Exam Bundle

This result would support data minimization, a distinct governance need illustrated by: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. For the reported transparent privacy notice issue at a regional technology consortium in Auckland, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.

This result would support automated decisions and contestability, a distinct governance need illustrated by: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. For the reported transparent privacy notice issue at a regional technology consortium in Auckland, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported transparent privacy notice issue at a regional technology consortium in Auckland, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor audit rights, for which an example concern is: A provider refuses to furnish material security or risk-assessment evidence while the deployment poses serious compliance exposure. It could be useful in that different situation, but it would not directly address the proprietary model self-deployment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The governance responsibility register includes model creation and deployment responsibilities.

This response relates instead to subprocessor oversight, for which an example concern is: A vendor may route prompts through undisclosed subcontractors, but the buyer's review covers only the contracting company. It could be useful in that different situation, but it would not directly address the proprietary model self-deployment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The governance responsibility register includes model creation and deployment responsibilities.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the proprietary model self-deployment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The governance responsibility register includes model creation and deployment responsibilities.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported proprietary model self-deployment issue at an international services company in Helsinki, the relevant corrective action is: Evaluate the additional design, training, quality, and release obligations arising from its own provider role. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported proprietary model self-deployment issue at an international services company in Helsinki, the relevant corrective action is: Evaluate the additional design, training, quality, and release obligations arising from its own provider role. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported proprietary model self-deployment issue at an international services company in Helsinki, the relevant corrective action is: Evaluate the additional design, training, quality, and release obligations arising from its own provider role. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the model selection trade-offs deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: An alternatives assessment explains why the chosen method meets the actual use-case constraints.

This response relates instead to impact assessment in design, for which an example concern is: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. It could be useful in that different situation, but it would not directly address the model selection trade-offs deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: An alternatives assessment explains why the chosen method meets the actual use-case constraints.

This response relates instead to evaluation-threshold setting, for which an example concern is: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. It could be useful in that different situation, but it would not directly address the model selection trade-offs deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: An alternatives assessment explains why the chosen method meets the actual use-case constraints.

This result would support architecture security review, a distinct governance need illustrated by: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. For the reported model selection trade-offs issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate model types against the task, risk, cost, latency, accuracy, and explainability requirements. The offered observation does not establish whether that targeted control succeeded.

This result would support benchmark relevance, a distinct governance need illustrated by: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. For the reported model selection trade-offs issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate model types against the task, risk, cost, latency, accuracy, and explainability requirements. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported model selection trade-offs issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate model types against the task, risk, cost, latency, accuracy, and explainability requirements. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the purpose limitation deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: A documented reuse review prevents incompatible processing unless the legal conditions are met.

This response relates instead to data minimization, for which an example concern is: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. It could be useful in that different situation, but it would not directly address the purpose limitation deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: A documented reuse review prevents incompatible processing unless the legal conditions are met.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the purpose limitation deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: A documented reuse review prevents incompatible processing unless the legal conditions are met.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported purpose limitation issue at a recruitment services group in Dublin, the relevant corrective action is: Evaluate purpose compatibility and obtain any required new legal basis or authorization before repurposing data. The offered observation does not establish whether that targeted control succeeded.

This result would support sensitive biometric data, a distinct governance need illustrated by: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. For the reported purpose limitation issue at a recruitment services group in Dublin, the relevant corrective action is: Evaluate purpose compatibility and obtain any required new legal basis or authorization before repurposing data. The offered observation does not establish whether that targeted control succeeded.

This result would support third-party processor controls, a distinct governance need illustrated by: A business sends customer records to a hosted model provider without instructions on permitted processing or breach handling. For the reported purpose limitation issue at a recruitment services group in Dublin, the relevant corrective action is: Evaluate purpose compatibility and obtain any required new legal basis or authorization before repurposing data. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to safety versus raw accuracy, for which an example concern is: An industrial anomaly detector improves average accuracy but produces rare unsafe false negatives in a safety-critical process. It could be useful in that different situation, but it would not directly address the generative versus predictive scope deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The evaluation protocol checks drafted content and failure modes rather than only numeric prediction error.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the generative versus predictive scope deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The evaluation protocol checks drafted content and failure modes rather than only numeric prediction error.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the generative versus predictive scope deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The evaluation protocol checks drafted content and failure modes rather than only numeric prediction error.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported generative versus predictive scope issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Classify the task as generative and choose task-appropriate evaluation of factuality, safety, and usefulness. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported generative versus predictive scope issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Classify the task as generative and choose task-appropriate evaluation of factuality, safety, and usefulness. The offered observation does not establish whether that targeted control succeeded.

This result would support supervised learning limits, a distinct governance need illustrated by: A project promises highly reliable supervised predictions but has only unlabeled historical records and no ground-truth outcomes. For the reported generative versus predictive scope issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Classify the task as generative and choose task-appropriate evaluation of factuality, safety, and usefulness. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the external incident communications deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Communication exercises demonstrate timely, accurate, coordinated notices where required.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the external incident communications deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Communication exercises demonstrate timely, accurate, coordinated notices where required.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the external incident communications deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Communication exercises demonstrate timely, accurate, coordinated notices where required.

This result would support deployment operating procedure, a distinct governance need illustrated by: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. For the reported external incident communications issue at a regional service provider in Singapore, the relevant corrective action is: Prepare consistent stakeholder and regulator communication plans with accountable spokespeople. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported external incident communications issue at a regional service provider in Singapore, the relevant corrective action is: Prepare consistent stakeholder and regulator communication plans with accountable spokespeople. The offered observation does not establish whether that targeted control succeeded.

This result would support maintenance after drift, a distinct governance need illustrated by: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. For the reported external incident communications issue at a regional service provider in Singapore, the relevant corrective action is: Prepare consistent stakeholder and regulator communication plans with accountable spokespeople. The offered observation does not establish whether that targeted control succeeded.