Exam Bundle

This result would support purpose limitation, a distinct governance need illustrated by: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. For the reported sensitive biometric data issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported sensitive biometric data issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported sensitive biometric data issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the maintenance after drift deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Monitoring thresholds cause timely retraining review or deactivation with documented decisions.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the maintenance after drift deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Monitoring thresholds cause timely retraining review or deactivation with documented decisions.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the maintenance after drift deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Monitoring thresholds cause timely retraining review or deactivation with documented decisions.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported maintenance after drift issue at a regional technology consortium in Auckland, the relevant corrective action is: Connect performance-drift triggers to controlled reassessment, updating, or suspension. The offered observation does not establish whether that targeted control succeeded.

This result would support production fairness monitoring, a distinct governance need illustrated by: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. For the reported maintenance after drift issue at a regional technology consortium in Auckland, the relevant corrective action is: Connect performance-drift triggers to controlled reassessment, updating, or suspension. The offered observation does not establish whether that targeted control succeeded.

This result would support monitoring ownership, a distinct governance need illustrated by: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. For the reported maintenance after drift issue at a regional technology consortium in Auckland, the relevant corrective action is: Connect performance-drift triggers to controlled reassessment, updating, or suspension. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the post-release audit cadence deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Audit logs show scheduled assessments, findings, owners, and remediation verification.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the post-release audit cadence deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Audit logs show scheduled assessments, findings, owners, and remediation verification.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the post-release audit cadence deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Audit logs show scheduled assessments, findings, owners, and remediation verification.

This result would support feedback-to-maintenance loop, a distinct governance need illustrated by: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. For the reported post-release audit cadence issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Establish periodic AI audit and control-testing cadence proportional to use-case risk. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported post-release audit cadence issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Establish periodic AI audit and control-testing cadence proportional to use-case risk. The offered observation does not establish whether that targeted control succeeded.

This result would support release-readiness evidence, a distinct governance need illustrated by: A new model is promoted into production while safety-test failures and unresolved critical issues remain undocumented. For the reported post-release audit cadence issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Establish periodic AI audit and control-testing cadence proportional to use-case risk. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to insurance underwriting fairness, for which an example concern is: An insurer approves a pricing model without considering whether sensitive proxies violate applicable insurance discrimination rules. It could be useful in that different situation, but it would not directly address the credit fairness deficiency reported at a financial services provider in London. The targeted acceptance criterion here is: The compliance review documents legally relevant group outcomes and required remediation.

This response relates instead to employment discrimination, for which an example concern is: A hiring model ranks applicants by a proxy feature that creates unjustified unequal outcomes for protected groups. It could be useful in that different situation, but it would not directly address the credit fairness deficiency reported at a financial services provider in London. The targeted acceptance criterion here is: The compliance review documents legally relevant group outcomes and required remediation.

This response relates instead to legal regime inventory, for which an example concern is: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. It could be useful in that different situation, but it would not directly address the credit fairness deficiency reported at a financial services provider in London. The targeted acceptance criterion here is: The compliance review documents legally relevant group outcomes and required remediation.

This result would support product safety liability, a distinct governance need illustrated by: A manufacturer integrates AI into a safety device but evaluates only the vendor's standalone model accuracy. For the reported credit fairness issue at a financial services provider in London, the relevant corrective action is: Evaluate applicable lending discrimination obligations and disparate effects in the intended decision process. The offered observation does not establish whether that targeted control succeeded.

This result would support legal regime inventory, a distinct governance need illustrated by: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. For the reported credit fairness issue at a financial services provider in London, the relevant corrective action is: Evaluate applicable lending discrimination obligations and disparate effects in the intended decision process. The offered observation does not establish whether that targeted control succeeded.

This result would support housing access equality, a distinct governance need illustrated by: A property service uses a ranking algorithm that could disadvantage protected applicants and claims general AI policies are enough. For the reported credit fairness issue at a financial services provider in London, the relevant corrective action is: Evaluate applicable lending discrimination obligations and disparate effects in the intended decision process. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the training versus inference deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: The inventory identifies retraining events separately from routine requests and responses.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the training versus inference deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: The inventory identifies retraining events separately from routine requests and responses.

This response relates instead to data dependency and drift, for which an example concern is: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. It could be useful in that different situation, but it would not directly address the training versus inference deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: The inventory identifies retraining events separately from routine requests and responses.

This result would support data dependency and drift, a distinct governance need illustrated by: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. For the reported training versus inference issue at a recruitment services group in Dublin, the relevant corrective action is: Distinguish model training and parameter updates from inference-time generation in the governance inventory. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported training versus inference issue at a recruitment services group in Dublin, the relevant corrective action is: Distinguish model training and parameter updates from inference-time generation in the governance inventory. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported training versus inference issue at a recruitment services group in Dublin, the relevant corrective action is: Distinguish model training and parameter updates from inference-time generation in the governance inventory. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to maintenance after drift, for which an example concern is: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. It could be useful in that different situation, but it would not directly address the production fairness monitoring deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Monitoring records flag material fairness drift and document corrective action.

This response relates instead to monitoring ownership, for which an example concern is: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. It could be useful in that different situation, but it would not directly address the production fairness monitoring deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Monitoring records flag material fairness drift and document corrective action.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the production fairness monitoring deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Monitoring records flag material fairness drift and document corrective action.

This result would support maintenance after drift, a distinct governance need illustrated by: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. For the reported production fairness monitoring issue at a recruitment services group in Dublin, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported production fairness monitoring issue at a recruitment services group in Dublin, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.

This result would support near-miss reporting, a distinct governance need illustrated by: Users report several close calls where an AI system nearly caused harm, but incidents are recorded only when actual loss occurs. For the reported production fairness monitoring issue at a recruitment services group in Dublin, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.