Exam Bundle

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported regular control audit issue at a large multibranch organization in Oslo, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support threat modeling new data flow, a distinct governance need illustrated by: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. For the reported regular control audit issue at a large multibranch organization in Oslo, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported regular control audit issue at a large multibranch organization in Oslo, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to architecture security review, for which an example concern is: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. It could be useful in that different situation, but it would not directly address the probability-severity matrix deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The documented risk ranking reflects severity as well as probability and affected population.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the probability-severity matrix deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The documented risk ranking reflects severity as well as probability and affected population.

This response relates instead to benchmark relevance, for which an example concern is: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. It could be useful in that different situation, but it would not directly address the probability-severity matrix deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The documented risk ranking reflects severity as well as probability and affected population.

This result would support benchmark relevance, a distinct governance need illustrated by: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. For the reported probability-severity matrix issue at a professional services group in London, the relevant corrective action is: Assess both likelihood and potential severity of AI harms when prioritizing mitigations. The offered observation does not establish whether that targeted control succeeded.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported probability-severity matrix issue at a professional services group in London, the relevant corrective action is: Assess both likelihood and potential severity of AI harms when prioritizing mitigations. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported probability-severity matrix issue at a professional services group in London, the relevant corrective action is: Assess both likelihood and potential severity of AI harms when prioritizing mitigations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the transparent privacy notice deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The notice identifies categories, purposes, recipients, and applicable rights for affected individuals.

This response relates instead to data minimization, for which an example concern is: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. It could be useful in that different situation, but it would not directly address the transparent privacy notice deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The notice identifies categories, purposes, recipients, and applicable rights for affected individuals.

This response relates instead to purpose limitation, for which an example concern is: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. It could be useful in that different situation, but it would not directly address the transparent privacy notice deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The notice identifies categories, purposes, recipients, and applicable rights for affected individuals.

This result would support data minimization, a distinct governance need illustrated by: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. For the reported transparent privacy notice issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported transparent privacy notice issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.

This result would support automated decisions and contestability, a distinct governance need illustrated by: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. For the reported transparent privacy notice issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Provide clear, purpose-specific processing information and required notices before or when using the AI feature. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor model changes, for which an example concern is: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. It could be useful in that different situation, but it would not directly address the vendor audit rights deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Agreed assurance mechanisms allow review of the relevant controls and incidents.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the vendor audit rights deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Agreed assurance mechanisms allow review of the relevant controls and incidents.

This response relates instead to subprocessor oversight, for which an example concern is: A vendor may route prompts through undisclosed subcontractors, but the buyer's review covers only the contracting company. It could be useful in that different situation, but it would not directly address the vendor audit rights deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Agreed assurance mechanisms allow review of the relevant controls and incidents.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported vendor audit rights issue at a technology services group in Stockholm, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported vendor audit rights issue at a technology services group in Stockholm, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported vendor audit rights issue at a technology services group in Stockholm, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to retraining governance, for which an example concern is: Automated retraining replaces models weekly without any checks that changes reduce bias or preserve required safety. It could be useful in that different situation, but it would not directly address the threat-model maintenance deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The updated threat model covers new tools, credentials, injection surfaces, and abuse controls.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the threat-model maintenance deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The updated threat model covers new tools, credentials, injection surfaces, and abuse controls.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the threat-model maintenance deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The updated threat model covers new tools, credentials, injection surfaces, and abuse controls.

This result would support red-teaming schedule, a distinct governance need illustrated by: A conversational model passed one initial safety test but has never undergone adversarial probing after new tools were added. For the reported threat-model maintenance issue at a software services vendor in Lisbon, the relevant corrective action is: Refresh threat models for new agent capabilities, trust boundaries, and misuse paths. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported threat-model maintenance issue at a software services vendor in Lisbon, the relevant corrective action is: Refresh threat models for new agent capabilities, trust boundaries, and misuse paths. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported threat-model maintenance issue at a software services vendor in Lisbon, the relevant corrective action is: Refresh threat models for new agent capabilities, trust boundaries, and misuse paths. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to board-level oversight, for which an example concern is: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. It could be useful in that different situation, but it would not directly address the risk tolerance communication deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Teams consistently apply the same documented tolerance thresholds when approving new use cases.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the risk tolerance communication deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Teams consistently apply the same documented tolerance thresholds when approving new use cases.

This response relates instead to cross-functional review, for which an example concern is: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. It could be useful in that different situation, but it would not directly address the risk tolerance communication deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Teams consistently apply the same documented tolerance thresholds when approving new use cases.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported risk tolerance communication issue at a global platform operator in Berlin, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported risk tolerance communication issue at a global platform operator in Berlin, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.

This result would support proportional control design, a distinct governance need illustrated by: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. For the reported risk tolerance communication issue at a global platform operator in Berlin, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.