Exam Bundle

This result would support safety versus raw accuracy, a distinct governance need illustrated by: An industrial anomaly detector improves average accuracy but produces rare unsafe false negatives in a safety-critical process. For the reported autonomous agent boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Restrict tool authority, require approval for high-impact actions, and log consequential agent decisions. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported autonomous agent boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Restrict tool authority, require approval for high-impact actions, and log consequential agent decisions. The offered observation does not establish whether that targeted control succeeded.

This result would support probabilistic output and review, a distinct governance need illustrated by: An executive assumes a generative classifier will return identical conclusions on every run and removes human checks for unusual outputs. For the reported autonomous agent boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Restrict tool authority, require approval for high-impact actions, and log consequential agent decisions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the purpose limitation deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: A documented reuse review prevents incompatible processing unless the legal conditions are met.

This response relates instead to transparent privacy notice, for which an example concern is: A consumer AI feature processes sensitive interaction data although users only received a generic notice about website analytics. It could be useful in that different situation, but it would not directly address the purpose limitation deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: A documented reuse review prevents incompatible processing unless the legal conditions are met.

This response relates instead to data minimization, for which an example concern is: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. It could be useful in that different situation, but it would not directly address the purpose limitation deficiency reported at a corporate HR program in Amsterdam. The targeted acceptance criterion here is: A documented reuse review prevents incompatible processing unless the legal conditions are met.

This result would support third-party processor controls, a distinct governance need illustrated by: A business sends customer records to a hosted model provider without instructions on permitted processing or breach handling. For the reported purpose limitation issue at a corporate HR program in Amsterdam, the relevant corrective action is: Evaluate purpose compatibility and obtain any required new legal basis or authorization before repurposing data. The offered observation does not establish whether that targeted control succeeded.

This result would support sensitive biometric data, a distinct governance need illustrated by: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. For the reported purpose limitation issue at a corporate HR program in Amsterdam, the relevant corrective action is: Evaluate purpose compatibility and obtain any required new legal basis or authorization before repurposing data. The offered observation does not establish whether that targeted control succeeded.

This result would support lawful basis before training, a distinct governance need illustrated by: A data science group assumes publicly visible personal profiles may automatically be copied for unrelated model training. For the reported purpose limitation issue at a corporate HR program in Amsterdam, the relevant corrective action is: Evaluate purpose compatibility and obtain any required new legal basis or authorization before repurposing data. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the class-imbalance testing deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Confusion matrices and targeted tests reveal how often dangerous cases are missed.

This response relates instead to model interpretability checks, for which an example concern is: A risk-scoring tool is deployed with generic feature-importance plots that have not been tested for stability or usefulness. It could be useful in that different situation, but it would not directly address the class-imbalance testing deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Confusion matrices and targeted tests reveal how often dangerous cases are missed.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the class-imbalance testing deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Confusion matrices and targeted tests reveal how often dangerous cases are missed.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported class-imbalance testing issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate recall and error severity for the minority safety-critical class, not accuracy alone. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported class-imbalance testing issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate recall and error severity for the minority safety-critical class, not accuracy alone. The offered observation does not establish whether that targeted control succeeded.

This result would support integration and end-to-end tests, a distinct governance need illustrated by: A model passes unit tests but the live application passes the wrong input field and silently reverses classifications. For the reported class-imbalance testing issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Evaluate recall and error severity for the minority safety-critical class, not accuracy alone. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the downstream harm forecasts deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: System-level tests cover chained actions, affected individuals, and recovery steps.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the downstream harm forecasts deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: System-level tests cover chained actions, affected individuals, and recovery steps.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the downstream harm forecasts deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: System-level tests cover chained actions, affected individuals, and recovery steps.

This result would support localization control, a distinct governance need illustrated by: A system is lawful in one region but its operating constraints are unsuitable in a newly entered jurisdiction. For the reported downstream harm forecasts issue at a regional technology consortium in Auckland, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported downstream harm forecasts issue at a regional technology consortium in Auckland, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported downstream harm forecasts issue at a regional technology consortium in Auckland, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to policy exception governance, for which an example concern is: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. It could be useful in that different situation, but it would not directly address the lifecycle gate policy deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Each system has traceable approvals and evidence for its current lifecycle stage.

This response relates instead to privacy/security policy integration, for which an example concern is: A security team treats model prompts as outside existing access-control and data-retention policies. It could be useful in that different situation, but it would not directly address the lifecycle gate policy deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Each system has traceable approvals and evidence for its current lifecycle stage.

This response relates instead to use-case assessment, for which an example concern is: Business units select models first and only later ask whether automation fits the actual problem or creates new risks. It could be useful in that different situation, but it would not directly address the lifecycle gate policy deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Each system has traceable approvals and evidence for its current lifecycle stage.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported lifecycle gate policy issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Implement stage-appropriate governance gates from use-case intake through design, tests, deployment, and retirement. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported lifecycle gate policy issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Implement stage-appropriate governance gates from use-case intake through design, tests, deployment, and retirement. The offered observation does not establish whether that targeted control succeeded.

This result would support retirement and disposal, a distinct governance need illustrated by: A discontinued predictive service remains callable with old credentials and retained training data after business shutdown. For the reported lifecycle gate policy issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Implement stage-appropriate governance gates from use-case intake through design, tests, deployment, and retirement. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to regulatory incident reporting, for which an example concern is: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. It could be useful in that different situation, but it would not directly address the high-risk management system deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The risk file contains identified hazards, evaluations, mitigations, and residual-risk decisions.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the high-risk management system deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The risk file contains identified hazards, evaluations, mitigations, and residual-risk decisions.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the high-risk management system deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The risk file contains identified hazards, evaluations, mitigations, and residual-risk decisions.

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported high-risk management system issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported high-risk management system issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported high-risk management system issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.