Exam Bundle

This result would support insurance underwriting fairness, a distinct governance need illustrated by: An insurer approves a pricing model without considering whether sensitive proxies violate applicable insurance discrimination rules. For the reported consumer deception issue at a technology services group in Stockholm, the relevant corrective action is: Require accurate marketing and output claims and prevent deceptive representations of AI capability. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported consumer deception issue at a technology services group in Stockholm, the relevant corrective action is: Require accurate marketing and output claims and prevent deceptive representations of AI capability. The offered observation does not establish whether that targeted control succeeded.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported consumer deception issue at a technology services group in Stockholm, the relevant corrective action is: Require accurate marketing and output claims and prevent deceptive representations of AI capability. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to near-miss reporting, for which an example concern is: Users report several close calls where an AI system nearly caused harm, but incidents are recorded only when actual loss occurs. It could be useful in that different situation, but it would not directly address the safety and reliability monitoring deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Dashboards show relevant error, harm, and reliability measures and trigger incident response.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the safety and reliability monitoring deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Dashboards show relevant error, harm, and reliability measures and trigger incident response.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the safety and reliability monitoring deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Dashboards show relevant error, harm, and reliability measures and trigger incident response.

This result would support near-miss reporting, a distinct governance need illustrated by: Users report several close calls where an AI system nearly caused harm, but incidents are recorded only when actual loss occurs. For the reported safety and reliability monitoring issue at a global platform operator in Berlin, the relevant corrective action is: Monitor outcome quality and safety indicators alongside operational reliability. The offered observation does not establish whether that targeted control succeeded.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported safety and reliability monitoring issue at a global platform operator in Berlin, the relevant corrective action is: Monitor outcome quality and safety indicators alongside operational reliability. The offered observation does not establish whether that targeted control succeeded.

This result would support incident containment, a distinct governance need illustrated by: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. For the reported safety and reliability monitoring issue at a global platform operator in Berlin, the relevant corrective action is: Monitor outcome quality and safety indicators alongside operational reliability. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the integration and end-to-end tests deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Integration cases prove that intended inputs produce correctly routed authorized outcomes.

This response relates instead to data leakage between splits, for which an example concern is: The same customer's near-identical records appear in both training and evaluation datasets, inflating model performance. It could be useful in that different situation, but it would not directly address the integration and end-to-end tests deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Integration cases prove that intended inputs produce correctly routed authorized outcomes.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the integration and end-to-end tests deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Integration cases prove that intended inputs produce correctly routed authorized outcomes.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported integration and end-to-end tests issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Test the complete AI system including connectors, preprocessing, interfaces, and downstream decisions. The offered observation does not establish whether that targeted control succeeded.

This result would support training experiment reproducibility, a distinct governance need illustrated by: A model's excellent benchmark score cannot be recreated because seeds, dataset versions, and hyperparameters were not recorded. For the reported integration and end-to-end tests issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Test the complete AI system including connectors, preprocessing, interfaces, and downstream decisions. The offered observation does not establish whether that targeted control succeeded.

This result would support class-imbalance testing, a distinct governance need illustrated by: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. For the reported integration and end-to-end tests issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Test the complete AI system including connectors, preprocessing, interfaces, and downstream decisions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to human oversight requirements, for which an example concern is: A regulated high-risk model advises caseworkers, but they lack training or the practical authority to reject erroneous outputs. It could be useful in that different situation, but it would not directly address the prohibited uses review deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Procurement records show the disallowed scenario was blocked or changed to a lawful design.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the prohibited uses review deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Procurement records show the disallowed scenario was blocked or changed to a lawful design.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the prohibited uses review deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Procurement records show the disallowed scenario was blocked or changed to a lawful design.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported prohibited uses review issue at a regional service provider in Singapore, the relevant corrective action is: Perform prohibited-practice screening before acquisition and decline or redesign any legally impermissible use. The offered observation does not establish whether that targeted control succeeded.

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported prohibited uses review issue at a regional service provider in Singapore, the relevant corrective action is: Perform prohibited-practice screening before acquisition and decline or redesign any legally impermissible use. The offered observation does not establish whether that targeted control succeeded.

This result would support regulatory incident reporting, a distinct governance need illustrated by: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. For the reported prohibited uses review issue at a regional service provider in Singapore, the relevant corrective action is: Perform prohibited-practice screening before acquisition and decline or redesign any legally impermissible use. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to supplier-vs-deployer expectations, for which an example concern is: A procurement contract labels the system seller as the only accountable party even when the customer will configure and operate the service. It could be useful in that different situation, but it would not directly address the stakeholder engagement deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Consultation findings are recorded and visibly influence risk controls or design changes.

This response relates instead to governance change management, for which an example concern is: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. It could be useful in that different situation, but it would not directly address the stakeholder engagement deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Consultation findings are recorded and visibly influence risk controls or design changes.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the stakeholder engagement deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Consultation findings are recorded and visibly influence risk controls or design changes.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported stakeholder engagement issue at an international services company in Helsinki, the relevant corrective action is: Involve affected stakeholders in governance consultation with suitable accessibility and feedback methods. The offered observation does not establish whether that targeted control succeeded.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported stakeholder engagement issue at an international services company in Helsinki, the relevant corrective action is: Involve affected stakeholders in governance consultation with suitable accessibility and feedback methods. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported stakeholder engagement issue at an international services company in Helsinki, the relevant corrective action is: Involve affected stakeholders in governance consultation with suitable accessibility and feedback methods. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor model changes, for which an example concern is: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. It could be useful in that different situation, but it would not directly address the vendor audit rights deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Agreed assurance mechanisms allow review of the relevant controls and incidents.

This response relates instead to subprocessor oversight, for which an example concern is: A vendor may route prompts through undisclosed subcontractors, but the buyer's review covers only the contracting company. It could be useful in that different situation, but it would not directly address the vendor audit rights deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Agreed assurance mechanisms allow review of the relevant controls and incidents.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the vendor audit rights deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Agreed assurance mechanisms allow review of the relevant controls and incidents.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported vendor audit rights issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported vendor audit rights issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported vendor audit rights issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.