Exam Bundle

This result would support deployment operating procedure, a distinct governance need illustrated by: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. For the reported external incident communications issue at a regional service provider in Singapore, the relevant corrective action is: Prepare consistent stakeholder and regulator communication plans with accountable spokespeople. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported external incident communications issue at a regional service provider in Singapore, the relevant corrective action is: Prepare consistent stakeholder and regulator communication plans with accountable spokespeople. The offered observation does not establish whether that targeted control succeeded.

This result would support maintenance after drift, a distinct governance need illustrated by: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. For the reported external incident communications issue at a regional service provider in Singapore, the relevant corrective action is: Prepare consistent stakeholder and regulator communication plans with accountable spokespeople. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the root-cause collaboration deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The investigation links observed harm to evidenced failure contributors and corrective actions.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the root-cause collaboration deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The investigation links observed harm to evidenced failure contributors and corrective actions.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the root-cause collaboration deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The investigation links observed harm to evidenced failure contributors and corrective actions.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported root-cause collaboration issue at an international services company in Helsinki, the relevant corrective action is: Conduct multidisciplinary root-cause review across data, model, interface, and human process. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported root-cause collaboration issue at an international services company in Helsinki, the relevant corrective action is: Conduct multidisciplinary root-cause review across data, model, interface, and human process. The offered observation does not establish whether that targeted control succeeded.

This result would support incident classification, a distinct governance need illustrated by: An AI response causes an unsafe operational action, but support treats it as a cosmetic content-quality bug. For the reported root-cause collaboration issue at an international services company in Helsinki, the relevant corrective action is: Conduct multidisciplinary root-cause review across data, model, interface, and human process. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to data minimization, for which an example concern is: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. It could be useful in that different situation, but it would not directly address the third-party processor controls deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The executed agreement and oversight plan cover processing instructions, assistance, and incident notification.

This response relates instead to automated decisions and contestability, for which an example concern is: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. It could be useful in that different situation, but it would not directly address the third-party processor controls deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The executed agreement and oversight plan cover processing instructions, assistance, and incident notification.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the third-party processor controls deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The executed agreement and oversight plan cover processing instructions, assistance, and incident notification.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported third-party processor controls issue at a software services vendor in Lisbon, the relevant corrective action is: Establish suitable processor terms, instructions, security measures, and monitoring where a processor relationship exists. The offered observation does not establish whether that targeted control succeeded.

This result would support purpose limitation, a distinct governance need illustrated by: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. For the reported third-party processor controls issue at a software services vendor in Lisbon, the relevant corrective action is: Establish suitable processor terms, instructions, security measures, and monitoring where a processor relationship exists. The offered observation does not establish whether that targeted control succeeded.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported third-party processor controls issue at a software services vendor in Lisbon, the relevant corrective action is: Establish suitable processor terms, instructions, security measures, and monitoring where a processor relationship exists. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the secondary use prevention deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Access controls and approval records block unreviewed repurposing of the model.

This response relates instead to deployment operating procedure, for which an example concern is: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. It could be useful in that different situation, but it would not directly address the secondary use prevention deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Access controls and approval records block unreviewed repurposing of the model.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the secondary use prevention deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Access controls and approval records block unreviewed repurposing of the model.

This result would support threat modeling new data flow, a distinct governance need illustrated by: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. For the reported secondary use prevention issue at a corporate HR program in Amsterdam, the relevant corrective action is: Reassess materially changed or secondary uses and restrict functions until governance approval. The offered observation does not establish whether that targeted control succeeded.

This result would support regular control audit, a distinct governance need illustrated by: A deployed AI system has unchanged governance paperwork despite major operational changes and no control re-testing. For the reported secondary use prevention issue at a corporate HR program in Amsterdam, the relevant corrective action is: Reassess materially changed or secondary uses and restrict functions until governance approval. The offered observation does not establish whether that targeted control succeeded.

This result would support production fairness monitoring, a distinct governance need illustrated by: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. For the reported secondary use prevention issue at a corporate HR program in Amsterdam, the relevant corrective action is: Reassess materially changed or secondary uses and restrict functions until governance approval. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to impact assessment in design, for which an example concern is: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. It could be useful in that different situation, but it would not directly address the evaluation-threshold setting deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Acceptance tests compare held-out outcomes with documented approval criteria.

This response relates instead to model selection trade-offs, for which an example concern is: A team chooses a very large generative model for a small deterministic lookup without comparing alternatives. It could be useful in that different situation, but it would not directly address the evaluation-threshold setting deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Acceptance tests compare held-out outcomes with documented approval criteria.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the evaluation-threshold setting deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Acceptance tests compare held-out outcomes with documented approval criteria.

This result would support design decision trace, a distinct governance need illustrated by: The model team cannot explain why a sensitive input feature was retained after a privacy objection. For the reported evaluation-threshold setting issue at a regional service provider in Singapore, the relevant corrective action is: Define measurable predeployment thresholds for accuracy, fairness, robustness, and safety appropriate to impact. The offered observation does not establish whether that targeted control succeeded.

This result would support human oversight by design, a distinct governance need illustrated by: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. For the reported evaluation-threshold setting issue at a regional service provider in Singapore, the relevant corrective action is: Define measurable predeployment thresholds for accuracy, fairness, robustness, and safety appropriate to impact. The offered observation does not establish whether that targeted control succeeded.

This result would support pilot containment, a distinct governance need illustrated by: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. For the reported evaluation-threshold setting issue at a regional service provider in Singapore, the relevant corrective action is: Define measurable predeployment thresholds for accuracy, fairness, robustness, and safety appropriate to impact. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to board-level oversight, for which an example concern is: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. It could be useful in that different situation, but it would not directly address the enterprise inventory ownership deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The inventory links deployed systems to owners, purpose, data categories, and review status.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the enterprise inventory ownership deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The inventory links deployed systems to owners, purpose, data categories, and review status.

This response relates instead to cross-functional review, for which an example concern is: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. It could be useful in that different situation, but it would not directly address the enterprise inventory ownership deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The inventory links deployed systems to owners, purpose, data categories, and review status.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported enterprise inventory ownership issue at a regional service provider in Singapore, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This result would support proportional control design, a distinct governance need illustrated by: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. For the reported enterprise inventory ownership issue at a regional service provider in Singapore, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported enterprise inventory ownership issue at a regional service provider in Singapore, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.