Exam Bundle

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported enterprise inventory ownership issue at a regional service provider in Singapore, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This result would support proportional control design, a distinct governance need illustrated by: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. For the reported enterprise inventory ownership issue at a regional service provider in Singapore, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported enterprise inventory ownership issue at a regional service provider in Singapore, the relevant corrective action is: Create an AI system and use-case inventory with accountable business owners, suppliers, and risk tiers. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to consumer deception, for which an example concern is: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. It could be useful in that different situation, but it would not directly address the employment discrimination deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Independent outcome review assesses relevant disparities and corrects affected hiring decisions.

This response relates instead to credit fairness, for which an example concern is: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. It could be useful in that different situation, but it would not directly address the employment discrimination deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Independent outcome review assesses relevant disparities and corrects affected hiring decisions.

This response relates instead to confidential business material, for which an example concern is: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. It could be useful in that different situation, but it would not directly address the employment discrimination deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Independent outcome review assesses relevant disparities and corrects affected hiring decisions.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported employment discrimination issue at a recruitment services group in Dublin, the relevant corrective action is: Test and mitigate unlawful discriminatory effects within the applicable employment-law context. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported employment discrimination issue at a recruitment services group in Dublin, the relevant corrective action is: Test and mitigate unlawful discriminatory effects within the applicable employment-law context. The offered observation does not establish whether that targeted control succeeded.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported employment discrimination issue at a recruitment services group in Dublin, the relevant corrective action is: Test and mitigate unlawful discriminatory effects within the applicable employment-law context. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the feedback-to-maintenance loop deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Tracked issues lead to model or process improvements and subsequent verification.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the feedback-to-maintenance loop deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Tracked issues lead to model or process improvements and subsequent verification.

This response relates instead to incident classification, for which an example concern is: An AI response causes an unsafe operational action, but support treats it as a cosmetic content-quality bug. It could be useful in that different situation, but it would not directly address the feedback-to-maintenance loop deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Tracked issues lead to model or process improvements and subsequent verification.

This result would support release-readiness evidence, a distinct governance need illustrated by: A new model is promoted into production while safety-test failures and unresolved critical issues remain undocumented. For the reported feedback-to-maintenance loop issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Connect user feedback, complaints, and operational incidents to prioritized maintenance actions. The offered observation does not establish whether that targeted control succeeded.

This result would support post-release audit cadence, a distinct governance need illustrated by: A regulated AI service was approved once and has no periodic review of logs, access, or control effectiveness. For the reported feedback-to-maintenance loop issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Connect user feedback, complaints, and operational incidents to prioritized maintenance actions. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported feedback-to-maintenance loop issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Connect user feedback, complaints, and operational incidents to prioritized maintenance actions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor audit rights, for which an example concern is: A provider refuses to furnish material security or risk-assessment evidence while the deployment poses serious compliance exposure. It could be useful in that different situation, but it would not directly address the vendor model changes deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Operational records identify material vendor updates and corresponding validation decisions.

This response relates instead to residual-risk acceptance, for which an example concern is: A third-party AI tool has known limitations, but nobody at the purchasing organization has formally accepted or rejected remaining risks. It could be useful in that different situation, but it would not directly address the vendor model changes deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Operational records identify material vendor updates and corresponding validation decisions.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the vendor model changes deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Operational records identify material vendor updates and corresponding validation decisions.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported vendor model changes issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require change management, notice, and reevaluation rights proportionate to deployment risk. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported vendor model changes issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require change management, notice, and reevaluation rights proportionate to deployment risk. The offered observation does not establish whether that targeted control succeeded.

This result would support subprocessor oversight, a distinct governance need illustrated by: A vendor may route prompts through undisclosed subcontractors, but the buyer's review covers only the contracting company. For the reported vendor model changes issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require change management, notice, and reevaluation rights proportionate to deployment risk. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to data dependency and drift, for which an example concern is: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. It could be useful in that different situation, but it would not directly address the opaque decision impacts deficiency reported at a government service center in Canberra. The targeted acceptance criterion here is: Affected individuals receive understandable reasons or explanations and a usable review channel.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the opaque decision impacts deficiency reported at a government service center in Canberra. The targeted acceptance criterion here is: Affected individuals receive understandable reasons or explanations and a usable review channel.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the opaque decision impacts deficiency reported at a government service center in Canberra. The targeted acceptance criterion here is: Affected individuals receive understandable reasons or explanations and a usable review channel.

This result would support data dependency and drift, a distinct governance need illustrated by: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. For the reported opaque decision impacts issue at a government service center in Canberra, the relevant corrective action is: Set transparency and contestability requirements appropriate to the decision impact and applicable law. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported opaque decision impacts issue at a government service center in Canberra, the relevant corrective action is: Set transparency and contestability requirements appropriate to the decision impact and applicable law. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported opaque decision impacts issue at a government service center in Canberra, the relevant corrective action is: Set transparency and contestability requirements appropriate to the decision impact and applicable law. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to training-data governance duty, for which an example concern is: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. It could be useful in that different situation, but it would not directly address the conformity assessment planning deficiency reported at a professional services group in London. The targeted acceptance criterion here is: A completed assessment and associated evidence are available before the relevant release gate.

This response relates instead to regulatory incident reporting, for which an example concern is: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. It could be useful in that different situation, but it would not directly address the conformity assessment planning deficiency reported at a professional services group in London. The targeted acceptance criterion here is: A completed assessment and associated evidence are available before the relevant release gate.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the conformity assessment planning deficiency reported at a professional services group in London. The targeted acceptance criterion here is: A completed assessment and associated evidence are available before the relevant release gate.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported conformity assessment planning issue at a professional services group in London, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported conformity assessment planning issue at a professional services group in London, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported conformity assessment planning issue at a professional services group in London, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.