Exam Bundle

This result would support threat modeling new data flow, a distinct governance need illustrated by: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. For the reported post-market monitoring plan issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.

This result would support downstream harm forecasts, a distinct governance need illustrated by: An innocuous text generator is integrated into a system that automatically sends consequential legal notices without reassessing impact. For the reported post-market monitoring plan issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.

This result would support regular control audit, a distinct governance need illustrated by: A deployed AI system has unchanged governance paperwork despite major operational changes and no control re-testing. For the reported post-market monitoring plan issue at a large multibranch organization in Oslo, the relevant corrective action is: Maintain a post-market monitoring plan with data sources, review cadence, and escalation criteria. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the versioned release artifacts deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: The installed model hash and configuration match the approved release package.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the versioned release artifacts deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: The installed model hash and configuration match the approved release package.

This response relates instead to release-readiness evidence, for which an example concern is: A new model is promoted into production while safety-test failures and unresolved critical issues remain undocumented. It could be useful in that different situation, but it would not directly address the versioned release artifacts deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: The installed model hash and configuration match the approved release package.

This result would support safe rollback operations, a distinct governance need illustrated by: A new model release creates unacceptable errors, but operations lack a tested method to restore the previous safe version. For the reported versioned release artifacts issue at a hospital group in Melbourne, the relevant corrective action is: Control model artifacts and deployment configurations with versioned, auditable release records. The offered observation does not establish whether that targeted control succeeded.

This result would support release-readiness evidence, a distinct governance need illustrated by: A new model is promoted into production while safety-test failures and unresolved critical issues remain undocumented. For the reported versioned release artifacts issue at a hospital group in Melbourne, the relevant corrective action is: Control model artifacts and deployment configurations with versioned, auditable release records. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported versioned release artifacts issue at a hospital group in Melbourne, the relevant corrective action is: Control model artifacts and deployment configurations with versioned, auditable release records. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the iso terminology and impact scope deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The standards register assigns each referenced standard to its actual governance purpose.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the iso terminology and impact scope deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The standards register assigns each referenced standard to its actual governance purpose.

This response relates instead to iso 42001 aims, for which an example concern is: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. It could be useful in that different situation, but it would not directly address the iso terminology and impact scope deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The standards register assigns each referenced standard to its actual governance purpose.

This result would support oecd trustworthy ai principles, a distinct governance need illustrated by: An organization claims the OECD Principles are a legally binding certification rather than a policy recommendation about trustworthy AI. For the reported iso terminology and impact scope issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Map AI terminology needs to ISO/IEC 22989 and AI-system impact assessment to ISO/IEC 42005. The offered observation does not establish whether that targeted control succeeded.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported iso terminology and impact scope issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Map AI terminology needs to ISO/IEC 22989 and AI-system impact assessment to ISO/IEC 42005. The offered observation does not establish whether that targeted control succeeded.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported iso terminology and impact scope issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Map AI terminology needs to ISO/IEC 22989 and AI-system impact assessment to ISO/IEC 42005. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the human override in practice deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Oversight testing shows trained people can disagree and reverse erroneous outcomes without obstruction.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the human override in practice deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Oversight testing shows trained people can disagree and reverse erroneous outcomes without obstruction.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the human override in practice deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Oversight testing shows trained people can disagree and reverse erroneous outcomes without obstruction.

This result would support monitoring ownership, a distinct governance need illustrated by: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. For the reported human override in practice issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Ensure intervention is feasible, encouraged when justified, and supported by reviewable evidence. The offered observation does not establish whether that targeted control succeeded.

This result would support deactivation authority, a distinct governance need illustrated by: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. For the reported human override in practice issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Ensure intervention is feasible, encouraged when justified, and supported by reviewable evidence. The offered observation does not establish whether that targeted control succeeded.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported human override in practice issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Ensure intervention is feasible, encouraged when justified, and supported by reviewable evidence. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to integration and end-to-end tests, for which an example concern is: A model passes unit tests but the live application passes the wrong input field and silently reverses classifications. It could be useful in that different situation, but it would not directly address the data leakage between splits deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The evaluation split is demonstrably independent under the chosen leakage controls.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the data leakage between splits deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The evaluation split is demonstrably independent under the chosen leakage controls.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the data leakage between splits deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The evaluation split is demonstrably independent under the chosen leakage controls.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported data leakage between splits issue at a global platform operator in Berlin, the relevant corrective action is: Prevent train-test leakage with appropriate entity- and time-aware data partitioning. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported data leakage between splits issue at a global platform operator in Berlin, the relevant corrective action is: Prevent train-test leakage with appropriate entity- and time-aware data partitioning. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy-preserving data treatment, a distinct governance need illustrated by: A team keeps full identifiable transcripts in an experimental dataset despite the ability to meet its goal with less personal detail. For the reported data leakage between splits issue at a global platform operator in Berlin, the relevant corrective action is: Prevent train-test leakage with appropriate entity- and time-aware data partitioning. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to lifecycle gate policy, for which an example concern is: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. It could be useful in that different situation, but it would not directly address the policy exception governance deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Exceptions show accountable authorization, expiry, mitigations, and closure evidence.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the policy exception governance deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Exceptions show accountable authorization, expiry, mitigations, and closure evidence.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the policy exception governance deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Exceptions show accountable authorization, expiry, mitigations, and closure evidence.

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported policy exception governance issue at a technology services group in Stockholm, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported policy exception governance issue at a technology services group in Stockholm, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.

This result would support lifecycle gate policy, a distinct governance need illustrated by: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. For the reported policy exception governance issue at a technology services group in Stockholm, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.