Exam Bundle

This result would support maintenance after drift, a distinct governance need illustrated by: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. For the reported production fairness monitoring issue at a recruitment services group in Dublin, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported production fairness monitoring issue at a recruitment services group in Dublin, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.

This result would support near-miss reporting, a distinct governance need illustrated by: Users report several close calls where an AI system nearly caused harm, but incidents are recorded only when actual loss occurs. For the reported production fairness monitoring issue at a recruitment services group in Dublin, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the input data drift deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Drift alarms trigger analysis of changed populations and model suitability.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the input data drift deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Drift alarms trigger analysis of changed populations and model suitability.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the input data drift deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Drift alarms trigger analysis of changed populations and model suitability.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported input data drift issue at a professional services group in London, the relevant corrective action is: Monitor production input distributions and investigate meaningful shifts relative to approved baselines. The offered observation does not establish whether that targeted control succeeded.

This result would support external transparency materials, a distinct governance need illustrated by: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. For the reported input data drift issue at a professional services group in London, the relevant corrective action is: Monitor production input distributions and investigate meaningful shifts relative to approved baselines. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported input data drift issue at a professional services group in London, the relevant corrective action is: Monitor production input distributions and investigate meaningful shifts relative to approved baselines. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the nist measure function deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Test results and monitoring measures provide evidence of risk magnitude and uncertainty.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the nist measure function deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Test results and monitoring measures provide evidence of risk magnitude and uncertainty.

This response relates instead to nist map function, for which an example concern is: A team collects model metrics without first establishing whom the system affects or what its deployment context is. It could be useful in that different situation, but it would not directly address the nist measure function deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Test results and monitoring measures provide evidence of risk magnitude and uncertainty.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported nist measure function issue at a software services vendor in Lisbon, the relevant corrective action is: Use the NIST AI RMF Measure function to assess, analyze, and track relevant identified risks. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported nist measure function issue at a software services vendor in Lisbon, the relevant corrective action is: Use the NIST AI RMF Measure function to assess, analyze, and track relevant identified risks. The offered observation does not establish whether that targeted control succeeded.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported nist measure function issue at a software services vendor in Lisbon, the relevant corrective action is: Use the NIST AI RMF Measure function to assess, analyze, and track relevant identified risks. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the ai end-user training deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Scenario assessments show users can spot questionable outputs and invoke review routes.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the ai end-user training deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Scenario assessments show users can spot questionable outputs and invoke review routes.

This response relates instead to deployment operating procedure, for which an example concern is: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. It could be useful in that different situation, but it would not directly address the ai end-user training deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Scenario assessments show users can spot questionable outputs and invoke review routes.

This result would support incident containment, a distinct governance need illustrated by: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. For the reported ai end-user training issue at a regional service provider in Singapore, the relevant corrective action is: Train users to recognize uncertainty, report incidents, and apply appropriate independent judgment. The offered observation does not establish whether that targeted control succeeded.

This result would support safety and reliability monitoring, a distinct governance need illustrated by: An AI-powered workflow is monitored only for uptime while harmful errors can occur even when the service is available. For the reported ai end-user training issue at a regional service provider in Singapore, the relevant corrective action is: Train users to recognize uncertainty, report incidents, and apply appropriate independent judgment. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported ai end-user training issue at a regional service provider in Singapore, the relevant corrective action is: Train users to recognize uncertainty, report incidents, and apply appropriate independent judgment. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to model selection trade-offs, for which an example concern is: A team chooses a very large generative model for a small deterministic lookup without comparing alternatives. It could be useful in that different situation, but it would not directly address the affected-party design feedback deficiency reported at a housing services organization in Manchester. The targeted acceptance criterion here is: Design reviews show stakeholder concerns influencing safeguards and testing plans.

This response relates instead to impact assessment in design, for which an example concern is: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. It could be useful in that different situation, but it would not directly address the affected-party design feedback deficiency reported at a housing services organization in Manchester. The targeted acceptance criterion here is: Design reviews show stakeholder concerns influencing safeguards and testing plans.

This response relates instead to purpose and success definition, for which an example concern is: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. It could be useful in that different situation, but it would not directly address the affected-party design feedback deficiency reported at a housing services organization in Manchester. The targeted acceptance criterion here is: Design reviews show stakeholder concerns influencing safeguards and testing plans.

This result would support human oversight by design, a distinct governance need illustrated by: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. For the reported affected-party design feedback issue at a housing services organization in Manchester, the relevant corrective action is: Collect structured input from affected stakeholders and translate material findings into model requirements. The offered observation does not establish whether that targeted control succeeded.

This result would support pilot containment, a distinct governance need illustrated by: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. For the reported affected-party design feedback issue at a housing services organization in Manchester, the relevant corrective action is: Collect structured input from affected stakeholders and translate material findings into model requirements. The offered observation does not establish whether that targeted control succeeded.

This result would support purpose and success definition, a distinct governance need illustrated by: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. For the reported affected-party design feedback issue at a housing services organization in Manchester, the relevant corrective action is: Collect structured input from affected stakeholders and translate material findings into model requirements. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the ai incident response deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Tabletop exercises demonstrate that model access can be limited and incidents escalated promptly.

This response relates instead to documentation and traceability, for which an example concern is: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. It could be useful in that different situation, but it would not directly address the ai incident response deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Tabletop exercises demonstrate that model access can be limited and incidents escalated promptly.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the ai incident response deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Tabletop exercises demonstrate that model access can be limited and incidents escalated promptly.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported ai incident response issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.

This result would support contract change monitoring, a distinct governance need illustrated by: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. For the reported ai incident response issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported ai incident response issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.