Exam Bundle

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported high-risk management system issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.

This result would support ai system transparency, a distinct governance need illustrated by: Users interact with a machine-generated assistant while being told they are communicating with a human employee. For the reported high-risk management system issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.

This result would support applicable-role analysis, a distinct governance need illustrated by: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. For the reported high-risk management system issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Establish a proportionate documented risk-management process for relevant high-risk use cases. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cloud deployment trade-offs, for which an example concern is: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. It could be useful in that different situation, but it would not directly address the classic versus generative choice deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The selected method meets defined quality, cost, explainability, and safety criteria.

This response relates instead to agentic orchestration risk, for which an example concern is: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. It could be useful in that different situation, but it would not directly address the classic versus generative choice deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The selected method meets defined quality, cost, explainability, and safety criteria.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the classic versus generative choice deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The selected method meets defined quality, cost, explainability, and safety criteria.

This result would support small versus large model, a distinct governance need illustrated by: An edge device must operate offline, but a team selects a large remote model based only on headline benchmark scores. For the reported classic versus generative choice issue at a professional services group in London, the relevant corrective action is: Compare classic predictive methods and generative options for the specific decision task. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported classic versus generative choice issue at a professional services group in London, the relevant corrective action is: Compare classic predictive methods and generative options for the specific decision task. The offered observation does not establish whether that targeted control succeeded.

This result would support multimodal capability decision, a distinct governance need illustrated by: A document workflow requires understanding diagrams and photographs, but procurement tests only text-only model capability. For the reported classic versus generative choice issue at a professional services group in London, the relevant corrective action is: Compare classic predictive methods and generative options for the specific decision task. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to human oversight by design, for which an example concern is: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. It could be useful in that different situation, but it would not directly address the purpose and success definition deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: The design file specifies validated business purpose, boundaries, and decision authority.

This response relates instead to design decision trace, for which an example concern is: The model team cannot explain why a sensitive input feature was retained after a privacy objection. It could be useful in that different situation, but it would not directly address the purpose and success definition deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: The design file specifies validated business purpose, boundaries, and decision authority.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the purpose and success definition deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: The design file specifies validated business purpose, boundaries, and decision authority.

This result would support architecture security review, a distinct governance need illustrated by: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. For the reported purpose and success definition issue at a healthcare service provider in Raleigh, the relevant corrective action is: Document intended use, excluded use, success criteria, and affected stakeholders before system design. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported purpose and success definition issue at a healthcare service provider in Raleigh, the relevant corrective action is: Document intended use, excluded use, success criteria, and affected stakeholders before system design. The offered observation does not establish whether that targeted control succeeded.

This result would support design decision trace, a distinct governance need illustrated by: The model team cannot explain why a sensitive input feature was retained after a privacy objection. For the reported purpose and success definition issue at a healthcare service provider in Raleigh, the relevant corrective action is: Document intended use, excluded use, success criteria, and affected stakeholders before system design. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the iso 42001 aims deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The management system has defined scope, leadership accountability, documented processes, and continual improvement.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the iso 42001 aims deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The management system has defined scope, leadership accountability, documented processes, and continual improvement.

This response relates instead to iso terminology and impact scope, for which an example concern is: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. It could be useful in that different situation, but it would not directly address the iso 42001 aims deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: The management system has defined scope, leadership accountability, documented processes, and continual improvement.

This result would support nist manage function, a distinct governance need illustrated by: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. For the reported iso 42001 aims issue at a large multibranch organization in Oslo, the relevant corrective action is: Consider an AI management system based on ISO/IEC 42001 for policy, leadership, improvement, and system-wide risk governance. The offered observation does not establish whether that targeted control succeeded.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported iso 42001 aims issue at a large multibranch organization in Oslo, the relevant corrective action is: Consider an AI management system based on ISO/IEC 42001 for policy, leadership, improvement, and system-wide risk governance. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported iso 42001 aims issue at a large multibranch organization in Oslo, the relevant corrective action is: Consider an AI management system based on ISO/IEC 42001 for policy, leadership, improvement, and system-wide risk governance. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to opaque decision impacts, for which an example concern is: A public-facing model rejects applications without any practical way for affected people to understand or challenge consequential outcomes. It could be useful in that different situation, but it would not directly address the autonomous agent boundaries deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Tests show that unauthorized actions are blocked and high-impact steps require accountable approval.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the autonomous agent boundaries deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Tests show that unauthorized actions are blocked and high-impact steps require accountable approval.

This response relates instead to data dependency and drift, for which an example concern is: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. It could be useful in that different situation, but it would not directly address the autonomous agent boundaries deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Tests show that unauthorized actions are blocked and high-impact steps require accountable approval.

This result would support safety versus raw accuracy, a distinct governance need illustrated by: An industrial anomaly detector improves average accuracy but produces rare unsafe false negatives in a safety-critical process. For the reported autonomous agent boundaries issue at a professional services group in London, the relevant corrective action is: Restrict tool authority, require approval for high-impact actions, and log consequential agent decisions. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported autonomous agent boundaries issue at a professional services group in London, the relevant corrective action is: Restrict tool authority, require approval for high-impact actions, and log consequential agent decisions. The offered observation does not establish whether that targeted control succeeded.

This result would support probabilistic output and review, a distinct governance need illustrated by: An executive assumes a generative classifier will return identical conclusions on every run and removes human checks for unusual outputs. For the reported autonomous agent boundaries issue at a professional services group in London, the relevant corrective action is: Restrict tool authority, require approval for high-impact actions, and log consequential agent decisions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor training-data terms, for which an example concern is: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. It could be useful in that different situation, but it would not directly address the service availability contract deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The contract specifies measurable availability, recovery, and escalation expectations.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the service availability contract deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The contract specifies measurable availability, recovery, and escalation expectations.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the service availability contract deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: The contract specifies measurable availability, recovery, and escalation expectations.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported service availability contract issue at a regional technology consortium in Auckland, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported service availability contract issue at a regional technology consortium in Auckland, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported service availability contract issue at a regional technology consortium in Auckland, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.