Exam Bundle

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported service availability contract issue at a regional technology consortium in Auckland, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported service availability contract issue at a regional technology consortium in Auckland, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported service availability contract issue at a regional technology consortium in Auckland, the relevant corrective action is: Review service levels, continuity terms, support response, and exit provisions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the model interpretability checks deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Reviewers can consistently understand relevant model behavior and method limitations.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the model interpretability checks deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Reviewers can consistently understand relevant model behavior and method limitations.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the model interpretability checks deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: Reviewers can consistently understand relevant model behavior and method limitations.

This result would support class-imbalance testing, a distinct governance need illustrated by: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. For the reported model interpretability checks issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported model interpretability checks issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported model interpretability checks issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the iso 42001 aims deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The management system has defined scope, leadership accountability, documented processes, and continual improvement.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the iso 42001 aims deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The management system has defined scope, leadership accountability, documented processes, and continual improvement.

This response relates instead to iso terminology and impact scope, for which an example concern is: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. It could be useful in that different situation, but it would not directly address the iso 42001 aims deficiency reported at a professional services group in London. The targeted acceptance criterion here is: The management system has defined scope, leadership accountability, documented processes, and continual improvement.

This result would support nist manage function, a distinct governance need illustrated by: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. For the reported iso 42001 aims issue at a professional services group in London, the relevant corrective action is: Consider an AI management system based on ISO/IEC 42001 for policy, leadership, improvement, and system-wide risk governance. The offered observation does not establish whether that targeted control succeeded.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported iso 42001 aims issue at a professional services group in London, the relevant corrective action is: Consider an AI management system based on ISO/IEC 42001 for policy, leadership, improvement, and system-wide risk governance. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported iso 42001 aims issue at a professional services group in London, the relevant corrective action is: Consider an AI management system based on ISO/IEC 42001 for policy, leadership, improvement, and system-wide risk governance. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the small versus large model deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Representative device tests establish workable performance and manageable operational cost.

This response relates instead to proprietary vendor model, for which an example concern is: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. It could be useful in that different situation, but it would not directly address the small versus large model deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Representative device tests establish workable performance and manageable operational cost.

This response relates instead to edge inference suitability, for which an example concern is: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. It could be useful in that different situation, but it would not directly address the small versus large model deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Representative device tests establish workable performance and manageable operational cost.

This result would support edge inference suitability, a distinct governance need illustrated by: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. For the reported small versus large model issue at a technology services group in Stockholm, the relevant corrective action is: Assess smaller and larger model trade-offs against latency, compute, privacy, and quality needs. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported small versus large model issue at a technology services group in Stockholm, the relevant corrective action is: Assess smaller and larger model trade-offs against latency, compute, privacy, and quality needs. The offered observation does not establish whether that targeted control succeeded.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported small versus large model issue at a technology services group in Stockholm, the relevant corrective action is: Assess smaller and larger model trade-offs against latency, compute, privacy, and quality needs. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to human oversight by design, for which an example concern is: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. It could be useful in that different situation, but it would not directly address the risk-mitigation hierarchy deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The control plan shows why more effective technical and process mitigations were considered.

This response relates instead to purpose and success definition, for which an example concern is: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. It could be useful in that different situation, but it would not directly address the risk-mitigation hierarchy deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The control plan shows why more effective technical and process mitigations were considered.

This response relates instead to design decision trace, for which an example concern is: The model team cannot explain why a sensitive input feature was retained after a privacy objection. It could be useful in that different situation, but it would not directly address the risk-mitigation hierarchy deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The control plan shows why more effective technical and process mitigations were considered.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported risk-mitigation hierarchy issue at a technology services group in Stockholm, the relevant corrective action is: Prioritize risk elimination or design reduction before relying only on warnings or downstream procedures. The offered observation does not establish whether that targeted control succeeded.

This result would support benchmark relevance, a distinct governance need illustrated by: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. For the reported risk-mitigation hierarchy issue at a technology services group in Stockholm, the relevant corrective action is: Prioritize risk elimination or design reduction before relying only on warnings or downstream procedures. The offered observation does not establish whether that targeted control succeeded.

This result would support architecture security review, a distinct governance need illustrated by: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. For the reported risk-mitigation hierarchy issue at a technology services group in Stockholm, the relevant corrective action is: Prioritize risk elimination or design reduction before relying only on warnings or downstream procedures. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to third-party role boundaries, for which an example concern is: A buyer assumes the vendor's training obligations automatically cover every human oversight task at the buyer's own deployment. It could be useful in that different situation, but it would not directly address the employee ai literacy deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Completion and scenario-based assessments show staff can recognize risky prompts and escalation triggers.

This response relates instead to cross-functional review, for which an example concern is: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. It could be useful in that different situation, but it would not directly address the employee ai literacy deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Completion and scenario-based assessments show staff can recognize risky prompts and escalation triggers.

This response relates instead to board-level oversight, for which an example concern is: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. It could be useful in that different situation, but it would not directly address the employee ai literacy deficiency reported at a multinational employer in Berlin. The targeted acceptance criterion here is: Completion and scenario-based assessments show staff can recognize risky prompts and escalation triggers.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported employee ai literacy issue at a multinational employer in Berlin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported employee ai literacy issue at a multinational employer in Berlin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported employee ai literacy issue at a multinational employer in Berlin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.