establish whether that targeted control succeeded.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported incident containment issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Activate risk-proportionate containment such as blocking affected features or restricting access. The offered observation does not establish whether that targeted control succeeded.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported incident containment issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Activate risk-proportionate containment such as blocking affected features or restricting access. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the training experiment reproducibility deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An authorized reviewer can reproduce the reported result or explain measured variance.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the training experiment reproducibility deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An authorized reviewer can reproduce the reported result or explain measured variance.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the training experiment reproducibility deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An authorized reviewer can reproduce the reported result or explain measured variance.

This result would support integration and end-to-end tests, a distinct governance need illustrated by: A model passes unit tests but the live application passes the wrong input field and silently reverses classifications. For the reported training experiment reproducibility issue at a large multibranch organization in Oslo, the relevant corrective action is: Record experiment configuration, data and code versions, evaluation splits, and reproducibility evidence. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported training experiment reproducibility issue at a large multibranch organization in Oslo, the relevant corrective action is: Record experiment configuration, data and code versions, evaluation splits, and reproducibility evidence. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported training experiment reproducibility issue at a large multibranch organization in Oslo, the relevant corrective action is: Record experiment configuration, data and code versions, evaluation splits, and reproducibility evidence. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to purpose limitation, for which an example concern is: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. It could be useful in that different situation, but it would not directly address the data minimization deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Data mapping confirms unnecessary identifiers are excluded or appropriately transformed.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the data minimization deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Data mapping confirms unnecessary identifiers are excluded or appropriately transformed.

This response relates instead to lawful basis before training, for which an example concern is: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. It could be useful in that different situation, but it would not directly address the data minimization deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Data mapping confirms unnecessary identifiers are excluded or appropriately transformed.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported data minimization issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Reduce training and inference inputs to information necessary for the justified purpose. The offered observation does not establish whether that targeted control succeeded.

This result would support automated decisions and contestability, a distinct governance need illustrated by: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. For the reported data minimization issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Reduce training and inference inputs to information necessary for the justified purpose. The offered observation does not establish whether that targeted control succeeded.

This result would support data-subject rights handling, a distinct governance need illustrated by: A requester seeks information about personal data used in an AI service, but the organization has no process for locating relevant data. For the reported data minimization issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Reduce training and inference inputs to information necessary for the justified purpose. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the vendor training-data terms deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The signed agreement states permitted data uses and enforceable protection and deletion conditions.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the vendor training-data terms deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The signed agreement states permitted data uses and enforceable protection and deletion conditions.

This response relates instead to service availability contract, for which an example concern is: A mission-critical deployment relies on a third-party model with no incident notification or service recovery obligations. It could be useful in that different situation, but it would not directly address the vendor training-data terms deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The signed agreement states permitted data uses and enforceable protection and deletion conditions.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported vendor training-data terms issue at a global platform operator in Berlin, the relevant corrective action is: Assess and negotiate relevant data retention, reuse, confidentiality, and processing terms. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported vendor training-data terms issue at a global platform operator in Berlin, the relevant corrective action is: Assess and negotiate relevant data retention, reuse, confidentiality, and processing terms. The offered observation does not establish whether that targeted control succeeded.

This result would support residual-risk acceptance, a distinct governance need illustrated by: A third-party AI tool has known limitations, but nobody at the purchasing organization has formally accepted or rejected remaining risks. For the reported vendor training-data terms issue at a global platform operator in Berlin, the relevant corrective action is: Assess and negotiate relevant data retention, reuse, confidentiality, and processing terms. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the privacy-preserving data treatment deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: The retained training data meets documented necessity and privacy controls.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the privacy-preserving data treatment deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: The retained training data meets documented necessity and privacy controls.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the privacy-preserving data treatment deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: The retained training data meets documented necessity and privacy controls.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported privacy-preserving data treatment issue at a public health agency in Ottawa, the relevant corrective action is: Apply proportionate minimization, de-identification, and access restriction while validating utility. The offered observation does not establish whether that targeted control succeeded.

This result would support representative sampling, a distinct governance need illustrated by: A voice model trained almost entirely on one accent is marketed as equally reliable for all language communities. For the reported privacy-preserving data treatment issue at a public health agency in Ottawa, the relevant corrective action is: Apply proportionate minimization, de-identification, and access restriction while validating utility. The offered observation does not establish whether that targeted control succeeded.

This result would support data leakage between splits, a distinct governance need illustrated by: The same customer's near-identical records appear in both training and evaluation datasets, inflating model performance. For the reported privacy-preserving data treatment issue at a public health agency in Ottawa, the relevant corrective action is: Apply proportionate minimization, de-identification, and access restriction while validating utility. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to generative versus predictive scope, for which an example concern is: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. It could be useful in that different situation, but it would not directly address the algorithmic unfairness deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Disaggregated evaluation documents group-level error measures and remediation outcomes.

This response relates instead to data dependency and drift, for which an example concern is: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. It could be useful in that different situation, but it would not directly address the algorithmic unfairness deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Disaggregated evaluation documents group-level error measures and remediation outcomes.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the algorithmic unfairness deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Disaggregated evaluation documents group-level error measures and remediation outcomes.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported algorithmic unfairness issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.

This result would support supervised learning limits, a distinct governance need illustrated by: A project promises highly reliable supervised predictions but has only unlabeled historical records and no ground-truth outcomes. For the reported algorithmic unfairness issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.

This result would support generative versus predictive scope, a distinct governance need illustrated by: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. For the reported algorithmic unfairness issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.