Exam Bundle

This result would support ai incident response, a distinct governance need illustrated by: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. For the reported ai acceptable-use policy issue at a multinational employer in Berlin, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy/security policy integration, a distinct governance need illustrated by: A security team treats model prompts as outside existing access-control and data-retention policies. For the reported ai acceptable-use policy issue at a multinational employer in Berlin, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This result would support documentation and traceability, a distinct governance need illustrated by: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. For the reported ai acceptable-use policy issue at a multinational employer in Berlin, the relevant corrective action is: Update acceptable-use rules for prompts, confidential data, approved tools, and employee escalation. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the data minimization deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Data mapping confirms unnecessary identifiers are excluded or appropriately transformed.

This response relates instead to purpose limitation, for which an example concern is: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. It could be useful in that different situation, but it would not directly address the data minimization deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Data mapping confirms unnecessary identifiers are excluded or appropriately transformed.

This response relates instead to lawful basis before training, for which an example concern is: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. It could be useful in that different situation, but it would not directly address the data minimization deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Data mapping confirms unnecessary identifiers are excluded or appropriately transformed.

This result would support automated decisions and contestability, a distinct governance need illustrated by: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. For the reported data minimization issue at a regional service provider in Singapore, the relevant corrective action is: Reduce training and inference inputs to information necessary for the justified purpose. The offered observation does not establish whether that targeted control succeeded.

This result would support data-subject rights handling, a distinct governance need illustrated by: A requester seeks information about personal data used in an AI service, but the organization has no process for locating relevant data. For the reported data minimization issue at a regional service provider in Singapore, the relevant corrective action is: Reduce training and inference inputs to information necessary for the justified purpose. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported data minimization issue at a regional service provider in Singapore, the relevant corrective action is: Reduce training and inference inputs to information necessary for the justified purpose. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the label-quality audit deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Inter-annotator checks and adjudication records demonstrate acceptable labeling quality.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the label-quality audit deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Inter-annotator checks and adjudication records demonstrate acceptable labeling quality.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the label-quality audit deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: Inter-annotator checks and adjudication records demonstrate acceptable labeling quality.

This result would support data-use rights, a distinct governance need illustrated by: A developer acquires a large web corpus without assessing whether its license permits model training. For the reported label-quality audit issue at an international services company in Helsinki, the relevant corrective action is: Define labeling guidance and measure annotation consistency before relying on labels. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported label-quality audit issue at an international services company in Helsinki, the relevant corrective action is: Define labeling guidance and measure annotation consistency before relying on labels. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported label-quality audit issue at an international services company in Helsinki, the relevant corrective action is: Define labeling guidance and measure annotation consistency before relying on labels. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to multimodal capability decision, for which an example concern is: A document workflow requires understanding diagrams and photographs, but procurement tests only text-only model capability. It could be useful in that different situation, but it would not directly address the rag versus fine-tuning deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Answers reference maintained authorized material and updates do not require full model retraining.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the rag versus fine-tuning deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Answers reference maintained authorized material and updates do not require full model retraining.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the rag versus fine-tuning deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Answers reference maintained authorized material and updates do not require full model retraining.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported rag versus fine-tuning issue at a large multibranch organization in Oslo, the relevant corrective action is: Evaluate retrieval-augmented generation with controlled up-to-date sources before unnecessary fine-tuning. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported rag versus fine-tuning issue at a large multibranch organization in Oslo, the relevant corrective action is: Evaluate retrieval-augmented generation with controlled up-to-date sources before unnecessary fine-tuning. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported rag versus fine-tuning issue at a large multibranch organization in Oslo, the relevant corrective action is: Evaluate retrieval-augmented generation with controlled up-to-date sources before unnecessary fine-tuning. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to named decision owner, for which an example concern is: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. It could be useful in that different situation, but it would not directly address the governance change management deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Change records show revised owners, risk classification, controls, and operational approval.

This response relates instead to supplier-vs-deployer expectations, for which an example concern is: A procurement contract labels the system seller as the only accountable party even when the customer will configure and operate the service. It could be useful in that different situation, but it would not directly address the governance change management deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Change records show revised owners, risk classification, controls, and operational approval.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the governance change management deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Change records show revised owners, risk classification, controls, and operational approval.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported governance change management issue at a technology services group in Stockholm, the relevant corrective action is: Trigger formal governance review when AI capability, autonomy, or intended use materially changes. The offered observation does not establish whether that targeted control succeeded.

This result would support enterprise inventory ownership, a distinct governance need illustrated by: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. For the reported governance change management issue at a technology services group in Stockholm, the relevant corrective action is: Trigger formal governance review when AI capability, autonomy, or intended use materially changes. The offered observation does not establish whether that targeted control succeeded.

This result would support stakeholder engagement, a distinct governance need illustrated by: A service is designed for vulnerable users while no representatives of the affected community participate in requirements or review. For the reported governance change management issue at a technology services group in Stockholm, the relevant corrective action is: Trigger formal governance review when AI capability, autonomy, or intended use materially changes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to lawful basis before training, for which an example concern is: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. It could be useful in that different situation, but it would not directly address the automated decisions and contestability deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Records demonstrate necessary explanations, review routes, and lawful decision procedures.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the automated decisions and contestability deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Records demonstrate necessary explanations, review routes, and lawful decision procedures.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the automated decisions and contestability deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Records demonstrate necessary explanations, review routes, and lawful decision procedures.

This result would support data minimization, a distinct governance need illustrated by: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. For the reported automated decisions and contestability issue at a global platform operator in Berlin, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.

This result would support data-subject rights handling, a distinct governance need illustrated by: A requester seeks information about personal data used in an AI service, but the organization has no process for locating relevant data. For the reported automated decisions and contestability issue at a global platform operator in Berlin, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported automated decisions and contestability issue at a global platform operator in Berlin, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.