Exam Bundle

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported training-data governance duty issue at a global platform operator in Berlin, the relevant corrective action is: Set risk-appropriate data governance and dataset-quality procedures for the regulated system. The offered observation does not establish whether that targeted control succeeded.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported training-data governance duty issue at a global platform operator in Berlin, the relevant corrective action is: Set risk-appropriate data governance and dataset-quality procedures for the regulated system. The offered observation does not establish whether that targeted control succeeded.

This result would support human oversight requirements, a distinct governance need illustrated by: A regulated high-risk model advises caseworkers, but they lack training or the practical authority to reject erroneous outputs. For the reported training-data governance duty issue at a global platform operator in Berlin, the relevant corrective action is: Set risk-appropriate data governance and dataset-quality procedures for the regulated system. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to safety and reliability monitoring, for which an example concern is: An AI-powered workflow is monitored only for uptime while harmful errors can occur even when the service is available. It could be useful in that different situation, but it would not directly address the near-miss reporting deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The incident program records near misses and changes safeguards before repeat harm.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the near-miss reporting deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The incident program records near misses and changes safeguards before repeat harm.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the near-miss reporting deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The incident program records near misses and changes safeguards before repeat harm.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported near-miss reporting issue at an international services company in Helsinki, the relevant corrective action is: Capture and analyze AI near misses as leading indicators for prevention. The offered observation does not establish whether that targeted control succeeded.

This result would support safety and reliability monitoring, a distinct governance need illustrated by: An AI-powered workflow is monitored only for uptime while harmful errors can occur even when the service is available. For the reported near-miss reporting issue at an international services company in Helsinki, the relevant corrective action is: Capture and analyze AI near misses as leading indicators for prevention. The offered observation does not establish whether that targeted control succeeded.

This result would support production fairness monitoring, a distinct governance need illustrated by: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. For the reported near-miss reporting issue at an international services company in Helsinki, the relevant corrective action is: Capture and analyze AI near misses as leading indicators for prevention. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to benchmark relevance, for which an example concern is: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. It could be useful in that different situation, but it would not directly address the pilot containment deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Pilot records show controlled participants, measured outcomes, and stop criteria.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the pilot containment deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Pilot records show controlled participants, measured outcomes, and stop criteria.

This response relates instead to architecture security review, for which an example concern is: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. It could be useful in that different situation, but it would not directly address the pilot containment deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Pilot records show controlled participants, measured outcomes, and stop criteria.

This result would support impact assessment in design, a distinct governance need illustrated by: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. For the reported pilot containment issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Run a bounded pilot with risk limits, monitoring, and safe rollback before broad release. The offered observation does not establish whether that targeted control succeeded.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported pilot containment issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Run a bounded pilot with risk limits, monitoring, and safe rollback before broad release. The offered observation does not establish whether that targeted control succeeded.

This result would support human oversight by design, a distinct governance need illustrated by: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. For the reported pilot containment issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Run a bounded pilot with risk limits, monitoring, and safe rollback before broad release. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to legal regime inventory, for which an example concern is: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. It could be useful in that different situation, but it would not directly address the product safety liability deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Product validation tests end-to-end safety and documents mitigations for foreseeable misuse.

This response relates instead to copyright in training data, for which an example concern is: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. It could be useful in that different situation, but it would not directly address the product safety liability deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Product validation tests end-to-end safety and documents mitigations for foreseeable misuse.

This response relates instead to housing access equality, for which an example concern is: A property service uses a ranking algorithm that could disadvantage protected applicants and claims general AI policies are enough. It could be useful in that different situation, but it would not directly address the product safety liability deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Product validation tests end-to-end safety and documents mitigations for foreseeable misuse.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported product safety liability issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess foreseeable product-level defects and safety risks from the integrated AI system. The offered observation does not establish whether that targeted control succeeded.

This result would support credit fairness, a distinct governance need illustrated by: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. For the reported product safety liability issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess foreseeable product-level defects and safety risks from the integrated AI system. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported product safety liability issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Assess foreseeable product-level defects and safety risks from the integrated AI system. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the human review policy deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Drills demonstrate timely override, safe rejection, and accountable escalation of model outcomes.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the human review policy deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Drills demonstrate timely override, safe rejection, and accountable escalation of model outcomes.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the human review policy deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Drills demonstrate timely override, safe rejection, and accountable escalation of model outcomes.

This result would support ai incident response, a distinct governance need illustrated by: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. For the reported human review policy issue at a software services vendor in Lisbon, the relevant corrective action is: Specify meaningful human oversight with competent reviewers, intervention powers, and escalation rules. The offered observation does not establish whether that targeted control succeeded.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported human review policy issue at a software services vendor in Lisbon, the relevant corrective action is: Specify meaningful human oversight with competent reviewers, intervention powers, and escalation rules. The offered observation does not establish whether that targeted control succeeded.

This result would support risk register treatment, a distinct governance need illustrated by: Teams list privacy and bias risks but never assign control owners, due dates, or reassessment triggers. For the reported human review policy issue at a software services vendor in Lisbon, the relevant corrective action is: Specify meaningful human oversight with competent reviewers, intervention powers, and escalation rules. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to multimodal capability decision, for which an example concern is: A document workflow requires understanding diagrams and photographs, but procurement tests only text-only model capability. It could be useful in that different situation, but it would not directly address the deployment fit assessment deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The deployment case documents measurable requirements, data fit, and operational constraints.

This response relates instead to agentic orchestration risk, for which an example concern is: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. It could be useful in that different situation, but it would not directly address the deployment fit assessment deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The deployment case documents measurable requirements, data fit, and operational constraints.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the deployment fit assessment deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The deployment case documents measurable requirements, data fit, and operational constraints.

This result would support open-source license review, a distinct governance need illustrated by: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. For the reported deployment fit assessment issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported deployment fit assessment issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.

This result would support proprietary vendor model, a distinct governance need illustrated by: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. For the reported deployment fit assessment issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.