Exam Bundle

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported ai incident response issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.

This result would support contract change monitoring, a distinct governance need illustrated by: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. For the reported ai incident response issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported ai incident response issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the technical documentation duty deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The compliance file supports review of intended purpose, design, tests, limitations, and applicable controls.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the technical documentation duty deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The compliance file supports review of intended purpose, design, tests, limitations, and applicable controls.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the technical documentation duty deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The compliance file supports review of intended purpose, design, tests, limitations, and applicable controls.

This result would support human oversight requirements, a distinct governance need illustrated by: A regulated high-risk model advises caseworkers, but they lack training or the practical authority to reject erroneous outputs. For the reported technical documentation duty issue at an international services company in Helsinki, the relevant corrective action is: Prepare required technical documentation and maintain it through relevant system changes. The offered observation does not establish whether that targeted control succeeded.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported technical documentation duty issue at an international services company in Helsinki, the relevant corrective action is: Prepare required technical documentation and maintain it through relevant system changes. The offered observation does not establish whether that targeted control succeeded.

This result would support high-risk management system, a distinct governance need illustrated by: A provider of a potentially high-risk AI system cannot show a documented ongoing process for evaluating foreseeable risks. For the reported technical documentation duty issue at an international services company in Helsinki, the relevant corrective action is: Prepare required technical documentation and maintain it through relevant system changes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to safe rollback operations, for which an example concern is: A new model release creates unacceptable errors, but operations lack a tested method to restore the previous safe version. It could be useful in that different situation, but it would not directly address the retraining governance deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Every replacement version passes predetermined tests and retains a recoverable predecessor.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the retraining governance deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Every replacement version passes predetermined tests and retains a recoverable predecessor.

This response relates instead to threat-model maintenance, for which an example concern is: An agent's tool access expands beyond its original design, but the security threat model is still based on a text-only chatbot. It could be useful in that different situation, but it would not directly address the retraining governance deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Every replacement version passes predetermined tests and retains a recoverable predecessor.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported retraining governance issue at a large multibranch organization in Oslo, the relevant corrective action is: Apply controlled retraining, validation, approval, and rollback procedures to updated models. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported retraining governance issue at a large multibranch organization in Oslo, the relevant corrective action is: Apply controlled retraining, validation, approval, and rollback procedures to updated models. The offered observation does not establish whether that targeted control succeeded.

This result would support external transparency materials, a distinct governance need illustrated by: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. For the reported retraining governance issue at a large multibranch organization in Oslo, the relevant corrective action is: Apply controlled retraining, validation, approval, and rollback procedures to updated models. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the near-miss reporting deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The incident program records near misses and changes safeguards before repeat harm.

This response relates instead to safety and reliability monitoring, for which an example concern is: An AI-powered workflow is monitored only for uptime while harmful errors can occur even when the service is available. It could be useful in that different situation, but it would not directly address the near-miss reporting deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The incident program records near misses and changes safeguards before repeat harm.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the near-miss reporting deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The incident program records near misses and changes safeguards before repeat harm.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported near-miss reporting issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Capture and analyze AI near misses as leading indicators for prevention. The offered observation does not establish whether that targeted control succeeded.

This result would support production fairness monitoring, a distinct governance need illustrated by: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. For the reported near-miss reporting issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Capture and analyze AI near misses as leading indicators for prevention. The offered observation does not establish whether that targeted control succeeded.

This result would support safety and reliability monitoring, a distinct governance need illustrated by: An AI-powered workflow is monitored only for uptime while harmful errors can occur even when the service is available. For the reported near-miss reporting issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Capture and analyze AI near misses as leading indicators for prevention. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the ai incident response deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Tabletop exercises demonstrate that model access can be limited and incidents escalated promptly.

This response relates instead to documentation and traceability, for which an example concern is: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. It could be useful in that different situation, but it would not directly address the ai incident response deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Tabletop exercises demonstrate that model access can be limited and incidents escalated promptly.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the ai incident response deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Tabletop exercises demonstrate that model access can be limited and incidents escalated promptly.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported ai incident response issue at an international services company in Helsinki, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported ai incident response issue at an international services company in Helsinki, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.

This result would support contract change monitoring, a distinct governance need illustrated by: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. For the reported ai incident response issue at an international services company in Helsinki, the relevant corrective action is: Integrate AI failure and misuse scenarios into incident detection, containment, notification, and recovery plans. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to purpose limitation, for which an example concern is: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. It could be useful in that different situation, but it would not directly address the transparent privacy notice deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The notice identifies categories, purposes, recipients, and applicable rights for affected individuals.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the transparent privacy notice deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The notice identifies categories, purposes, recipients, and applicable rights for affected individuals.

This response relates instead to data minimization, for which an example concern is: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. It could be useful in that different situation, but it would not directly address the transparent privacy notice deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The notice identifies categories, purposes, recipients, and applicable rights for affected individuals.

This result would support data minimization, a distinct governance need illustrated by: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. For the reported transparent privacy notice issue at a regional technology consortium in Auckland, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.

This result would support automated decisions and contestability, a distinct governance need illustrated by: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. For the reported transparent privacy notice issue at a regional technology consortium in Auckland, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported transparent privacy notice issue at a regional technology consortium in Auckland, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.