Exam Bundle

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported sensitive biometric data issue at a regional service provider in Singapore, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This result would support purpose limitation, a distinct governance need illustrated by: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. For the reported sensitive biometric data issue at a regional service provider in Singapore, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported sensitive biometric data issue at a regional service provider in Singapore, the relevant corrective action is: Determine whether special-category rules and additional safeguards apply before processing biometric data. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the end-of-life and archival controls deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Verification confirms retired integrations no longer process live data and required records remain governed.

This response relates instead to threat modeling new data flow, for which an example concern is: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. It could be useful in that different situation, but it would not directly address the end-of-life and archival controls deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Verification confirms retired integrations no longer process live data and required records remain governed.

This response relates instead to incident containment, for which an example concern is: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. It could be useful in that different situation, but it would not directly address the end-of-life and archival controls deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Verification confirms retired integrations no longer process live data and required records remain governed.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported end-of-life and archival controls issue at a regional service provider in Singapore, the relevant corrective action is: Execute a coordinated retirement checklist covering interfaces, access, records, and retention. The offered observation does not establish whether that targeted control succeeded.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported end-of-life and archival controls issue at a regional service provider in Singapore, the relevant corrective action is: Execute a coordinated retirement checklist covering interfaces, access, records, and retention. The offered observation does not establish whether that targeted control succeeded.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported end-of-life and archival controls issue at a regional service provider in Singapore, the relevant corrective action is: Execute a coordinated retirement checklist covering interfaces, access, records, and retention. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the data-use rights deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Dataset intake records include rights assessment and prohibited-use constraints.

This response relates instead to dataset provenance, for which an example concern is: Training files have been merged from several suppliers with no trace of which sources contain disputed records. It could be useful in that different situation, but it would not directly address the data-use rights deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Dataset intake records include rights assessment and prohibited-use constraints.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the data-use rights deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Dataset intake records include rights assessment and prohibited-use constraints.

This result would support label-quality audit, a distinct governance need illustrated by: Moderators disagree about which examples are harmful, yet the team treats all labels as flawless ground truth. For the reported data-use rights issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Check rights, permissions, and lawful usage limits before incorporating datasets into training. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported data-use rights issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Check rights, permissions, and lawful usage limits before incorporating datasets into training. The offered observation does not establish whether that targeted control succeeded.

This result would support representative sampling, a distinct governance need illustrated by: A voice model trained almost entirely on one accent is marketed as equally reliable for all language communities. For the reported data-use rights issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Check rights, permissions, and lawful usage limits before incorporating datasets into training. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the nist govern function deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Responsibilities, policies, and accountability mechanisms are established across the AI lifecycle.

This response relates instead to nist measure function, for which an example concern is: A system's risks are discussed qualitatively but no evaluation method or measurable evidence has been selected. It could be useful in that different situation, but it would not directly address the nist govern function deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Responsibilities, policies, and accountability mechanisms are established across the AI lifecycle.

This response relates instead to nist map function, for which an example concern is: A team collects model metrics without first establishing whom the system affects or what its deployment context is. It could be useful in that different situation, but it would not directly address the nist govern function deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Responsibilities, policies, and accountability mechanisms are established across the AI lifecycle.

This result would support nist manage function, a distinct governance need illustrated by: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. For the reported nist govern function issue at a large multibranch organization in Oslo, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported nist govern function issue at a large multibranch organization in Oslo, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported nist govern function issue at a large multibranch organization in Oslo, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the opaque decision impacts deficiency reported at a local authority in Bristol. The targeted acceptance criterion here is: Affected individuals receive understandable reasons or explanations and a usable review channel.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the opaque decision impacts deficiency reported at a local authority in Bristol. The targeted acceptance criterion here is: Affected individuals receive understandable reasons or explanations and a usable review channel.

This response relates instead to data dependency and drift, for which an example concern is: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. It could be useful in that different situation, but it would not directly address the opaque decision impacts deficiency reported at a local authority in Bristol. The targeted acceptance criterion here is: Affected individuals receive understandable reasons or explanations and a usable review channel.

This result would support data dependency and drift, a distinct governance need illustrated by: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. For the reported opaque decision impacts issue at a local authority in Bristol, the relevant corrective action is: Set transparency and contestability requirements appropriate to the decision impact and applicable law. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported opaque decision impacts issue at a local authority in Bristol, the relevant corrective action is: Set transparency and contestability requirements appropriate to the decision impact and applicable law. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported opaque decision impacts issue at a local authority in Bristol, the relevant corrective action is: Set transparency and contestability requirements appropriate to the decision impact and applicable law. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the deactivation authority deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: A kill-switch exercise shows an authorized responder can disable the unsafe capability promptly.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the deactivation authority deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: A kill-switch exercise shows an authorized responder can disable the unsafe capability promptly.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the deactivation authority deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: A kill-switch exercise shows an authorized responder can disable the unsafe capability promptly.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported deactivation authority issue at a global platform operator in Berlin, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.

This result would support incident containment, a distinct governance need illustrated by: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. For the reported deactivation authority issue at a global platform operator in Berlin, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.

This result would support human override in practice, a distinct governance need illustrated by: An automated decision tool has an override button, but users are penalized for clicking it and cannot access explanations. For the reported deactivation authority issue at a global platform operator in Berlin, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.