Exam Bundle

This result would support documentation and traceability, a distinct governance need illustrated by: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. For the reported ai acceptable-use policy issue at a corporate HR program in Amsterdam, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy/security policy integration, a distinct governance need illustrated by: A security team treats model prompts as outside existing access-control and data-retention policies. For the reported ai acceptable-use policy issue at a corporate HR program in Amsterdam, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This result would support ai incident response, a distinct governance need illustrated by: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. For the reported ai acceptable-use policy issue at a corporate HR program in Amsterdam, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the high-risk management system deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The risk file contains identified hazards, evaluations, mitigations, and residual-risk decisions.

This response relates instead to regulatory incident reporting, for which an example concern is: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. It could be useful in that different situation, but it would not directly address the high-risk management system deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The risk file contains identified hazards, evaluations, mitigations, and residual-risk decisions.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the high-risk management system deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The risk file contains identified hazards, evaluations, mitigations, and residual-risk decisions.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported high-risk management system issue at a software services vendor in Lisbon, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported high-risk management system issue at a software services vendor in Lisbon, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported high-risk management system issue at a software services vendor in Lisbon, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the data leakage between splits deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The evaluation split is demonstrably independent under the chosen leakage controls.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the data leakage between splits deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The evaluation split is demonstrably independent under the chosen leakage controls.

This response relates instead to integration and end-to-end tests, for which an example concern is: A model passes unit tests but the live application passes the wrong input field and silently reverses classifications. It could be useful in that different situation, but it would not directly address the data leakage between splits deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The evaluation split is demonstrably independent under the chosen leakage controls.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported data leakage between splits issue at a professional services group in London, the relevant corrective action is: Prevent train-test leakage with appropriate entity- and time-aware data partitioning. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported data leakage between splits issue at a professional services group in London, the relevant corrective action is: Prevent train-test leakage with appropriate entity- and time-aware data partitioning. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy-preserving data treatment, a distinct governance need illustrated by: A team keeps full identifiable transcripts in an experimental dataset despite the ability to meet its goal with less personal detail. For the reported data leakage between splits issue at a professional services group in London, the relevant corrective action is: Prevent train-test leakage with appropriate entity- and time-aware data partitioning. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the agentic red-team testing deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Adversarial tests demonstrate containment of unsafe tool requests and documented fixes.

This response relates instead to monitoring ownership, for which an example concern is: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. It could be useful in that different situation, but it would not directly address the agentic red-team testing deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Adversarial tests demonstrate containment of unsafe tool requests and documented fixes.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the agentic red-team testing deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Adversarial tests demonstrate containment of unsafe tool requests and documented fixes.

This result would support deployment operating procedure, a distinct governance need illustrated by: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. For the reported agentic red-team testing issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Retest prompt injection, permission escalation, tool misuse, and cross-agent propagation. The offered observation does not establish whether that targeted control succeeded.

This result would support localization control, a distinct governance need illustrated by: A system is lawful in one region but its operating constraints are unsuitable in a newly entered jurisdiction. For the reported agentic red-team testing issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Retest prompt injection, permission escalation, tool misuse, and cross-agent propagation. The offered observation does not establish whether that targeted control succeeded.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported agentic red-team testing issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Retest prompt injection, permission escalation, tool misuse, and cross-agent propagation. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to board-level oversight, for which an example concern is: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. It could be useful in that different situation, but it would not directly address the cross-functional review deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: Governance meeting records capture diverse review findings and accountable resolutions.

This response relates instead to stakeholder engagement, for which an example concern is: A service is designed for vulnerable users while no representatives of the affected community participate in requirements or review. It could be useful in that different situation, but it would not directly address the cross-functional review deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: Governance meeting records capture diverse review findings and accountable resolutions.

This response relates instead to enterprise inventory ownership, for which an example concern is: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. It could be useful in that different situation, but it would not directly address the cross-functional review deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: Governance meeting records capture diverse review findings and accountable resolutions.

This result would support stakeholder engagement, a distinct governance need illustrated by: A service is designed for vulnerable users while no representatives of the affected community participate in requirements or review. For the reported cross-functional review issue at a banking group in Zurich, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported cross-functional review issue at a banking group in Zurich, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.

This result would support named decision owner, a distinct governance need illustrated by: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. For the reported cross-functional review issue at a banking group in Zurich, the relevant corrective action is: Require cross-functional review involving technical, legal, privacy, risk, and affected business perspectives. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to product safety liability, for which an example concern is: A manufacturer integrates AI into a safety device but evaluates only the vendor's standalone model accuracy. It could be useful in that different situation, but it would not directly address the copyright in training data deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The provenance log records rights or applicable legal justification for each copyrighted source class.

This response relates instead to housing access equality, for which an example concern is: A property service uses a ranking algorithm that could disadvantage protected applicants and claims general AI policies are enough. It could be useful in that different situation, but it would not directly address the copyright in training data deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The provenance log records rights or applicable legal justification for each copyrighted source class.

This response relates instead to confidential business material, for which an example concern is: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. It could be useful in that different situation, but it would not directly address the copyright in training data deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The provenance log records rights or applicable legal justification for each copyrighted source class.

This result would support legal regime inventory, a distinct governance need illustrated by: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. For the reported copyright in training data issue at a global platform operator in Berlin, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.

This result would support insurance underwriting fairness, a distinct governance need illustrated by: An insurer approves a pricing model without considering whether sensitive proxies violate applicable insurance discrimination rules. For the reported copyright in training data issue at a global platform operator in Berlin, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported copyright in training data issue at a global platform operator in Berlin, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.