Exam Bundle

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported algorithmic unfairness issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.

This result would support supervised learning limits, a distinct governance need illustrated by: A project promises highly reliable supervised predictions but has only unlabeled historical records and no ground-truth outcomes. For the reported algorithmic unfairness issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.

This result would support generative versus predictive scope, a distinct governance need illustrated by: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. For the reported algorithmic unfairness issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the nist measure function deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Test results and monitoring measures provide evidence of risk magnitude and uncertainty.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the nist measure function deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Test results and monitoring measures provide evidence of risk magnitude and uncertainty.

This response relates instead to nist map function, for which an example concern is: A team collects model metrics without first establishing whom the system affects or what its deployment context is. It could be useful in that different situation, but it would not directly address the nist measure function deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Test results and monitoring measures provide evidence of risk magnitude and uncertainty.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported nist measure function issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Use the NIST AI RMF Measure function to assess, analyze, and track relevant identified risks. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported nist measure function issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Use the NIST AI RMF Measure function to assess, analyze, and track relevant identified risks. The offered observation does not establish whether that targeted control succeeded.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported nist measure function issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Use the NIST AI RMF Measure function to assess, analyze, and track relevant identified risks. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to purpose and success definition, for which an example concern is: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. It could be useful in that different situation, but it would not directly address the affected-party design feedback deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: Design reviews show stakeholder concerns influencing safeguards and testing plans.

This response relates instead to impact assessment in design, for which an example concern is: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. It could be useful in that different situation, but it would not directly address the affected-party design feedback deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: Design reviews show stakeholder concerns influencing safeguards and testing plans.

This response relates instead to model selection trade-offs, for which an example concern is: A team chooses a very large generative model for a small deterministic lookup without comparing alternatives. It could be useful in that different situation, but it would not directly address the affected-party design feedback deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: Design reviews show stakeholder concerns influencing safeguards and testing plans.

This result would support human oversight by design, a distinct governance need illustrated by: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. For the reported affected-party design feedback issue at a property services provider in Boston, the relevant corrective action is: Collect structured input from affected stakeholders and translate material findings into model requirements. The offered observation does not establish whether that targeted control succeeded.

This result would support purpose and success definition, a distinct governance need illustrated by: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. For the reported affected-party design feedback issue at a property services provider in Boston, the relevant corrective action is: Collect structured input from affected stakeholders and translate material findings into model requirements. The offered observation does not establish whether that targeted control succeeded.

This result would support pilot containment, a distinct governance need illustrated by: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. For the reported affected-party design feedback issue at a property services provider in Boston, the relevant corrective action is: Collect structured input from affected stakeholders and translate material findings into model requirements. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to maintenance after drift, for which an example concern is: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. It could be useful in that different situation, but it would not directly address the production fairness monitoring deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Monitoring records flag material fairness drift and document corrective action.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the production fairness monitoring deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Monitoring records flag material fairness drift and document corrective action.

This response relates instead to monitoring ownership, for which an example concern is: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. It could be useful in that different situation, but it would not directly address the production fairness monitoring deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Monitoring records flag material fairness drift and document corrective action.

This result would support maintenance after drift, a distinct governance need illustrated by: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. For the reported production fairness monitoring issue at a corporate HR program in Amsterdam, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.

This result would support near-miss reporting, a distinct governance need illustrated by: Users report several close calls where an AI system nearly caused harm, but incidents are recorded only when actual loss occurs. For the reported production fairness monitoring issue at a corporate HR program in Amsterdam, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported production fairness monitoring issue at a corporate HR program in Amsterdam, the relevant corrective action is: Track applicable group-level performance and disparity measures over time with escalation thresholds. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to lifecycle gate policy, for which an example concern is: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. It could be useful in that different situation, but it would not directly address the privacy/security policy integration deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Policy review traces AI-specific data flows to controls, owners, and retention limits.

This response relates instead to documentation and traceability, for which an example concern is: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. It could be useful in that different situation, but it would not directly address the privacy/security policy integration deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Policy review traces AI-specific data flows to controls, owners, and retention limits.

This response relates instead to third-party procurement due diligence, for which an example concern is: Procurement buys a model API based only on its benchmark score without reviewing data reuse or subcontractor risks. It could be useful in that different situation, but it would not directly address the privacy/security policy integration deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Policy review traces AI-specific data flows to controls, owners, and retention limits.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported privacy/security policy integration issue at a technology services group in Stockholm, the relevant corrective action is: Extend existing privacy, security, and data-governance controls to AI inputs, logs, outputs, and service integrations. The offered observation does not establish whether that targeted control succeeded.

This result would support retirement and disposal, a distinct governance need illustrated by: A discontinued predictive service remains callable with old credentials and retained training data after business shutdown. For the reported privacy/security policy integration issue at a technology services group in Stockholm, the relevant corrective action is: Extend existing privacy, security, and data-governance controls to AI inputs, logs, outputs, and service integrations. The offered observation does not establish whether that targeted control succeeded.

This result would support documentation and traceability, a distinct governance need illustrated by: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. For the reported privacy/security policy integration issue at a technology services group in Stockholm, the relevant corrective action is: Extend existing privacy, security, and data-governance controls to AI inputs, logs, outputs, and service integrations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the sensitive biometric data deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The assessment documents the data classification, applicable legal condition, and security measures.

This response relates instead to automated decisions and contestability, for which an example concern is: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. It could be useful in that different situation, but it would not directly address the sensitive biometric data deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The assessment documents the data classification, applicable legal condition, and security measures.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the sensitive biometric data deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The assessment documents the data classification, applicable legal condition, and security measures.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported sensitive biometric data issue at a regional service provider in Singapore, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This result would support purpose limitation, a distinct governance need illustrated by: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. For the reported sensitive biometric data issue at a regional service provider in Singapore, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported sensitive biometric data issue at a regional service provider in Singapore, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.