Exam Bundle

This result would support fine-tuning governance, a distinct governance need illustrated by: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. For the reported multimodal capability decision issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate modality requirements and select supported multimodal processing if justified. The offered observation does not establish whether that targeted control succeeded.

This result would support small versus large model, a distinct governance need illustrated by: An edge device must operate offline, but a team selects a large remote model based only on headline benchmark scores. For the reported multimodal capability decision issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate modality requirements and select supported multimodal processing if justified. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported multimodal capability decision issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate modality requirements and select supported multimodal processing if justified. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to purpose and success definition, for which an example concern is: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. It could be useful in that different situation, but it would not directly address the design decision trace deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An auditor can trace the feature decision to evidence, approval, and later reassessments.

This response relates instead to human oversight by design, for which an example concern is: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. It could be useful in that different situation, but it would not directly address the design decision trace deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An auditor can trace the feature decision to evidence, approval, and later reassessments.

This response relates instead to risk-mitigation hierarchy, for which an example concern is: The team responds to an unacceptable safety risk only with user disclaimers despite a feasible safer design. It could be useful in that different situation, but it would not directly address the design decision trace deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An auditor can trace the feature decision to evidence, approval, and later reassessments.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported design decision trace issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain design decisions, rationales, owners, review outcomes, and risk exceptions in a versioned record. The offered observation does not establish whether that targeted control succeeded.

This result would support purpose and success definition, a distinct governance need illustrated by: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. For the reported design decision trace issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain design decisions, rationales, owners, review outcomes, and risk exceptions in a versioned record. The offered observation does not establish whether that targeted control succeeded.

This result would support impact assessment in design, a distinct governance need illustrated by: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. For the reported design decision trace issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain design decisions, rationales, owners, review outcomes, and risk exceptions in a versioned record. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the ai system transparency deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: A user-facing interaction clearly identifies AI involvement where legally required.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the ai system transparency deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: A user-facing interaction clearly identifies AI involvement where legally required.

This response relates instead to technical documentation duty, for which an example concern is: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. It could be useful in that different situation, but it would not directly address the ai system transparency deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: A user-facing interaction clearly identifies AI involvement where legally required.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported ai system transparency issue at a corporate HR program in Amsterdam, the relevant corrective action is: Assess applicable AI-interaction disclosure duties and make any required disclosure understandable to users. The offered observation does not establish whether that targeted control succeeded.

This result would support conformity assessment planning, a distinct governance need illustrated by: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. For the reported ai system transparency issue at a corporate HR program in Amsterdam, the relevant corrective action is: Assess applicable AI-interaction disclosure duties and make any required disclosure understandable to users. The offered observation does not establish whether that targeted control succeeded.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported ai system transparency issue at a corporate HR program in Amsterdam, the relevant corrective action is: Assess applicable AI-interaction disclosure duties and make any required disclosure understandable to users. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proprietary model self-deployment, for which an example concern is: A company builds and deploys its own AI product but assumes self-hosting eliminates provider-side documentation and safety duties. It could be useful in that different situation, but it would not directly address the pre-deployment impact review deficiency reported at a public administration agency in Ottawa. The targeted acceptance criterion here is: The deployment record addresses affected people, expected harms, safeguards, and local responsibilities.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the pre-deployment impact review deficiency reported at a public administration agency in Ottawa. The targeted acceptance criterion here is: The deployment record addresses affected people, expected harms, safeguards, and local responsibilities.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the pre-deployment impact review deficiency reported at a public administration agency in Ottawa. The targeted acceptance criterion here is: The deployment record addresses affected people, expected harms, safeguards, and local responsibilities.

This result would support proprietary model self-deployment, a distinct governance need illustrated by: A company builds and deploys its own AI product but assumes self-hosting eliminates provider-side documentation and safety duties. For the reported pre-deployment impact review issue at a public administration agency in Ottawa, the relevant corrective action is: Perform a use-context impact assessment before deploying the selected AI system. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported pre-deployment impact review issue at a public administration agency in Ottawa, the relevant corrective action is: Perform a use-context impact assessment before deploying the selected AI system. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported pre-deployment impact review issue at a public administration agency in Ottawa, the relevant corrective action is: Perform a use-context impact assessment before deploying the selected AI system. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to retraining governance, for which an example concern is: Automated retraining replaces models weekly without any checks that changes reduce bias or preserve required safety. It could be useful in that different situation, but it would not directly address the threat-model maintenance deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The updated threat model covers new tools, credentials, injection surfaces, and abuse controls.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the threat-model maintenance deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The updated threat model covers new tools, credentials, injection surfaces, and abuse controls.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the threat-model maintenance deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The updated threat model covers new tools, credentials, injection surfaces, and abuse controls.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported threat-model maintenance issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Refresh threat models for new agent capabilities, trust boundaries, and misuse paths. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported threat-model maintenance issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Refresh threat models for new agent capabilities, trust boundaries, and misuse paths. The offered observation does not establish whether that targeted control succeeded.

This result would support red-teaming schedule, a distinct governance need illustrated by: A conversational model passed one initial safety test but has never undergone adversarial probing after new tools were added. For the reported threat-model maintenance issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Refresh threat models for new agent capabilities, trust boundaries, and misuse paths. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to safety versus raw accuracy, for which an example concern is: An industrial anomaly detector improves average accuracy but produces rare unsafe false negatives in a safety-critical process. It could be useful in that different situation, but it would not directly address the supervised learning limits deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: A data-readiness assessment confirms labels and suitable held-out evaluation data.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the supervised learning limits deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: A data-readiness assessment confirms labels and suitable held-out evaluation data.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the supervised learning limits deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: A data-readiness assessment confirms labels and suitable held-out evaluation data.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported supervised learning limits issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess whether labeled, representative examples exist before selecting supervised learning for the intended outcome. The offered observation does not establish whether that targeted control succeeded.

This result would support generative versus predictive scope, a distinct governance need illustrated by: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. For the reported supervised learning limits issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess whether labeled, representative examples exist before selecting supervised learning for the intended outcome. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported supervised learning limits issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess whether labeled, representative examples exist before selecting supervised learning for the intended outcome. The offered observation does not establish whether that targeted control succeeded.