Exam Bundle

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported gpai model responsibilities issue at a regional service provider in Singapore, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.

This result would support training-data governance duty, a distinct governance need illustrated by: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. For the reported gpai model responsibilities issue at a regional service provider in Singapore, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.

This result would support risk-tier classification, a distinct governance need illustrated by: A company considers all AI equally regulated without checking whether a use fits prohibited, high-risk, or transparency-focused categories. For the reported gpai model responsibilities issue at a regional service provider in Singapore, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to small versus large model, for which an example concern is: An edge device must operate offline, but a team selects a large remote model based only on headline benchmark scores. It could be useful in that different situation, but it would not directly address the edge inference suitability deficiency reported at an industrial manufacturer in Detroit. The targeted acceptance criterion here is: Tests show acceptable offline response and safe synchronization when connectivity returns.

This response relates instead to on-premises option, for which an example concern is: An organization assumes moving an AI model on-premises automatically makes it safe despite missing patching and monitoring capabilities. It could be useful in that different situation, but it would not directly address the edge inference suitability deficiency reported at an industrial manufacturer in Detroit. The targeted acceptance criterion here is: Tests show acceptable offline response and safe synchronization when connectivity returns.

This response relates instead to proprietary vendor model, for which an example concern is: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. It could be useful in that different situation, but it would not directly address the edge inference suitability deficiency reported at an industrial manufacturer in Detroit. The targeted acceptance criterion here is: Tests show acceptable offline response and safe synchronization when connectivity returns.

This result would support small versus large model, a distinct governance need illustrated by: An edge device must operate offline, but a team selects a large remote model based only on headline benchmark scores. For the reported edge inference suitability issue at an industrial manufacturer in Detroit, the relevant corrective action is: Assess edge inference where resilience and latency demands justify local execution. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported edge inference suitability issue at an industrial manufacturer in Detroit, the relevant corrective action is: Assess edge inference where resilience and latency demands justify local execution. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported edge inference suitability issue at an industrial manufacturer in Detroit, the relevant corrective action is: Assess edge inference where resilience and latency demands justify local execution. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to incident classification, for which an example concern is: An AI response causes an unsafe operational action, but support treats it as a cosmetic content-quality bug. It could be useful in that different situation, but it would not directly address the continuous model monitoring deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Dashboards detect changes in error rates and assigned owners act on threshold breaches.

This response relates instead to input data drift, for which an example concern is: An AI service receives new types of cases over time, but only the model's uptime is monitored. It could be useful in that different situation, but it would not directly address the continuous model monitoring deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Dashboards detect changes in error rates and assigned owners act on threshold breaches.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the continuous model monitoring deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Dashboards detect changes in error rates and assigned owners act on threshold breaches.

This result would support external transparency materials, a distinct governance need illustrated by: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. For the reported continuous model monitoring issue at an international services company in Helsinki, the relevant corrective action is: Monitor live performance, reliability, fairness, and safety against risk-based baselines. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported continuous model monitoring issue at an international services company in Helsinki, the relevant corrective action is: Monitor live performance, reliability, fairness, and safety against risk-based baselines. The offered observation does not establish whether that targeted control succeeded.

This result would support post-release audit cadence, a distinct governance need illustrated by: A regulated AI service was approved once and has no periodic review of logs, access, or control effectiveness. For the reported continuous model monitoring issue at an international services company in Helsinki, the relevant corrective action is: Monitor live performance, reliability, fairness, and safety against risk-based baselines. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to automated decisions and contestability, for which an example concern is: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. It could be useful in that different situation, but it would not directly address the data-subject rights handling deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: A tested request traces applicable data and meets appropriate response obligations.

This response relates instead to lawful basis before training, for which an example concern is: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. It could be useful in that different situation, but it would not directly address the data-subject rights handling deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: A tested request traces applicable data and meets appropriate response obligations.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the data-subject rights handling deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: A tested request traces applicable data and meets appropriate response obligations.

This result would support automated decisions and contestability, a distinct governance need illustrated by: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. For the reported data-subject rights handling issue at a technology services group in Stockholm, the relevant corrective action is: Create a rights-response workflow that identifies relevant personal data and lawful exceptions across AI datasets and logs. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported data-subject rights handling issue at a technology services group in Stockholm, the relevant corrective action is: Create a rights-response workflow that identifies relevant personal data and lawful exceptions across AI datasets and logs. The offered observation does not establish whether that targeted control succeeded.

This result would support data minimization, a distinct governance need illustrated by: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. For the reported data-subject rights handling issue at a technology services group in Stockholm, the relevant corrective action is: Create a rights-response workflow that identifies relevant personal data and lawful exceptions across AI datasets and logs. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the third-party procurement due diligence deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A documented vendor assessment addresses processing terms, model risks, safeguards, and exit arrangements.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the third-party procurement due diligence deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A documented vendor assessment addresses processing terms, model risks, safeguards, and exit arrangements.

This response relates instead to privacy/security policy integration, for which an example concern is: A security team treats model prompts as outside existing access-control and data-retention policies. It could be useful in that different situation, but it would not directly address the third-party procurement due diligence deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A documented vendor assessment addresses processing terms, model risks, safeguards, and exit arrangements.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported third-party procurement due diligence issue at a regional technology consortium in Auckland, the relevant corrective action is: Add AI-specific due diligence, security, privacy, and model limitation questions to supplier qualification. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported third-party procurement due diligence issue at a regional technology consortium in Auckland, the relevant corrective action is: Add AI-specific due diligence, security, privacy, and model limitation questions to supplier qualification. The offered observation does not establish whether that targeted control succeeded.

This result would support contract change monitoring, a distinct governance need illustrated by: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. For the reported third-party procurement due diligence issue at a regional technology consortium in Auckland, the relevant corrective action is: Add AI-specific due diligence, security, privacy, and model limitation questions to supplier qualification. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the regular control audit deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Audit findings are tracked to closure with evidence of effective controls.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the regular control audit deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Audit findings are tracked to closure with evidence of effective controls.

This response relates instead to deployment operating procedure, for which an example concern is: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. It could be useful in that different situation, but it would not directly address the regular control audit deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Audit findings are tracked to closure with evidence of effective controls.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported regular control audit issue at a large multibranch organization in Oslo, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support threat modeling new data flow, a distinct governance need illustrated by: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. For the reported regular control audit issue at a large multibranch organization in Oslo, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported regular control audit issue at a large multibranch organization in Oslo, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.