Exam Bundle

This result would support data minimization, a distinct governance need illustrated by: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. For the reported automated decisions and contestability issue at a global platform operator in Berlin, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.

This result would support data-subject rights handling, a distinct governance need illustrated by: A requester seeks information about personal data used in an AI service, but the organization has no process for locating relevant data. For the reported automated decisions and contestability issue at a global platform operator in Berlin, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported automated decisions and contestability issue at a global platform operator in Berlin, the relevant corrective action is: Assess applicable automated-decision protections and provide required safeguards or meaningful human involvement. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the residual-risk acceptance deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The risk decision names an owner, conditions, unresolved issues, and a follow-up date.

This response relates instead to vendor model changes, for which an example concern is: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. It could be useful in that different situation, but it would not directly address the residual-risk acceptance deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The risk decision names an owner, conditions, unresolved issues, and a follow-up date.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the residual-risk acceptance deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The risk decision names an owner, conditions, unresolved issues, and a follow-up date.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported residual-risk acceptance issue at a technology services group in Stockholm, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported residual-risk acceptance issue at a technology services group in Stockholm, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.

This result would support vendor training-data terms, a distinct governance need illustrated by: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. For the reported residual-risk acceptance issue at a technology services group in Stockholm, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the integration and end-to-end tests deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Integration cases prove that intended inputs produce correctly routed authorized outcomes.

This response relates instead to data leakage between splits, for which an example concern is: The same customer's near-identical records appear in both training and evaluation datasets, inflating model performance. It could be useful in that different situation, but it would not directly address the integration and end-to-end tests deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Integration cases prove that intended inputs produce correctly routed authorized outcomes.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the integration and end-to-end tests deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Integration cases prove that intended inputs produce correctly routed authorized outcomes.

This result would support class-imbalance testing, a distinct governance need illustrated by: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. For the reported integration and end-to-end tests issue at a global platform operator in Berlin, the relevant corrective action is: Test the complete AI system including connectors, preprocessing, interfaces, and downstream decisions. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported integration and end-to-end tests issue at a global platform operator in Berlin, the relevant corrective action is: Test the complete AI system including connectors, preprocessing, interfaces, and downstream decisions. The offered observation does not establish whether that targeted control succeeded.

This result would support training experiment reproducibility, a distinct governance need illustrated by: A model's excellent benchmark score cannot be recreated because seeds, dataset versions, and hyperparameters were not recorded. For the reported integration and end-to-end tests issue at a global platform operator in Berlin, the relevant corrective action is: Test the complete AI system including connectors, preprocessing, interfaces, and downstream decisions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist measure function, for which an example concern is: A system's risks are discussed qualitatively but no evaluation method or measurable evidence has been selected. It could be useful in that different situation, but it would not directly address the nist manage function deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: High-priority risk findings have owners, mitigation actions, and verified disposition.

This response relates instead to nist map function, for which an example concern is: A team collects model metrics without first establishing whom the system affects or what its deployment context is. It could be useful in that different situation, but it would not directly address the nist manage function deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: High-priority risk findings have owners, mitigation actions, and verified disposition.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the nist manage function deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: High-priority risk findings have owners, mitigation actions, and verified disposition.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported nist manage function issue at a global platform operator in Berlin, the relevant corrective action is: Use the NIST AI RMF Manage function to prioritize treatment and allocate risk response. The offered observation does not establish whether that targeted control succeeded.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported nist manage function issue at a global platform operator in Berlin, the relevant corrective action is: Use the NIST AI RMF Manage function to prioritize treatment and allocate risk response. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported nist manage function issue at a global platform operator in Berlin, the relevant corrective action is: Use the NIST AI RMF Manage function to prioritize treatment and allocate risk response. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to data dependency and drift, for which an example concern is: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. It could be useful in that different situation, but it would not directly address the algorithmic unfairness deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Disaggregated evaluation documents group-level error measures and remediation outcomes.

This response relates instead to generative versus predictive scope, for which an example concern is: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. It could be useful in that different situation, but it would not directly address the algorithmic unfairness deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Disaggregated evaluation documents group-level error measures and remediation outcomes.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the algorithmic unfairness deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Disaggregated evaluation documents group-level error measures and remediation outcomes.

This result would support generative versus predictive scope, a distinct governance need illustrated by: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. For the reported algorithmic unfairness issue at a global platform operator in Berlin, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported algorithmic unfairness issue at a global platform operator in Berlin, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.

This result would support supervised learning limits, a distinct governance need illustrated by: A project promises highly reliable supervised predictions but has only unlabeled historical records and no ground-truth outcomes. For the reported algorithmic unfairness issue at a global platform operator in Berlin, the relevant corrective action is: Evaluate error rates and downstream harm by relevant groups, then investigate and mitigate observed disparity. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cloud deployment trade-offs, for which an example concern is: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. It could be useful in that different situation, but it would not directly address the on-premises option deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The local operating plan assigns infrastructure, access, incident, and maintenance ownership.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the on-premises option deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The local operating plan assigns infrastructure, access, incident, and maintenance ownership.

This response relates instead to edge inference suitability, for which an example concern is: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. It could be useful in that different situation, but it would not directly address the on-premises option deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The local operating plan assigns infrastructure, access, incident, and maintenance ownership.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported on-premises option issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate whether local hosting can satisfy security operations, model updates, and resilience responsibilities. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported on-premises option issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate whether local hosting can satisfy security operations, model updates, and resilience responsibilities. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported on-premises option issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Evaluate whether local hosting can satisfy security operations, model updates, and resilience responsibilities. The offered observation does not establish whether that targeted control succeeded.