Exam Bundle

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported supervised learning limits issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess whether labeled, representative examples exist before selecting supervised learning for the intended outcome. The offered observation does not establish whether that targeted control succeeded.

This result would support generative versus predictive scope, a distinct governance need illustrated by: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. For the reported supervised learning limits issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess whether labeled, representative examples exist before selecting supervised learning for the intended outcome. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported supervised learning limits issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Assess whether labeled, representative examples exist before selecting supervised learning for the intended outcome. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to lawful basis before training, for which an example concern is: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. It could be useful in that different situation, but it would not directly address the data-subject rights handling deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: A tested request traces applicable data and meets appropriate response obligations.

This response relates instead to automated decisions and contestability, for which an example concern is: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. It could be useful in that different situation, but it would not directly address the data-subject rights handling deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: A tested request traces applicable data and meets appropriate response obligations.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the data-subject rights handling deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: A tested request traces applicable data and meets appropriate response obligations.

This result would support data minimization, a distinct governance need illustrated by: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. For the reported data-subject rights handling issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Create a rights-response workflow that identifies relevant personal data and lawful exceptions across AI datasets and logs. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported data-subject rights handling issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Create a rights-response workflow that identifies relevant personal data and lawful exceptions across AI datasets and logs. The offered observation does not establish whether that targeted control succeeded.

This result would support automated decisions and contestability, a distinct governance need illustrated by: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. For the reported data-subject rights handling issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Create a rights-response workflow that identifies relevant personal data and lawful exceptions across AI datasets and logs. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the representative sampling deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Group-level evaluations include underrepresented speaker categories and documented gaps.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the representative sampling deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Group-level evaluations include underrepresented speaker categories and documented gaps.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the representative sampling deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Group-level evaluations include underrepresented speaker categories and documented gaps.

This result would support privacy-preserving data treatment, a distinct governance need illustrated by: A team keeps full identifiable transcripts in an experimental dataset despite the ability to meet its goal with less personal detail. For the reported representative sampling issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess target-population representation and improve sampling or mitigation before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported representative sampling issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess target-population representation and improve sampling or mitigation before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support data-use rights, a distinct governance need illustrated by: A developer acquires a large web corpus without assessing whether its license permits model training. For the reported representative sampling issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assess target-population representation and improve sampling or mitigation before deployment. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor training-data terms, for which an example concern is: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. It could be useful in that different situation, but it would not directly address the portability and exit deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An exit test demonstrates usable export and feasible service replacement or safe suspension.

This response relates instead to subprocessor oversight, for which an example concern is: A vendor may route prompts through undisclosed subcontractors, but the buyer's review covers only the contracting company. It could be useful in that different situation, but it would not directly address the portability and exit deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An exit test demonstrates usable export and feasible service replacement or safe suspension.

This response relates instead to vendor audit rights, for which an example concern is: A provider refuses to furnish material security or risk-assessment evidence while the deployment poses serious compliance exposure. It could be useful in that different situation, but it would not directly address the portability and exit deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: An exit test demonstrates usable export and feasible service replacement or safe suspension.

This result would support proprietary model self-deployment, a distinct governance need illustrated by: A company builds and deploys its own AI product but assumes self-hosting eliminates provider-side documentation and safety duties. For the reported portability and exit issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess lock-in, transition arrangements, data export, and operational alternatives before contract approval. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported portability and exit issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess lock-in, transition arrangements, data export, and operational alternatives before contract approval. The offered observation does not establish whether that targeted control succeeded.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported portability and exit issue at a large multibranch organization in Oslo, the relevant corrective action is: Assess lock-in, transition arrangements, data export, and operational alternatives before contract approval. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the third-party procurement due diligence deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A documented vendor assessment addresses processing terms, model risks, safeguards, and exit arrangements.

This response relates instead to privacy/security policy integration, for which an example concern is: A security team treats model prompts as outside existing access-control and data-retention policies. It could be useful in that different situation, but it would not directly address the third-party procurement due diligence deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A documented vendor assessment addresses processing terms, model risks, safeguards, and exit arrangements.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the third-party procurement due diligence deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A documented vendor assessment addresses processing terms, model risks, safeguards, and exit arrangements.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported third-party procurement due diligence issue at a large multibranch organization in Oslo, the relevant corrective action is: Add AI-specific due diligence, security, privacy, and model limitation questions to supplier qualification. The offered observation does not establish whether that targeted control succeeded.

This result would support contract change monitoring, a distinct governance need illustrated by: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. For the reported third-party procurement due diligence issue at a large multibranch organization in Oslo, the relevant corrective action is: Add AI-specific due diligence, security, privacy, and model limitation questions to supplier qualification. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported third-party procurement due diligence issue at a large multibranch organization in Oslo, the relevant corrective action is: Add AI-specific due diligence, security, privacy, and model limitation questions to supplier qualification. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the sensitive biometric data deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The assessment documents the data classification, applicable legal condition, and security measures.

This response relates instead to automated decisions and contestability, for which an example concern is: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. It could be useful in that different situation, but it would not directly address the sensitive biometric data deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The assessment documents the data classification, applicable legal condition, and security measures.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the sensitive biometric data deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The assessment documents the data classification, applicable legal condition, and security measures.

This result would support purpose limitation, a distinct governance need illustrated by: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. For the reported sensitive biometric data issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported sensitive biometric data issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported sensitive biometric data issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.