Exam Bundle

This result would support open-source license review, a distinct governance need illustrated by: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. For the reported deployment fit assessment issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported deployment fit assessment issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.

This result would support proprietary vendor model, a distinct governance need illustrated by: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. For the reported deployment fit assessment issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to benchmark relevance, for which an example concern is: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. It could be useful in that different situation, but it would not directly address the architecture security review deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Architecture tests demonstrate bounded tool access and blocked data-exfiltration paths.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the architecture security review deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Architecture tests demonstrate bounded tool access and blocked data-exfiltration paths.

This response relates instead to human oversight by design, for which an example concern is: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. It could be useful in that different situation, but it would not directly address the architecture security review deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Architecture tests demonstrate bounded tool access and blocked data-exfiltration paths.

This result would support human oversight by design, a distinct governance need illustrated by: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. For the reported architecture security review issue at a large multibranch organization in Oslo, the relevant corrective action is: Perform threat modeling and least-privilege architectural review before connecting AI to tools. The offered observation does not establish whether that targeted control succeeded.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported architecture security review issue at a large multibranch organization in Oslo, the relevant corrective action is: Perform threat modeling and least-privilege architectural review before connecting AI to tools. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported architecture security review issue at a large multibranch organization in Oslo, the relevant corrective action is: Perform threat modeling and least-privilege architectural review before connecting AI to tools. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to data minimization, for which an example concern is: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. It could be useful in that different situation, but it would not directly address the third-party processor controls deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The executed agreement and oversight plan cover processing instructions, assistance, and incident notification.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the third-party processor controls deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The executed agreement and oversight plan cover processing instructions, assistance, and incident notification.

This response relates instead to automated decisions and contestability, for which an example concern is: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. It could be useful in that different situation, but it would not directly address the third-party processor controls deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The executed agreement and oversight plan cover processing instructions, assistance, and incident notification.

This result would support purpose limitation, a distinct governance need illustrated by: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. For the reported third-party processor controls issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish suitable processor terms, instructions, security measures, and monitoring where a processor relationship exists. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported third-party processor controls issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish suitable processor terms, instructions, security measures, and monitoring where a processor relationship exists. The offered observation does not establish whether that targeted control succeeded.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported third-party processor controls issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish suitable processor terms, instructions, security measures, and monitoring where a processor relationship exists. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the deployment fit assessment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The deployment case documents measurable requirements, data fit, and operational constraints.

This response relates instead to multimodal capability decision, for which an example concern is: A document workflow requires understanding diagrams and photographs, but procurement tests only text-only model capability. It could be useful in that different situation, but it would not directly address the deployment fit assessment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The deployment case documents measurable requirements, data fit, and operational constraints.

This response relates instead to agentic orchestration risk, for which an example concern is: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. It could be useful in that different situation, but it would not directly address the deployment fit assessment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The deployment case documents measurable requirements, data fit, and operational constraints.

This result would support open-source license review, a distinct governance need illustrated by: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. For the reported deployment fit assessment issue at an international services company in Helsinki, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.

This result would support proprietary vendor model, a distinct governance need illustrated by: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. For the reported deployment fit assessment issue at an international services company in Helsinki, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported deployment fit assessment issue at an international services company in Helsinki, the relevant corrective action is: Evaluate deployment objectives, stakeholder needs, workforce readiness, and acceptable performance before acquisition. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the external transparency materials deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Recipients receive usable descriptions of permitted use, known risks, and escalation paths.

This response relates instead to feedback-to-maintenance loop, for which an example concern is: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. It could be useful in that different situation, but it would not directly address the external transparency materials deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Recipients receive usable descriptions of permitted use, known risks, and escalation paths.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the external transparency materials deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Recipients receive usable descriptions of permitted use, known risks, and escalation paths.

This result would support incident classification, a distinct governance need illustrated by: An AI response causes an unsafe operational action, but support treats it as a cosmetic content-quality bug. For the reported external transparency materials issue at a regional service provider in Singapore, the relevant corrective action is: Supply required use instructions and transparent system documentation appropriate to the applicable role. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported external transparency materials issue at a regional service provider in Singapore, the relevant corrective action is: Supply required use instructions and transparent system documentation appropriate to the applicable role. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported external transparency materials issue at a regional service provider in Singapore, the relevant corrective action is: Supply required use instructions and transparent system documentation appropriate to the applicable role. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to lifecycle gate policy, for which an example concern is: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. It could be useful in that different situation, but it would not directly address the privacy/security policy integration deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Policy review traces AI-specific data flows to controls, owners, and retention limits.

This response relates instead to third-party procurement due diligence, for which an example concern is: Procurement buys a model API based only on its benchmark score without reviewing data reuse or subcontractor risks. It could be useful in that different situation, but it would not directly address the privacy/security policy integration deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Policy review traces AI-specific data flows to controls, owners, and retention limits.

This response relates instead to documentation and traceability, for which an example concern is: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. It could be useful in that different situation, but it would not directly address the privacy/security policy integration deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Policy review traces AI-specific data flows to controls, owners, and retention limits.

This result would support retirement and disposal, a distinct governance need illustrated by: A discontinued predictive service remains callable with old credentials and retained training data after business shutdown. For the reported privacy/security policy integration issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Extend existing privacy, security, and data-governance controls to AI inputs, logs, outputs, and service integrations. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported privacy/security policy integration issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Extend existing privacy, security, and data-governance controls to AI inputs, logs, outputs, and service integrations. The offered observation does not establish whether that targeted control succeeded.

This result would support documentation and traceability, a distinct governance need illustrated by: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. For the reported privacy/security policy integration issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Extend existing privacy, security, and data-governance controls to AI inputs, logs, outputs, and service integrations. The offered observation does not establish whether that targeted control succeeded.