Exam Bundle

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported risk-tier classification issue at a large multibranch organization in Oslo, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported risk-tier classification issue at a large multibranch organization in Oslo, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported risk-tier classification issue at a large multibranch organization in Oslo, the relevant corrective action is: Classify the specific intended AI use under the applicable AI-specific legal framework before selecting controls. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the end-of-life and archival controls deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Verification confirms retired integrations no longer process live data and required records remain governed.

This response relates instead to threat modeling new data flow, for which an example concern is: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. It could be useful in that different situation, but it would not directly address the end-of-life and archival controls deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Verification confirms retired integrations no longer process live data and required records remain governed.

This response relates instead to incident containment, for which an example concern is: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. It could be useful in that different situation, but it would not directly address the end-of-life and archival controls deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Verification confirms retired integrations no longer process live data and required records remain governed.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported end-of-life and archival controls issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Execute a coordinated retirement checklist covering interfaces, access, records, and retention. The offered observation does not establish whether that targeted control succeeded.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported end-of-life and archival controls issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Execute a coordinated retirement checklist covering interfaces, access, records, and retention. The offered observation does not establish whether that targeted control succeeded.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported end-of-life and archival controls issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Execute a coordinated retirement checklist covering interfaces, access, records, and retention. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to pilot containment, for which an example concern is: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. It could be useful in that different situation, but it would not directly address the benchmark relevance deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: Validation reflects the actual deployment tasks and known safety failure modes.

This response relates instead to architecture security review, for which an example concern is: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. It could be useful in that different situation, but it would not directly address the benchmark relevance deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: Validation reflects the actual deployment tasks and known safety failure modes.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the benchmark relevance deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: Validation reflects the actual deployment tasks and known safety failure modes.

This result would support probability-severity matrix, a distinct governance need illustrated by: A project prioritizes a rare catastrophic harm below trivial frequent errors because it counts occurrences only. For the reported benchmark relevance issue at a healthcare service provider in Raleigh, the relevant corrective action is: Select domain- and use-case-relevant benchmarks plus representative pilot scenarios. The offered observation does not establish whether that targeted control succeeded.

This result would support model selection trade-offs, a distinct governance need illustrated by: A team chooses a very large generative model for a small deterministic lookup without comparing alternatives. For the reported benchmark relevance issue at a healthcare service provider in Raleigh, the relevant corrective action is: Select domain- and use-case-relevant benchmarks plus representative pilot scenarios. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported benchmark relevance issue at a healthcare service provider in Raleigh, the relevant corrective action is: Select domain- and use-case-relevant benchmarks plus representative pilot scenarios. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the prohibited uses review deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Procurement records show the disallowed scenario was blocked or changed to a lawful design.

This response relates instead to human oversight requirements, for which an example concern is: A regulated high-risk model advises caseworkers, but they lack training or the practical authority to reject erroneous outputs. It could be useful in that different situation, but it would not directly address the prohibited uses review deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Procurement records show the disallowed scenario was blocked or changed to a lawful design.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the prohibited uses review deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Procurement records show the disallowed scenario was blocked or changed to a lawful design.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported prohibited uses review issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Perform prohibited-practice screening before acquisition and decline or redesign any legally impermissible use. The offered observation does not establish whether that targeted control succeeded.

This result would support regulatory incident reporting, a distinct governance need illustrated by: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. For the reported prohibited uses review issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Perform prohibited-practice screening before acquisition and decline or redesign any legally impermissible use. The offered observation does not establish whether that targeted control succeeded.

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported prohibited uses review issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Perform prohibited-practice screening before acquisition and decline or redesign any legally impermissible use. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cross-functional review, for which an example concern is: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. It could be useful in that different situation, but it would not directly address the board-level oversight deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Leadership dashboards and minutes demonstrate oversight decisions and follow-up actions.

This response relates instead to enterprise inventory ownership, for which an example concern is: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. It could be useful in that different situation, but it would not directly address the board-level oversight deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Leadership dashboards and minutes demonstrate oversight decisions and follow-up actions.

This response relates instead to employee ai literacy, for which an example concern is: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. It could be useful in that different situation, but it would not directly address the board-level oversight deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Leadership dashboards and minutes demonstrate oversight decisions and follow-up actions.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported board-level oversight issue at a global platform operator in Berlin, the relevant corrective action is: Establish regular governing-body reporting on AI objectives, material risks, and unresolved exceptions. The offered observation does not establish whether that targeted control succeeded.

This result would support enterprise inventory ownership, a distinct governance need illustrated by: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. For the reported board-level oversight issue at a global platform operator in Berlin, the relevant corrective action is: Establish regular governing-body reporting on AI objectives, material risks, and unresolved exceptions. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported board-level oversight issue at a global platform operator in Berlin, the relevant corrective action is: Establish regular governing-body reporting on AI objectives, material risks, and unresolved exceptions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to service availability contract, for which an example concern is: A mission-critical deployment relies on a third-party model with no incident notification or service recovery obligations. It could be useful in that different situation, but it would not directly address the licensing restrictions deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The licensing checklist confirms the intended product and geographic uses are authorized.

This response relates instead to vendor training-data terms, for which an example concern is: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. It could be useful in that different situation, but it would not directly address the licensing restrictions deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The licensing checklist confirms the intended product and geographic uses are authorized.

This response relates instead to vendor model changes, for which an example concern is: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. It could be useful in that different situation, but it would not directly address the licensing restrictions deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The licensing checklist confirms the intended product and geographic uses are authorized.

This result would support vendor training-data terms, a distinct governance need illustrated by: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. For the reported licensing restrictions issue at a regional service provider in Singapore, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported licensing restrictions issue at a regional service provider in Singapore, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported licensing restrictions issue at a regional service provider in Singapore, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.