Exam Bundle

This result would support vendor training-data terms, a distinct governance need illustrated by: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. For the reported licensing restrictions issue at a regional service provider in Singapore, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported licensing restrictions issue at a regional service provider in Singapore, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported licensing restrictions issue at a regional service provider in Singapore, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to architecture security review, for which an example concern is: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. It could be useful in that different situation, but it would not directly address the benchmark relevance deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: Validation reflects the actual deployment tasks and known safety failure modes.

This response relates instead to pilot containment, for which an example concern is: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. It could be useful in that different situation, but it would not directly address the benchmark relevance deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: Validation reflects the actual deployment tasks and known safety failure modes.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the benchmark relevance deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: Validation reflects the actual deployment tasks and known safety failure modes.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported benchmark relevance issue at a public health agency in Ottawa, the relevant corrective action is: Select domain- and use-case-relevant benchmarks plus representative pilot scenarios. The offered observation does not establish whether that targeted control succeeded.

This result would support model selection trade-offs, a distinct governance need illustrated by: A team chooses a very large generative model for a small deterministic lookup without comparing alternatives. For the reported benchmark relevance issue at a public health agency in Ottawa, the relevant corrective action is: Select domain- and use-case-relevant benchmarks plus representative pilot scenarios. The offered observation does not establish whether that targeted control succeeded.

This result would support probability-severity matrix, a distinct governance need illustrated by: A project prioritizes a rare catastrophic harm below trivial frequent errors because it counts occurrences only. For the reported benchmark relevance issue at a public health agency in Ottawa, the relevant corrective action is: Select domain- and use-case-relevant benchmarks plus representative pilot scenarios. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the regulatory incident reporting deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Incident records track affected authorities, reportability analysis, deadlines, and corrective actions.

This response relates instead to high-risk management system, for which an example concern is: A provider of a potentially high-risk AI system cannot show a documented ongoing process for evaluating foreseeable risks. It could be useful in that different situation, but it would not directly address the regulatory incident reporting deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Incident records track affected authorities, reportability analysis, deadlines, and corrective actions.

This response relates instead to gpai model responsibilities, for which an example concern is: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. It could be useful in that different situation, but it would not directly address the regulatory incident reporting deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Incident records track affected authorities, reportability analysis, deadlines, and corrective actions.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported regulatory incident reporting issue at a professional services group in London, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.

This result would support prohibited uses review, a distinct governance need illustrated by: A procurement team plans an AI capability that may fall under a legally prohibited practice without screening its purpose or context. For the reported regulatory incident reporting issue at a professional services group in London, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported regulatory incident reporting issue at a professional services group in London, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor audit rights, for which an example concern is: A provider refuses to furnish material security or risk-assessment evidence while the deployment poses serious compliance exposure. It could be useful in that different situation, but it would not directly address the portability and exit deficiency reported at a professional services group in London. The targeted acceptance criterion here is: An exit test demonstrates usable export and feasible service replacement or safe suspension.

This response relates instead to subprocessor oversight, for which an example concern is: A vendor may route prompts through undisclosed subcontractors, but the buyer's review covers only the contracting company. It could be useful in that different situation, but it would not directly address the portability and exit deficiency reported at a professional services group in London. The targeted acceptance criterion here is: An exit test demonstrates usable export and feasible service replacement or safe suspension.

This response relates instead to vendor training-data terms, for which an example concern is: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. It could be useful in that different situation, but it would not directly address the portability and exit deficiency reported at a professional services group in London. The targeted acceptance criterion here is: An exit test demonstrates usable export and feasible service replacement or safe suspension.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported portability and exit issue at a professional services group in London, the relevant corrective action is: Assess lock-in, transition arrangements, data export, and operational alternatives before contract approval. The offered observation does not establish whether that targeted control succeeded.

This result would support proprietary model self-deployment, a distinct governance need illustrated by: A company builds and deploys its own AI product but assumes self-hosting eliminates provider-side documentation and safety duties. For the reported portability and exit issue at a professional services group in London, the relevant corrective action is: Assess lock-in, transition arrangements, data export, and operational alternatives before contract approval. The offered observation does not establish whether that targeted control succeeded.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported portability and exit issue at a professional services group in London, the relevant corrective action is: Assess lock-in, transition arrangements, data export, and operational alternatives before contract approval. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the class-imbalance testing deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Confusion matrices and targeted tests reveal how often dangerous cases are missed.

This response relates instead to model interpretability checks, for which an example concern is: A risk-scoring tool is deployed with generic feature-importance plots that have not been tested for stability or usefulness. It could be useful in that different situation, but it would not directly address the class-imbalance testing deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Confusion matrices and targeted tests reveal how often dangerous cases are missed.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the class-imbalance testing deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Confusion matrices and targeted tests reveal how often dangerous cases are missed.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported class-imbalance testing issue at a technology services group in Stockholm, the relevant corrective action is: Evaluate recall and error severity for the minority safety-critical class, not accuracy alone. The offered observation does not establish whether that targeted control succeeded.

This result would support integration and end-to-end tests, a distinct governance need illustrated by: A model passes unit tests but the live application passes the wrong input field and silently reverses classifications. For the reported class-imbalance testing issue at a technology services group in Stockholm, the relevant corrective action is: Evaluate recall and error severity for the minority safety-critical class, not accuracy alone. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported class-imbalance testing issue at a technology services group in Stockholm, the relevant corrective action is: Evaluate recall and error severity for the minority safety-critical class, not accuracy alone. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to human review policy, for which an example concern is: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. It could be useful in that different situation, but it would not directly address the ai acceptable-use policy deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Usage controls and staff guidance distinguish authorized AI services from forbidden disclosures.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the ai acceptable-use policy deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Usage controls and staff guidance distinguish authorized AI services from forbidden disclosures.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the ai acceptable-use policy deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: Usage controls and staff guidance distinguish authorized AI services from forbidden disclosures.

This result would support documentation and traceability, a distinct governance need illustrated by: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. For the reported ai acceptable-use policy issue at a corporate HR program in Amsterdam, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy/security policy integration, a distinct governance need illustrated by: A security team treats model prompts as outside existing access-control and data-retention policies. For the reported ai acceptable-use policy issue at a corporate HR program in Amsterdam, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This result would support ai incident response, a distinct governance need illustrated by: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. For the reported ai acceptable-use policy issue at a corporate HR program in Amsterdam, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.