Exam Bundle

This result would support credit fairness, a distinct governance need illustrated by: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. For the reported confidential business material issue at a corporate HR program in Amsterdam, the relevant corrective action is: Apply contractual and trade-secret safeguards before disclosing protected information to AI suppliers. The offered observation does not establish whether that targeted control succeeded.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported confidential business material issue at a corporate HR program in Amsterdam, the relevant corrective action is: Apply contractual and trade-secret safeguards before disclosing protected information to AI suppliers. The offered observation does not establish whether that targeted control succeeded.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported confidential business material issue at a corporate HR program in Amsterdam, the relevant corrective action is: Apply contractual and trade-secret safeguards before disclosing protected information to AI suppliers. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to service availability contract, for which an example concern is: A mission-critical deployment relies on a third-party model with no incident notification or service recovery obligations. It could be useful in that different situation, but it would not directly address the vendor training-data terms deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The signed agreement states permitted data uses and enforceable protection and deletion conditions.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the vendor training-data terms deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The signed agreement states permitted data uses and enforceable protection and deletion conditions.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the vendor training-data terms deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The signed agreement states permitted data uses and enforceable protection and deletion conditions.

This result would support residual-risk acceptance, a distinct governance need illustrated by: A third-party AI tool has known limitations, but nobody at the purchasing organization has formally accepted or rejected remaining risks. For the reported vendor training-data terms issue at a professional services group in London, the relevant corrective action is: Assess and negotiate relevant data retention, reuse, confidentiality, and processing terms. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported vendor training-data terms issue at a professional services group in London, the relevant corrective action is: Assess and negotiate relevant data retention, reuse, confidentiality, and processing terms. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported vendor training-data terms issue at a professional services group in London, the relevant corrective action is: Assess and negotiate relevant data retention, reuse, confidentiality, and processing terms. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to privacy-preserving data treatment, for which an example concern is: A team keeps full identifiable transcripts in an experimental dataset despite the ability to meet its goal with less personal detail. It could be useful in that different situation, but it would not directly address the bias mitigation validation deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Post-mitigation testing documents trade-offs, group outcomes, and residual impacts.

This response relates instead to representative sampling, for which an example concern is: A voice model trained almost entirely on one accent is marketed as equally reliable for all language communities. It could be useful in that different situation, but it would not directly address the bias mitigation validation deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Post-mitigation testing documents trade-offs, group outcomes, and residual impacts.

This response relates instead to model interpretability checks, for which an example concern is: A risk-scoring tool is deployed with generic feature-importance plots that have not been tested for stability or usefulness. It could be useful in that different situation, but it would not directly address the bias mitigation validation deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Post-mitigation testing documents trade-offs, group outcomes, and residual impacts.

This result would support representative sampling, a distinct governance need illustrated by: A voice model trained almost entirely on one accent is marketed as equally reliable for all language communities. For the reported bias mitigation validation issue at an international services company in Helsinki, the relevant corrective action is: Re-evaluate fairness and overall utility after mitigation across all relevant groups. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported bias mitigation validation issue at an international services company in Helsinki, the relevant corrective action is: Re-evaluate fairness and overall utility after mitigation across all relevant groups. The offered observation does not establish whether that targeted control succeeded.

This result would support integration and end-to-end tests, a distinct governance need illustrated by: A model passes unit tests but the live application passes the wrong input field and silently reverses classifications. For the reported bias mitigation validation issue at an international services company in Helsinki, the relevant corrective action is: Re-evaluate fairness and overall utility after mitigation across all relevant groups. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to deployer operational duties, for which an example concern is: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. It could be useful in that different situation, but it would not directly address the human oversight requirements deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Operators can understand limitations, intervene, and stop or disregard problematic recommendations.

This response relates instead to prohibited uses review, for which an example concern is: A procurement team plans an AI capability that may fall under a legally prohibited practice without screening its purpose or context. It could be useful in that different situation, but it would not directly address the human oversight requirements deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Operators can understand limitations, intervene, and stop or disregard problematic recommendations.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the human oversight requirements deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Operators can understand limitations, intervene, and stop or disregard problematic recommendations.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported human oversight requirements issue at a technology services group in Stockholm, the relevant corrective action is: Implement legally appropriate human oversight capability and train authorized operators. The offered observation does not establish whether that targeted control succeeded.

This result would support training-data governance duty, a distinct governance need illustrated by: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. For the reported human oversight requirements issue at a technology services group in Stockholm, the relevant corrective action is: Implement legally appropriate human oversight capability and train authorized operators. The offered observation does not establish whether that targeted control succeeded.

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported human oversight requirements issue at a technology services group in Stockholm, the relevant corrective action is: Implement legally appropriate human oversight capability and train authorized operators. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to governance change management, for which an example concern is: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. It could be useful in that different situation, but it would not directly address the proportional control design deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: Documented control tiers impose stronger evidence for higher-impact systems without losing essential safeguards.

This response relates instead to supplier-vs-deployer expectations, for which an example concern is: A procurement contract labels the system seller as the only accountable party even when the customer will configure and operate the service. It could be useful in that different situation, but it would not directly address the proportional control design deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: Documented control tiers impose stronger evidence for higher-impact systems without losing essential safeguards.

This response relates instead to enterprise inventory ownership, for which an example concern is: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. It could be useful in that different situation, but it would not directly address the proportional control design deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: Documented control tiers impose stronger evidence for higher-impact systems without losing essential safeguards.

This result would support risk tolerance communication, a distinct governance need illustrated by: Product teams make incompatible launch decisions because leadership has never defined unacceptable AI impacts or escalation thresholds. For the reported proportional control design issue at a hospital group in Melbourne, the relevant corrective action is: Scale governance controls to use-case risk, criticality, organizational maturity, and impact. The offered observation does not establish whether that targeted control succeeded.

This result would support enterprise inventory ownership, a distinct governance need illustrated by: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. For the reported proportional control design issue at a hospital group in Melbourne, the relevant corrective action is: Scale governance controls to use-case risk, criticality, organizational maturity, and impact. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported proportional control design issue at a hospital group in Melbourne, the relevant corrective action is: Scale governance controls to use-case risk, criticality, organizational maturity, and impact. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to on-premises option, for which an example concern is: An organization assumes moving an AI model on-premises automatically makes it safe despite missing patching and monitoring capabilities. It could be useful in that different situation, but it would not directly address the multimodal capability decision deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Representative text-and-image cases meet the defined task and safety criteria.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the multimodal capability decision deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Representative text-and-image cases meet the defined task and safety criteria.

This response relates instead to deployment fit assessment, for which an example concern is: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. It could be useful in that different situation, but it would not directly address the multimodal capability decision deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Representative text-and-image cases meet the defined task and safety criteria.

This result would support fine-tuning governance, a distinct governance need illustrated by: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. For the reported multimodal capability decision issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate modality requirements and select supported multimodal processing if justified. The offered observation does not establish whether that targeted control succeeded.

This result would support small versus large model, a distinct governance need illustrated by: An edge device must operate offline, but a team selects a large remote model based only on headline benchmark scores. For the reported multimodal capability decision issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate modality requirements and select supported multimodal processing if justified. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported multimodal capability decision issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate modality requirements and select supported multimodal processing if justified. The offered observation does not establish whether that targeted control succeeded.