Exam Bundle

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported deactivation authority issue at a global platform operator in Berlin, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.

This result would support incident containment, a distinct governance need illustrated by: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. For the reported deactivation authority issue at a global platform operator in Berlin, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.

This result would support human override in practice, a distinct governance need illustrated by: An automated decision tool has an override button, but users are penalized for clicking it and cannot access explanations. For the reported deactivation authority issue at a global platform operator in Berlin, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to design decision trace, for which an example concern is: The model team cannot explain why a sensitive input feature was retained after a privacy objection. It could be useful in that different situation, but it would not directly address the purpose and success definition deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: The design file specifies validated business purpose, boundaries, and decision authority.

This response relates instead to human oversight by design, for which an example concern is: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. It could be useful in that different situation, but it would not directly address the purpose and success definition deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: The design file specifies validated business purpose, boundaries, and decision authority.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the purpose and success definition deficiency reported at a public health agency in Ottawa. The targeted acceptance criterion here is: The design file specifies validated business purpose, boundaries, and decision authority.

This result would support architecture security review, a distinct governance need illustrated by: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. For the reported purpose and success definition issue at a public health agency in Ottawa, the relevant corrective action is: Document intended use, excluded use, success criteria, and affected stakeholders before system design. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported purpose and success definition issue at a public health agency in Ottawa, the relevant corrective action is: Document intended use, excluded use, success criteria, and affected stakeholders before system design. The offered observation does not establish whether that targeted control succeeded.

This result would support design decision trace, a distinct governance need illustrated by: The model team cannot explain why a sensitive input feature was retained after a privacy objection. For the reported purpose and success definition issue at a public health agency in Ottawa, the relevant corrective action is: Document intended use, excluded use, success criteria, and affected stakeholders before system design. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to legal regime inventory, for which an example concern is: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. It could be useful in that different situation, but it would not directly address the insurance underwriting fairness deficiency reported at a financial services provider in London. The targeted acceptance criterion here is: The model approval includes a sector-specific legal analysis and fairness evidence.

This response relates instead to confidential business material, for which an example concern is: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. It could be useful in that different situation, but it would not directly address the insurance underwriting fairness deficiency reported at a financial services provider in London. The targeted acceptance criterion here is: The model approval includes a sector-specific legal analysis and fairness evidence.

This response relates instead to credit fairness, for which an example concern is: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. It could be useful in that different situation, but it would not directly address the insurance underwriting fairness deficiency reported at a financial services provider in London. The targeted acceptance criterion here is: The model approval includes a sector-specific legal analysis and fairness evidence.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported insurance underwriting fairness issue at a financial services provider in London, the relevant corrective action is: Review the relevant insurance and consumer-protection obligations for features, pricing, and explanations. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported insurance underwriting fairness issue at a financial services provider in London, the relevant corrective action is: Review the relevant insurance and consumer-protection obligations for features, pricing, and explanations. The offered observation does not establish whether that targeted control succeeded.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported insurance underwriting fairness issue at a financial services provider in London, the relevant corrective action is: Review the relevant insurance and consumer-protection obligations for features, pricing, and explanations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proprietary model self-deployment, for which an example concern is: A company builds and deploys its own AI product but assumes self-hosting eliminates provider-side documentation and safety duties. It could be useful in that different situation, but it would not directly address the pre-deployment impact review deficiency reported at a local authority in Bristol. The targeted acceptance criterion here is: The deployment record addresses affected people, expected harms, safeguards, and local responsibilities.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the pre-deployment impact review deficiency reported at a local authority in Bristol. The targeted acceptance criterion here is: The deployment record addresses affected people, expected harms, safeguards, and local responsibilities.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the pre-deployment impact review deficiency reported at a local authority in Bristol. The targeted acceptance criterion here is: The deployment record addresses affected people, expected harms, safeguards, and local responsibilities.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported pre-deployment impact review issue at a local authority in Bristol, the relevant corrective action is: Perform a use-context impact assessment before deploying the selected AI system. The offered observation does not establish whether that targeted control succeeded.

This result would support proprietary model self-deployment, a distinct governance need illustrated by: A company builds and deploys its own AI product but assumes self-hosting eliminates provider-side documentation and safety duties. For the reported pre-deployment impact review issue at a local authority in Bristol, the relevant corrective action is: Perform a use-context impact assessment before deploying the selected AI system. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported pre-deployment impact review issue at a local authority in Bristol, the relevant corrective action is: Perform a use-context impact assessment before deploying the selected AI system. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the model-card limitations deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Deployers can identify tested contexts, untested groups, and required safeguards before adoption.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the model-card limitations deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Deployers can identify tested contexts, untested groups, and required safeguards before adoption.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the model-card limitations deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Deployers can identify tested contexts, untested groups, and required safeguards before adoption.

This result would support red-teaming schedule, a distinct governance need illustrated by: A conversational model passed one initial safety test but has never undergone adversarial probing after new tools were added. For the reported model-card limitations issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Prepare a usable model card describing purpose, evaluations, limitations, and appropriate operating conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported model-card limitations issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Prepare a usable model card describing purpose, evaluations, limitations, and appropriate operating conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported model-card limitations issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Prepare a usable model card describing purpose, evaluations, limitations, and appropriate operating conditions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to named decision owner, for which an example concern is: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. It could be useful in that different situation, but it would not directly address the supplier-vs-deployer expectations deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Contractual and operating documents assign distinct responsibilities without leaving deployment gaps.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the supplier-vs-deployer expectations deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Contractual and operating documents assign distinct responsibilities without leaving deployment gaps.

This response relates instead to governance change management, for which an example concern is: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. It could be useful in that different situation, but it would not directly address the supplier-vs-deployer expectations deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Contractual and operating documents assign distinct responsibilities without leaving deployment gaps.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported supplier-vs-deployer expectations issue at a large multibranch organization in Oslo, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported supplier-vs-deployer expectations issue at a large multibranch organization in Oslo, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported supplier-vs-deployer expectations issue at a large multibranch organization in Oslo, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.