Exam Bundle

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported conformity assessment planning issue at a professional services group in London, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported conformity assessment planning issue at a professional services group in London, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported conformity assessment planning issue at a professional services group in London, the relevant corrective action is: Determine the applicable conformity-assessment pathway before placing the regulated system into service. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to end-of-life and archival controls, for which an example concern is: A retired AI service remains reachable through an undocumented integration and continues receiving user data. It could be useful in that different situation, but it would not directly address the incident containment deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Incident logs show exposures halted and required stakeholders notified promptly.

This response relates instead to threat modeling new data flow, for which an example concern is: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. It could be useful in that different situation, but it would not directly address the incident containment deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Incident logs show exposures halted and required stakeholders notified promptly.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the incident containment deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Incident logs show exposures halted and required stakeholders notified promptly.

This result would support safety and reliability monitoring, a distinct governance need illustrated by: An AI-powered workflow is monitored only for uptime while harmful errors can occur even when the service is available. For the reported incident containment issue at a global platform operator in Berlin, the relevant corrective action is: Activate risk-proportionate containment such as blocking affected features or restricting access. The offered observation does not establish whether that targeted control succeeded.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported incident containment issue at a global platform operator in Berlin, the relevant corrective action is: Activate risk-proportionate containment such as blocking affected features or restricting access. The offered observation does not establish whether that targeted control succeeded.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported incident containment issue at a global platform operator in Berlin, the relevant corrective action is: Activate risk-proportionate containment such as blocking affected features or restricting access. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to feedback-to-maintenance loop, for which an example concern is: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. It could be useful in that different situation, but it would not directly address the incident classification deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The incident record reflects severity, escalation, containment, and corrective action.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the incident classification deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The incident record reflects severity, escalation, containment, and corrective action.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the incident classification deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The incident record reflects severity, escalation, containment, and corrective action.

This result would support root-cause collaboration, a distinct governance need illustrated by: After an AI failure, engineering blames users without checking data quality, model brittleness, configuration, and workflow context. For the reported incident classification issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported incident classification issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.

This result would support external transparency materials, a distinct governance need illustrated by: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. For the reported incident classification issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to confidential business material, for which an example concern is: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. It could be useful in that different situation, but it would not directly address the housing access equality deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: Application outcomes and selection criteria are tested under applicable housing rules.

This response relates instead to product safety liability, for which an example concern is: A manufacturer integrates AI into a safety device but evaluates only the vendor's standalone model accuracy. It could be useful in that different situation, but it would not directly address the housing access equality deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: Application outcomes and selection criteria are tested under applicable housing rules.

This response relates instead to copyright in training data, for which an example concern is: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. It could be useful in that different situation, but it would not directly address the housing access equality deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: Application outcomes and selection criteria are tested under applicable housing rules.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported housing access equality issue at a property services provider in Boston, the relevant corrective action is: Assess housing-specific nondiscrimination requirements alongside the AI governance policy. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported housing access equality issue at a property services provider in Boston, the relevant corrective action is: Assess housing-specific nondiscrimination requirements alongside the AI governance policy. The offered observation does not establish whether that targeted control succeeded.

This result would support credit fairness, a distinct governance need illustrated by: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. For the reported housing access equality issue at a property services provider in Boston, the relevant corrective action is: Assess housing-specific nondiscrimination requirements alongside the AI governance policy. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the retirement and disposal deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Retirement evidence confirms endpoints are disabled and data are retained or deleted according to policy.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the retirement and disposal deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Retirement evidence confirms endpoints are disabled and data are retained or deleted according to policy.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the retirement and disposal deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Retirement evidence confirms endpoints are disabled and data are retained or deleted according to policy.

This result would support lifecycle gate policy, a distinct governance need illustrated by: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. For the reported retirement and disposal issue at a large multibranch organization in Oslo, the relevant corrective action is: Create a controlled AI decommission process for access removal, model/data handling, records, and dependencies. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy/security policy integration, a distinct governance need illustrated by: A security team treats model prompts as outside existing access-control and data-retention policies. For the reported retirement and disposal issue at a large multibranch organization in Oslo, the relevant corrective action is: Create a controlled AI decommission process for access removal, model/data handling, records, and dependencies. The offered observation does not establish whether that targeted control succeeded.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported retirement and disposal issue at a large multibranch organization in Oslo, the relevant corrective action is: Create a controlled AI decommission process for access removal, model/data handling, records, and dependencies. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the post-market monitoring plan deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The plan links live evidence to assigned review actions and retention requirements.

This response relates instead to monitoring ownership, for which an example concern is: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. It could be useful in that different situation, but it would not directly address the post-market monitoring plan deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The plan links live evidence to assigned review actions and retention requirements.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the post-market monitoring plan deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The plan links live evidence to assigned review actions and retention requirements.

This result would support threat modeling new data flow, a distinct governance need illustrated by: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. For the reported post-market monitoring plan issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.

This result would support downstream harm forecasts, a distinct governance need illustrated by: An innocuous text generator is integrated into a system that automatically sends consequential legal notices without reassessing impact. For the reported post-market monitoring plan issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.

This result would support regular control audit, a distinct governance need illustrated by: A deployed AI system has unchanged governance paperwork despite major operational changes and no control re-testing. For the reported post-market monitoring plan issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.