Exam Bundle

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported policy exception governance issue at a technology services group in Stockholm, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported policy exception governance issue at a technology services group in Stockholm, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.

This result would support lifecycle gate policy, a distinct governance need illustrated by: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. For the reported policy exception governance issue at a technology services group in Stockholm, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the deployer operational duties deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Operating records show trained overseers, appropriate inputs, and local performance checks.

This response relates instead to human oversight requirements, for which an example concern is: A regulated high-risk model advises caseworkers, but they lack training or the practical authority to reject erroneous outputs. It could be useful in that different situation, but it would not directly address the deployer operational duties deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Operating records show trained overseers, appropriate inputs, and local performance checks.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the deployer operational duties deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Operating records show trained overseers, appropriate inputs, and local performance checks.

This result would support regulatory incident reporting, a distinct governance need illustrated by: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. For the reported deployer operational duties issue at a regional technology consortium in Auckland, the relevant corrective action is: Assign deployer responsibilities for instructions, competent oversight, suitable input data, and monitoring. The offered observation does not establish whether that targeted control succeeded.

This result would support prohibited uses review, a distinct governance need illustrated by: A procurement team plans an AI capability that may fall under a legally prohibited practice without screening its purpose or context. For the reported deployer operational duties issue at a regional technology consortium in Auckland, the relevant corrective action is: Assign deployer responsibilities for instructions, competent oversight, suitable input data, and monitoring. The offered observation does not establish whether that targeted control succeeded.

This result would support training-data governance duty, a distinct governance need illustrated by: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. For the reported deployer operational duties issue at a regional technology consortium in Auckland, the relevant corrective action is: Assign deployer responsibilities for instructions, competent oversight, suitable input data, and monitoring. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to model selection trade-offs, for which an example concern is: A team chooses a very large generative model for a small deterministic lookup without comparing alternatives. It could be useful in that different situation, but it would not directly address the impact assessment in design deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Requirements and mitigation records trace to assessed impacts on relevant groups.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the impact assessment in design deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Requirements and mitigation records trace to assessed impacts on relevant groups.

This response relates instead to evaluation-threshold setting, for which an example concern is: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. It could be useful in that different situation, but it would not directly address the impact assessment in design deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Requirements and mitigation records trace to assessed impacts on relevant groups.

This result would support pilot containment, a distinct governance need illustrated by: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. For the reported impact assessment in design issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Conduct an early AI impact assessment and feed its findings into requirements and architecture. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported impact assessment in design issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Conduct an early AI impact assessment and feed its findings into requirements and architecture. The offered observation does not establish whether that targeted control succeeded.

This result would support design decision trace, a distinct governance need illustrated by: The model team cannot explain why a sensitive input feature was retained after a privacy objection. For the reported impact assessment in design issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Conduct an early AI impact assessment and feed its findings into requirements and architecture. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to subprocessor oversight, for which an example concern is: A vendor may route prompts through undisclosed subcontractors, but the buyer's review covers only the contracting company. It could be useful in that different situation, but it would not directly address the proprietary model self-deployment deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The governance responsibility register includes model creation and deployment responsibilities.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the proprietary model self-deployment deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The governance responsibility register includes model creation and deployment responsibilities.

This response relates instead to vendor audit rights, for which an example concern is: A provider refuses to furnish material security or risk-assessment evidence while the deployment poses serious compliance exposure. It could be useful in that different situation, but it would not directly address the proprietary model self-deployment deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The governance responsibility register includes model creation and deployment responsibilities.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported proprietary model self-deployment issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate the additional design, training, quality, and release obligations arising from its own provider role. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported proprietary model self-deployment issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate the additional design, training, quality, and release obligations arising from its own provider role. The offered observation does not establish whether that targeted control succeeded.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported proprietary model self-deployment issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate the additional design, training, quality, and release obligations arising from its own provider role. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the policy exception governance deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Exceptions show accountable authorization, expiry, mitigations, and closure evidence.

This response relates instead to lifecycle gate policy, for which an example concern is: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. It could be useful in that different situation, but it would not directly address the policy exception governance deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Exceptions show accountable authorization, expiry, mitigations, and closure evidence.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the policy exception governance deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Exceptions show accountable authorization, expiry, mitigations, and closure evidence.

This result would support human review policy, a distinct governance need illustrated by: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. For the reported policy exception governance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.

This result would support lifecycle gate policy, a distinct governance need illustrated by: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. For the reported policy exception governance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported policy exception governance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Implement documented exception approval with compensating safeguards, expiration, and follow-up review. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the gpai model responsibilities deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The role analysis distinguishes foundation-model documentation and related obligations from app deployment controls.

This response relates instead to regulatory incident reporting, for which an example concern is: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. It could be useful in that different situation, but it would not directly address the gpai model responsibilities deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The role analysis distinguishes foundation-model documentation and related obligations from app deployment controls.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the gpai model responsibilities deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The role analysis distinguishes foundation-model documentation and related obligations from app deployment controls.

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported gpai model responsibilities issue at a regional service provider in Singapore, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.

This result would support training-data governance duty, a distinct governance need illustrated by: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. For the reported gpai model responsibilities issue at a regional service provider in Singapore, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.

This result would support risk-tier classification, a distinct governance need illustrated by: A company considers all AI equally regulated without checking whether a use fits prohibited, high-risk, or transparency-focused categories. For the reported gpai model responsibilities issue at a regional service provider in Singapore, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.