Exam Bundle

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported board-level oversight issue at a professional services group in London, the relevant corrective action is: Establish regular governing-body reporting on AI objectives, material risks, and unresolved exceptions. The offered observation does not establish whether that targeted control succeeded.

This result would support enterprise inventory ownership, a distinct governance need illustrated by: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. For the reported board-level oversight issue at a professional services group in London, the relevant corrective action is: Establish regular governing-body reporting on AI objectives, material risks, and unresolved exceptions. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported board-level oversight issue at a professional services group in London, the relevant corrective action is: Establish regular governing-body reporting on AI objectives, material risks, and unresolved exceptions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the deployer operational duties deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Operating records show trained overseers, appropriate inputs, and local performance checks.

This response relates instead to human oversight requirements, for which an example concern is: A regulated high-risk model advises caseworkers, but they lack training or the practical authority to reject erroneous outputs. It could be useful in that different situation, but it would not directly address the deployer operational duties deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Operating records show trained overseers, appropriate inputs, and local performance checks.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the deployer operational duties deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Operating records show trained overseers, appropriate inputs, and local performance checks.

This result would support prohibited uses review, a distinct governance need illustrated by: A procurement team plans an AI capability that may fall under a legally prohibited practice without screening its purpose or context. For the reported deployer operational duties issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assign deployer responsibilities for instructions, competent oversight, suitable input data, and monitoring. The offered observation does not establish whether that targeted control succeeded.

This result would support training-data governance duty, a distinct governance need illustrated by: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. For the reported deployer operational duties issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assign deployer responsibilities for instructions, competent oversight, suitable input data, and monitoring. The offered observation does not establish whether that targeted control succeeded.

This result would support regulatory incident reporting, a distinct governance need illustrated by: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. For the reported deployer operational duties issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assign deployer responsibilities for instructions, competent oversight, suitable input data, and monitoring. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the label-quality audit deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Inter-annotator checks and adjudication records demonstrate acceptable labeling quality.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the label-quality audit deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Inter-annotator checks and adjudication records demonstrate acceptable labeling quality.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the label-quality audit deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Inter-annotator checks and adjudication records demonstrate acceptable labeling quality.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported label-quality audit issue at a software services vendor in Lisbon, the relevant corrective action is: Define labeling guidance and measure annotation consistency before relying on labels. The offered observation does not establish whether that targeted control succeeded.

This result would support data-use rights, a distinct governance need illustrated by: A developer acquires a large web corpus without assessing whether its license permits model training. For the reported label-quality audit issue at a software services vendor in Lisbon, the relevant corrective action is: Define labeling guidance and measure annotation consistency before relying on labels. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported label-quality audit issue at a software services vendor in Lisbon, the relevant corrective action is: Define labeling guidance and measure annotation consistency before relying on labels. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to end-of-life and archival controls, for which an example concern is: A retired AI service remains reachable through an undocumented integration and continues receiving user data. It could be useful in that different situation, but it would not directly address the threat modeling new data flow deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Access-control and attack-simulation evidence covers the new retrieval connector.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the threat modeling new data flow deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Access-control and attack-simulation evidence covers the new retrieval connector.

This response relates instead to incident containment, for which an example concern is: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. It could be useful in that different situation, but it would not directly address the threat modeling new data flow deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Access-control and attack-simulation evidence covers the new retrieval connector.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported threat modeling new data flow issue at a software services vendor in Lisbon, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.

This result would support regular control audit, a distinct governance need illustrated by: A deployed AI system has unchanged governance paperwork despite major operational changes and no control re-testing. For the reported threat modeling new data flow issue at a software services vendor in Lisbon, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported threat modeling new data flow issue at a software services vendor in Lisbon, the relevant corrective action is: Assess new trust boundaries and exfiltration paths before activating additional data access. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to third-party procurement due diligence, for which an example concern is: Procurement buys a model API based only on its benchmark score without reviewing data reuse or subcontractor risks. It could be useful in that different situation, but it would not directly address the contract change monitoring deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The contract register contains versioned terms, notifications, and remediation decisions.

This response relates instead to documentation and traceability, for which an example concern is: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. It could be useful in that different situation, but it would not directly address the contract change monitoring deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The contract register contains versioned terms, notifications, and remediation decisions.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the contract change monitoring deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The contract register contains versioned terms, notifications, and remediation decisions.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported contract change monitoring issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require contractual change notification and reassessment of material supplier and processing changes. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported contract change monitoring issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require contractual change notification and reassessment of material supplier and processing changes. The offered observation does not establish whether that targeted control succeeded.

This result would support third-party procurement due diligence, a distinct governance need illustrated by: Procurement buys a model API based only on its benchmark score without reviewing data reuse or subcontractor risks. For the reported contract change monitoring issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Require contractual change notification and reassessment of material supplier and processing changes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to copyright in training data, for which an example concern is: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. It could be useful in that different situation, but it would not directly address the confidential business material deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Approved tools and disclosure controls keep restricted business material within authorized processing arrangements.

This response relates instead to credit fairness, for which an example concern is: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. It could be useful in that different situation, but it would not directly address the confidential business material deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Approved tools and disclosure controls keep restricted business material within authorized processing arrangements.

This response relates instead to consumer deception, for which an example concern is: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. It could be useful in that different situation, but it would not directly address the confidential business material deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Approved tools and disclosure controls keep restricted business material within authorized processing arrangements.

This result would support credit fairness, a distinct governance need illustrated by: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. For the reported confidential business material issue at a corporate HR program in Amsterdam, the relevant corrective action is: Apply contractual and trade-secret safeguards before disclosing protected information to AI suppliers. The offered observation does not establish whether that targeted control succeeded.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported confidential business material issue at a corporate HR program in Amsterdam, the relevant corrective action is: Apply contractual and trade-secret safeguards before disclosing protected information to AI suppliers. The offered observation does not establish whether that targeted control succeeded.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported confidential business material issue at a corporate HR program in Amsterdam, the relevant corrective action is: Apply contractual and trade-secret safeguards before disclosing protected information to AI suppliers. The offered observation does not establish whether that targeted control succeeded.