Exam Bundle

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported service availability contract issue at a large multibranch organization in Oslo, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported service availability contract issue at a large multibranch organization in Oslo, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported service availability contract issue at a large multibranch organization in Oslo, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the impact assessment in design deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Requirements and mitigation records trace to assessed impacts on relevant groups.

This response relates instead to evaluation-threshold setting, for which an example concern is: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. It could be useful in that different situation, but it would not directly address the impact assessment in design deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Requirements and mitigation records trace to assessed impacts on relevant groups.

This response relates instead to model selection trade-offs, for which an example concern is: A team chooses a very large generative model for a small deterministic lookup without comparing alternatives. It could be useful in that different situation, but it would not directly address the impact assessment in design deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Requirements and mitigation records trace to assessed impacts on relevant groups.

This result would support design decision trace, a distinct governance need illustrated by: The model team cannot explain why a sensitive input feature was retained after a privacy objection. For the reported impact assessment in design issue at a regional technology consortium in Auckland, the relevant corrective action is: Conduct an early AI impact assessment and feed its findings into requirements and architecture. The offered observation does not establish whether that targeted control succeeded.

This result would support pilot containment, a distinct governance need illustrated by: A new autonomous agent is rolled out to every customer after a lab test without staged exposure limits. For the reported impact assessment in design issue at a regional technology consortium in Auckland, the relevant corrective action is: Conduct an early AI impact assessment and feed its findings into requirements and architecture. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported impact assessment in design issue at a regional technology consortium in Auckland, the relevant corrective action is: Conduct an early AI impact assessment and feed its findings into requirements and architecture. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the nist map function deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: A context map links the use case to affected groups, constraints, and foreseeable harms.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the nist map function deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: A context map links the use case to affected groups, constraints, and foreseeable harms.

This response relates instead to nist measure function, for which an example concern is: A system's risks are discussed qualitatively but no evaluation method or measurable evidence has been selected. It could be useful in that different situation, but it would not directly address the nist map function deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: A context map links the use case to affected groups, constraints, and foreseeable harms.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported nist map function issue at a regional service provider in Singapore, the relevant corrective action is: Use the NIST AI RMF Map function to define context, stakeholders, purpose, and potential impacts. The offered observation does not establish whether that targeted control succeeded.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported nist map function issue at a regional service provider in Singapore, the relevant corrective action is: Use the NIST AI RMF Map function to define context, stakeholders, purpose, and potential impacts. The offered observation does not establish whether that targeted control succeeded.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported nist map function issue at a regional service provider in Singapore, the relevant corrective action is: Use the NIST AI RMF Map function to define context, stakeholders, purpose, and potential impacts. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the maintenance after drift deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Monitoring thresholds cause timely retraining review or deactivation with documented decisions.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the maintenance after drift deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Monitoring thresholds cause timely retraining review or deactivation with documented decisions.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the maintenance after drift deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Monitoring thresholds cause timely retraining review or deactivation with documented decisions.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported maintenance after drift issue at a large multibranch organization in Oslo, the relevant corrective action is: Connect performance-drift triggers to controlled reassessment, updating, or suspension. The offered observation does not establish whether that targeted control succeeded.

This result would support monitoring ownership, a distinct governance need illustrated by: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. For the reported maintenance after drift issue at a large multibranch organization in Oslo, the relevant corrective action is: Connect performance-drift triggers to controlled reassessment, updating, or suspension. The offered observation does not establish whether that targeted control succeeded.

This result would support production fairness monitoring, a distinct governance need illustrated by: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. For the reported maintenance after drift issue at a large multibranch organization in Oslo, the relevant corrective action is: Connect performance-drift triggers to controlled reassessment, updating, or suspension. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to privacy-preserving data treatment, for which an example concern is: A team keeps full identifiable transcripts in an experimental dataset despite the ability to meet its goal with less personal detail. It could be useful in that different situation, but it would not directly address the bias mitigation validation deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Post-mitigation testing documents trade-offs, group outcomes, and residual impacts.

This response relates instead to model interpretability checks, for which an example concern is: A risk-scoring tool is deployed with generic feature-importance plots that have not been tested for stability or usefulness. It could be useful in that different situation, but it would not directly address the bias mitigation validation deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Post-mitigation testing documents trade-offs, group outcomes, and residual impacts.

This response relates instead to representative sampling, for which an example concern is: A voice model trained almost entirely on one accent is marketed as equally reliable for all language communities. It could be useful in that different situation, but it would not directly address the bias mitigation validation deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Post-mitigation testing documents trade-offs, group outcomes, and residual impacts.

This result would support integration and end-to-end tests, a distinct governance need illustrated by: A model passes unit tests but the live application passes the wrong input field and silently reverses classifications. For the reported bias mitigation validation issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Re-evaluate fairness and overall utility after mitigation across all relevant groups. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported bias mitigation validation issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Re-evaluate fairness and overall utility after mitigation across all relevant groups. The offered observation does not establish whether that targeted control succeeded.

This result would support representative sampling, a distinct governance need illustrated by: A voice model trained almost entirely on one accent is marketed as equally reliable for all language communities. For the reported bias mitigation validation issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Re-evaluate fairness and overall utility after mitigation across all relevant groups. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to named decision owner, for which an example concern is: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. It could be useful in that different situation, but it would not directly address the supplier-vs-deployer expectations deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Contractual and operating documents assign distinct responsibilities without leaving deployment gaps.

This response relates instead to governance change management, for which an example concern is: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. It could be useful in that different situation, but it would not directly address the supplier-vs-deployer expectations deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Contractual and operating documents assign distinct responsibilities without leaving deployment gaps.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the supplier-vs-deployer expectations deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Contractual and operating documents assign distinct responsibilities without leaving deployment gaps.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported supplier-vs-deployer expectations issue at a professional services group in London, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported supplier-vs-deployer expectations issue at a professional services group in London, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported supplier-vs-deployer expectations issue at a professional services group in London, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.