Exam Bundle

This result would support legal regime inventory, a distinct governance need illustrated by: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. For the reported copyright in training data issue at a global platform operator in Berlin, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.

This result would support insurance underwriting fairness, a distinct governance need illustrated by: An insurer approves a pricing model without considering whether sensitive proxies violate applicable insurance discrimination rules. For the reported copyright in training data issue at a global platform operator in Berlin, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported copyright in training data issue at a global platform operator in Berlin, the relevant corrective action is: Assess intellectual-property rights, permissions, and applicable exceptions before training-data ingestion. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proprietary vendor model, for which an example concern is: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. It could be useful in that different situation, but it would not directly address the agentic orchestration risk deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Simulations show unauthorized actions and cascading tool failures are bounded and recoverable.

This response relates instead to edge inference suitability, for which an example concern is: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. It could be useful in that different situation, but it would not directly address the agentic orchestration risk deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Simulations show unauthorized actions and cascading tool failures are bounded and recoverable.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the agentic orchestration risk deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Simulations show unauthorized actions and cascading tool failures are bounded and recoverable.

This result would support edge inference suitability, a distinct governance need illustrated by: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. For the reported agentic orchestration risk issue at a regional service provider in Singapore, the relevant corrective action is: Assess agentic autonomy, tool permissions, approval checkpoints, and containment before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported agentic orchestration risk issue at a regional service provider in Singapore, the relevant corrective action is: Assess agentic autonomy, tool permissions, approval checkpoints, and containment before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported agentic orchestration risk issue at a regional service provider in Singapore, the relevant corrective action is: Assess agentic autonomy, tool permissions, approval checkpoints, and containment before deployment. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to impact assessment in design, for which an example concern is: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. It could be useful in that different situation, but it would not directly address the evaluation-threshold setting deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Acceptance tests compare held-out outcomes with documented approval criteria.

This response relates instead to model selection trade-offs, for which an example concern is: A team chooses a very large generative model for a small deterministic lookup without comparing alternatives. It could be useful in that different situation, but it would not directly address the evaluation-threshold setting deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Acceptance tests compare held-out outcomes with documented approval criteria.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the evaluation-threshold setting deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: Acceptance tests compare held-out outcomes with documented approval criteria.

This result would support design decision trace, a distinct governance need illustrated by: The model team cannot explain why a sensitive input feature was retained after a privacy objection. For the reported evaluation-threshold setting issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Define measurable predeployment thresholds for accuracy, fairness, robustness, and safety appropriate to impact. The offered observation does not establish whether that targeted control succeeded.

This result would support pilot containment, a distinct governance need illustrated by: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. For the reported evaluation-threshold setting issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Define measurable predeployment thresholds for accuracy, fairness, robustness, and safety appropriate to impact. The offered observation does not establish whether that targeted control succeeded.

This result would support human oversight by design, a distinct governance need illustrated by: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. For the reported evaluation-threshold setting issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Define measurable predeployment thresholds for accuracy, fairness, robustness, and safety appropriate to impact. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to product safety liability, for which an example concern is: A manufacturer integrates AI into a safety device but evaluates only the vendor's standalone model accuracy. It could be useful in that different situation, but it would not directly address the legal regime inventory deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: The compliance register identifies overlapping duties and assigns owners for each applicable law.

This response relates instead to credit fairness, for which an example concern is: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. It could be useful in that different situation, but it would not directly address the legal regime inventory deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: The compliance register identifies overlapping duties and assigns owners for each applicable law.

This response relates instead to insurance underwriting fairness, for which an example concern is: An insurer approves a pricing model without considering whether sensitive proxies violate applicable insurance discrimination rules. It could be useful in that different situation, but it would not directly address the legal regime inventory deficiency reported at a property services provider in Boston. The targeted acceptance criterion here is: The compliance register identifies overlapping duties and assigns owners for each applicable law.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported legal regime inventory issue at a property services provider in Boston, the relevant corrective action is: Map all applicable legal regimes and obligations by market, data, product, and use case. The offered observation does not establish whether that targeted control succeeded.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported legal regime inventory issue at a property services provider in Boston, the relevant corrective action is: Map all applicable legal regimes and obligations by market, data, product, and use case. The offered observation does not establish whether that targeted control succeeded.

This result would support credit fairness, a distinct governance need illustrated by: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. For the reported legal regime inventory issue at a property services provider in Boston, the relevant corrective action is: Map all applicable legal regimes and obligations by market, data, product, and use case. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the human review policy deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Drills demonstrate timely override, safe rejection, and accountable escalation of model outcomes.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the human review policy deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Drills demonstrate timely override, safe rejection, and accountable escalation of model outcomes.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the human review policy deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Drills demonstrate timely override, safe rejection, and accountable escalation of model outcomes.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported human review policy issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Specify meaningful human oversight with competent reviewers, intervention powers, and escalation rules. The offered observation does not establish whether that targeted control succeeded.

This result would support ai incident response, a distinct governance need illustrated by: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. For the reported human review policy issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Specify meaningful human oversight with competent reviewers, intervention powers, and escalation rules. The offered observation does not establish whether that targeted control succeeded.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported human review policy issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Specify meaningful human oversight with competent reviewers, intervention powers, and escalation rules. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the service availability contract deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The contract specifies measurable availability, recovery, and escalation expectations.

This response relates instead to vendor training-data terms, for which an example concern is: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. It could be useful in that different situation, but it would not directly address the service availability contract deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The contract specifies measurable availability, recovery, and escalation expectations.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the service availability contract deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The contract specifies measurable availability, recovery, and escalation expectations.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported service availability contract issue at a large multibranch organization in Oslo, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported service availability contract issue at a large multibranch organization in Oslo, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported service availability contract issue at a large multibranch organization in Oslo, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.