Exam Bundle

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported risk tolerance communication issue at a global platform operator in Berlin, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported risk tolerance communication issue at a global platform operator in Berlin, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.

This result would support proportional control design, a distinct governance need illustrated by: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. For the reported risk tolerance communication issue at a global platform operator in Berlin, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the risk-tier classification deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The legal review explains the relevant use-case category and obligations rather than assigning risk by model brand.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the risk-tier classification deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The legal review explains the relevant use-case category and obligations rather than assigning risk by model brand.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the risk-tier classification deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The legal review explains the relevant use-case category and obligations rather than assigning risk by model brand.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported risk-tier classification issue at a regional technology consortium in Auckland, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported risk-tier classification issue at a regional technology consortium in Auckland, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported risk-tier classification issue at a regional technology consortium in Auckland, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to design decision trace, for which an example concern is: The model team cannot explain why a sensitive input feature was retained after a privacy objection. It could be useful in that different situation, but it would not directly address the risk-mitigation hierarchy deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The control plan shows why more effective technical and process mitigations were considered.

This response relates instead to purpose and success definition, for which an example concern is: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. It could be useful in that different situation, but it would not directly address the risk-mitigation hierarchy deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The control plan shows why more effective technical and process mitigations were considered.

This response relates instead to human oversight by design, for which an example concern is: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. It could be useful in that different situation, but it would not directly address the risk-mitigation hierarchy deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The control plan shows why more effective technical and process mitigations were considered.

This result would support benchmark relevance, a distinct governance need illustrated by: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. For the reported risk-mitigation hierarchy issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Prioritize risk elimination or design reduction before relying only on warnings or downstream procedures. The offered observation does not establish whether that targeted control succeeded.

This result would support architecture security review, a distinct governance need illustrated by: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. For the reported risk-mitigation hierarchy issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Prioritize risk elimination or design reduction before relying only on warnings or downstream procedures. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported risk-mitigation hierarchy issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Prioritize risk elimination or design reduction before relying only on warnings or downstream procedures. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the on-premises option deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The local operating plan assigns infrastructure, access, incident, and maintenance ownership.

This response relates instead to edge inference suitability, for which an example concern is: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. It could be useful in that different situation, but it would not directly address the on-premises option deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The local operating plan assigns infrastructure, access, incident, and maintenance ownership.

This response relates instead to cloud deployment trade-offs, for which an example concern is: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. It could be useful in that different situation, but it would not directly address the on-premises option deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The local operating plan assigns infrastructure, access, incident, and maintenance ownership.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported on-premises option issue at a global platform operator in Berlin, the relevant corrective action is: Evaluate whether local hosting can satisfy security operations, model updates, and resilience responsibilities. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported on-premises option issue at a global platform operator in Berlin, the relevant corrective action is: Evaluate whether local hosting can satisfy security operations, model updates, and resilience responsibilities. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported on-premises option issue at a global platform operator in Berlin, the relevant corrective action is: Evaluate whether local hosting can satisfy security operations, model updates, and resilience responsibilities. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the safety versus raw accuracy deficiency reported at a logistics technology company in Hamburg. The targeted acceptance criterion here is: Risk analysis and safety tests quantify dangerous misses and define safe fallback behavior.

This response relates instead to supervised learning limits, for which an example concern is: A project promises highly reliable supervised predictions but has only unlabeled historical records and no ground-truth outcomes. It could be useful in that different situation, but it would not directly address the safety versus raw accuracy deficiency reported at a logistics technology company in Hamburg. The targeted acceptance criterion here is: Risk analysis and safety tests quantify dangerous misses and define safe fallback behavior.

This response relates instead to generative versus predictive scope, for which an example concern is: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. It could be useful in that different situation, but it would not directly address the safety versus raw accuracy deficiency reported at a logistics technology company in Hamburg. The targeted acceptance criterion here is: Risk analysis and safety tests quantify dangerous misses and define safe fallback behavior.

This result would support probabilistic output and review, a distinct governance need illustrated by: An executive assumes a generative classifier will return identical conclusions on every run and removes human checks for unusual outputs. For the reported safety versus raw accuracy issue at a logistics technology company in Hamburg, the relevant corrective action is: Assess severity-weighted failure modes rather than treating average accuracy as the only safety criterion. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported safety versus raw accuracy issue at a logistics technology company in Hamburg, the relevant corrective action is: Assess severity-weighted failure modes rather than treating average accuracy as the only safety criterion. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported safety versus raw accuracy issue at a logistics technology company in Hamburg, the relevant corrective action is: Assess severity-weighted failure modes rather than treating average accuracy as the only safety criterion. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the risk-tier classification deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The legal review explains the relevant use-case category and obligations rather than assigning risk by model brand.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the risk-tier classification deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The legal review explains the relevant use-case category and obligations rather than assigning risk by model brand.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the risk-tier classification deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The legal review explains the relevant use-case category and obligations rather than assigning risk by model brand.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported risk-tier classification issue at a large multibranch organization in Oslo, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported risk-tier classification issue at a large multibranch organization in Oslo, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported risk-tier classification issue at a large multibranch organization in Oslo, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.