Exam Bundle

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported supplier-vs-deployer expectations issue at a professional services group in London, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported supplier-vs-deployer expectations issue at a professional services group in London, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported supplier-vs-deployer expectations issue at a professional services group in London, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to iso terminology and impact scope, for which an example concern is: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. It could be useful in that different situation, but it would not directly address the oecd trustworthy ai principles deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The governance crosswalk uses the principles for internal controls without inventing compulsory certification.

This response relates instead to iso 42001 aims, for which an example concern is: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. It could be useful in that different situation, but it would not directly address the oecd trustworthy ai principles deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The governance crosswalk uses the principles for internal controls without inventing compulsory certification.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the oecd trustworthy ai principles deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: The governance crosswalk uses the principles for internal controls without inventing compulsory certification.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported oecd trustworthy ai principles issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Treat the OECD AI Principles as nonbinding guidance for transparency, fairness, robustness, and accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported oecd trustworthy ai principles issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Treat the OECD AI Principles as nonbinding guidance for transparency, fairness, robustness, and accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported oecd trustworthy ai principles issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Treat the OECD AI Principles as nonbinding guidance for transparency, fairness, robustness, and accountability. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the safe rollback operations deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: A rehearsal restores the approved baseline and records recovery decisions and timing.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the safe rollback operations deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: A rehearsal restores the approved baseline and records recovery decisions and timing.

This response relates instead to retraining governance, for which an example concern is: Automated retraining replaces models weekly without any checks that changes reduce bias or preserve required safety. It could be useful in that different situation, but it would not directly address the safe rollback operations deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: A rehearsal restores the approved baseline and records recovery decisions and timing.

This result would support release-readiness evidence, a distinct governance need illustrated by: A new model is promoted into production while safety-test failures and unresolved critical issues remain undocumented. For the reported safe rollback operations issue at an international services company in Helsinki, the relevant corrective action is: Implement and exercise controlled rollback and incident containment for AI releases. The offered observation does not establish whether that targeted control succeeded.

This result would support versioned release artifacts, a distinct governance need illustrated by: The team cannot tell whether production serves the approved model version or an experimental checkpoint. For the reported safe rollback operations issue at an international services company in Helsinki, the relevant corrective action is: Implement and exercise controlled rollback and incident containment for AI releases. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported safe rollback operations issue at an international services company in Helsinki, the relevant corrective action is: Implement and exercise controlled rollback and incident containment for AI releases. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the small versus large model deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Representative device tests establish workable performance and manageable operational cost.

This response relates instead to proprietary vendor model, for which an example concern is: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. It could be useful in that different situation, but it would not directly address the small versus large model deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Representative device tests establish workable performance and manageable operational cost.

This response relates instead to edge inference suitability, for which an example concern is: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. It could be useful in that different situation, but it would not directly address the small versus large model deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Representative device tests establish workable performance and manageable operational cost.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported small versus large model issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assess smaller and larger model trade-offs against latency, compute, privacy, and quality needs. The offered observation does not establish whether that targeted control succeeded.

This result would support edge inference suitability, a distinct governance need illustrated by: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. For the reported small versus large model issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assess smaller and larger model trade-offs against latency, compute, privacy, and quality needs. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported small versus large model issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assess smaller and larger model trade-offs against latency, compute, privacy, and quality needs. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to use-case assessment, for which an example concern is: Business units select models first and only later ask whether automation fits the actual problem or creates new risks. It could be useful in that different situation, but it would not directly address the documentation and traceability deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: An audit reconstructs the applicable model, controls, and responsible decision-maker.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the documentation and traceability deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: An audit reconstructs the applicable model, controls, and responsible decision-maker.

This response relates instead to privacy/security policy integration, for which an example concern is: A security team treats model prompts as outside existing access-control and data-retention policies. It could be useful in that different situation, but it would not directly address the documentation and traceability deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: An audit reconstructs the applicable model, controls, and responsible decision-maker.

This result would support use-case assessment, a distinct governance need illustrated by: Business units select models first and only later ask whether automation fits the actual problem or creates new risks. For the reported documentation and traceability issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require versioned documentation and logging of system changes, inputs, review, and decision provenance. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy/security policy integration, a distinct governance need illustrated by: A security team treats model prompts as outside existing access-control and data-retention policies. For the reported documentation and traceability issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require versioned documentation and logging of system changes, inputs, review, and decision provenance. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported documentation and traceability issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Require versioned documentation and logging of system changes, inputs, review, and decision provenance. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the training-data governance duty deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Dataset documentation addresses data relevance, error checks, limitations, and selected mitigation.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the training-data governance duty deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Dataset documentation addresses data relevance, error checks, limitations, and selected mitigation.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the training-data governance duty deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Dataset documentation addresses data relevance, error checks, limitations, and selected mitigation.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported training-data governance duty issue at a global platform operator in Berlin, the relevant corrective action is: Set risk-appropriate data governance and dataset-quality procedures for the regulated system. The offered observation does not establish whether that targeted control succeeded.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported training-data governance duty issue at a global platform operator in Berlin, the relevant corrective action is: Set risk-appropriate data governance and dataset-quality procedures for the regulated system. The offered observation does not establish whether that targeted control succeeded.

This result would support human oversight requirements, a distinct governance need illustrated by: A regulated high-risk model advises caseworkers, but they lack training or the practical authority to reject erroneous outputs. For the reported training-data governance duty issue at a global platform operator in Berlin, the relevant corrective action is: Set risk-appropriate data governance and dataset-quality procedures for the regulated system. The offered observation does not establish whether that targeted control succeeded.