Exam Bundle

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported vendor audit rights issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported vendor audit rights issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported vendor audit rights issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate contract assurance and audit-evidence rights appropriate to the model's risk. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the pilot containment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Pilot records show controlled participants, measured outcomes, and stop criteria.

This response relates instead to benchmark relevance, for which an example concern is: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. It could be useful in that different situation, but it would not directly address the pilot containment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Pilot records show controlled participants, measured outcomes, and stop criteria.

This response relates instead to architecture security review, for which an example concern is: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. It could be useful in that different situation, but it would not directly address the pilot containment deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Pilot records show controlled participants, measured outcomes, and stop criteria.

This result would support human oversight by design, a distinct governance need illustrated by: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. For the reported pilot containment issue at an international services company in Helsinki, the relevant corrective action is: Run a bounded pilot with risk limits, monitoring, and safe rollback before broad release. The offered observation does not establish whether that targeted control succeeded.

This result would support impact assessment in design, a distinct governance need illustrated by: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. For the reported pilot containment issue at an international services company in Helsinki, the relevant corrective action is: Run a bounded pilot with risk limits, monitoring, and safe rollback before broad release. The offered observation does not establish whether that targeted control succeeded.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported pilot containment issue at an international services company in Helsinki, the relevant corrective action is: Run a bounded pilot with risk limits, monitoring, and safe rollback before broad release. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the cross-border processing deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The data-flow register and transfer assessment cover vendors, destinations, and applicable safeguards.

This response relates instead to sensitive biometric data, for which an example concern is: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. It could be useful in that different situation, but it would not directly address the cross-border processing deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The data-flow register and transfer assessment cover vendors, destinations, and applicable safeguards.

This response relates instead to lawful basis before training, for which an example concern is: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. It could be useful in that different situation, but it would not directly address the cross-border processing deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The data-flow register and transfer assessment cover vendors, destinations, and applicable safeguards.

This result would support sensitive biometric data, a distinct governance need illustrated by: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. For the reported cross-border processing issue at a regional technology consortium in Auckland, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported cross-border processing issue at a regional technology consortium in Auckland, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.

This result would support third-party processor controls, a distinct governance need illustrated by: A business sends customer records to a hosted model provider without instructions on permitted processing or breach handling. For the reported cross-border processing issue at a regional technology consortium in Auckland, the relevant corrective action is: Assess transfer restrictions and any required safeguards before processing personal data across borders. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the deployment operating procedure deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Operational staff demonstrate correct use and escalation under representative scenarios.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the deployment operating procedure deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Operational staff demonstrate correct use and escalation under representative scenarios.

This response relates instead to monitoring ownership, for which an example concern is: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. It could be useful in that different situation, but it would not directly address the deployment operating procedure deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Operational staff demonstrate correct use and escalation under representative scenarios.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported deployment operating procedure issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Publish risk-based deployment procedures, approved uses, human oversight, and escalation instructions. The offered observation does not establish whether that targeted control succeeded.

This result would support external incident communications, a distinct governance need illustrated by: A harmful AI incident draws public inquiries, but teams issue contradictory statements with no approved communication responsibility. For the reported deployment operating procedure issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Publish risk-based deployment procedures, approved uses, human oversight, and escalation instructions. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported deployment operating procedure issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Publish risk-based deployment procedures, approved uses, human oversight, and escalation instructions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to data leakage between splits, for which an example concern is: The same customer's near-identical records appear in both training and evaluation datasets, inflating model performance. It could be useful in that different situation, but it would not directly address the adversarial robustness deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Test records characterize failure under anticipated perturbations and trigger mitigations.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the adversarial robustness deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Test records characterize failure under anticipated perturbations and trigger mitigations.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the adversarial robustness deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Test records characterize failure under anticipated perturbations and trigger mitigations.

This result would support label-quality audit, a distinct governance need illustrated by: Moderators disagree about which examples are harmful, yet the team treats all labels as flawless ground truth. For the reported adversarial robustness issue at a large multibranch organization in Oslo, the relevant corrective action is: Add robustness and adversarial testing within plausible operating conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support data leakage between splits, a distinct governance need illustrated by: The same customer's near-identical records appear in both training and evaluation datasets, inflating model performance. For the reported adversarial robustness issue at a large multibranch organization in Oslo, the relevant corrective action is: Add robustness and adversarial testing within plausible operating conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support data-use rights, a distinct governance need illustrated by: A developer acquires a large web corpus without assessing whether its license permits model training. For the reported adversarial robustness issue at a large multibranch organization in Oslo, the relevant corrective action is: Add robustness and adversarial testing within plausible operating conditions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to human review policy, for which an example concern is: An organization says a human is involved because someone can view the model dashboard, but no one can intervene. It could be useful in that different situation, but it would not directly address the ai acceptable-use policy deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Usage controls and staff guidance distinguish authorized AI services from forbidden disclosures.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the ai acceptable-use policy deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Usage controls and staff guidance distinguish authorized AI services from forbidden disclosures.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the ai acceptable-use policy deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Usage controls and staff guidance distinguish authorized AI services from forbidden disclosures.

This result would support ai incident response, a distinct governance need illustrated by: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. For the reported ai acceptable-use policy issue at a multinational employer in Berlin, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy/security policy integration, a distinct governance need illustrated by: A security team treats model prompts as outside existing access-control and data-retention policies. For the reported ai acceptable-use policy issue at a multinational employer in Berlin, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This result would support documentation and traceability, a distinct governance need illustrated by: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. For the reported ai acceptable-use policy issue at a multinational employer in Berlin, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.