Exam Bundle

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported employee ai literacy issue at a multinational employer in Berlin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported employee ai literacy issue at a multinational employer in Berlin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported employee ai literacy issue at a multinational employer in Berlin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to iso terminology and impact scope, for which an example concern is: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. It could be useful in that different situation, but it would not directly address the oecd trustworthy ai principles deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The governance crosswalk uses the principles for internal controls without inventing compulsory certification.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the oecd trustworthy ai principles deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The governance crosswalk uses the principles for internal controls without inventing compulsory certification.

This response relates instead to iso 42001 aims, for which an example concern is: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. It could be useful in that different situation, but it would not directly address the oecd trustworthy ai principles deficiency reported at an international services company in Helsinki. The targeted acceptance criterion here is: The governance crosswalk uses the principles for internal controls without inventing compulsory certification.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported oecd trustworthy ai principles issue at an international services company in Helsinki, the relevant corrective action is: Treat the OECD AI Principles as nonbinding guidance for transparency, fairness, robustness, and accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported oecd trustworthy ai principles issue at an international services company in Helsinki, the relevant corrective action is: Treat the OECD AI Principles as nonbinding guidance for transparency, fairness, robustness, and accountability. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported oecd trustworthy ai principles issue at an international services company in Helsinki, the relevant corrective action is: Treat the OECD AI Principles as nonbinding guidance for transparency, fairness, robustness, and accountability. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the adversarial robustness deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Test records characterize failure under anticipated perturbations and trigger mitigations.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the adversarial robustness deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Test records characterize failure under anticipated perturbations and trigger mitigations.

This response relates instead to data leakage between splits, for which an example concern is: The same customer's near-identical records appear in both training and evaluation datasets, inflating model performance. It could be useful in that different situation, but it would not directly address the adversarial robustness deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Test records characterize failure under anticipated perturbations and trigger mitigations.

This result would support label-quality audit, a distinct governance need illustrated by: Moderators disagree about which examples are harmful, yet the team treats all labels as flawless ground truth. For the reported adversarial robustness issue at a regional technology consortium in Auckland, the relevant corrective action is: Add robustness and adversarial testing within plausible operating conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support data-use rights, a distinct governance need illustrated by: A developer acquires a large web corpus without assessing whether its license permits model training. For the reported adversarial robustness issue at a regional technology consortium in Auckland, the relevant corrective action is: Add robustness and adversarial testing within plausible operating conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support data leakage between splits, a distinct governance need illustrated by: The same customer's near-identical records appear in both training and evaluation datasets, inflating model performance. For the reported adversarial robustness issue at a regional technology consortium in Auckland, the relevant corrective action is: Add robustness and adversarial testing within plausible operating conditions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the localization control deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Jurisdiction tests confirm features and processing comply with the applicable local restrictions.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the localization control deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Jurisdiction tests confirm features and processing comply with the applicable local restrictions.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the localization control deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Jurisdiction tests confirm features and processing comply with the applicable local restrictions.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported localization control issue at a software services vendor in Lisbon, the relevant corrective action is: Implement location-specific configuration and controls after evaluating local legal and social context. The offered observation does not establish whether that targeted control succeeded.

This result would support downstream harm forecasts, a distinct governance need illustrated by: An innocuous text generator is integrated into a system that automatically sends consequential legal notices without reassessing impact. For the reported localization control issue at a software services vendor in Lisbon, the relevant corrective action is: Implement location-specific configuration and controls after evaluating local legal and social context. The offered observation does not establish whether that targeted control succeeded.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported localization control issue at a software services vendor in Lisbon, the relevant corrective action is: Implement location-specific configuration and controls after evaluating local legal and social context. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the retirement and disposal deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Retirement evidence confirms endpoints are disabled and data are retained or deleted according to policy.

This response relates instead to ai acceptable-use policy, for which an example concern is: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. It could be useful in that different situation, but it would not directly address the retirement and disposal deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Retirement evidence confirms endpoints are disabled and data are retained or deleted according to policy.

This response relates instead to ai incident response, for which an example concern is: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. It could be useful in that different situation, but it would not directly address the retirement and disposal deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Retirement evidence confirms endpoints are disabled and data are retained or deleted according to policy.

This result would support lifecycle gate policy, a distinct governance need illustrated by: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. For the reported retirement and disposal issue at a professional services group in London, the relevant corrective action is: Create a controlled AI decommission process for access removal, model/data handling, records, and dependencies. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy/security policy integration, a distinct governance need illustrated by: A security team treats model prompts as outside existing access-control and data-retention policies. For the reported retirement and disposal issue at a professional services group in London, the relevant corrective action is: Create a controlled AI decommission process for access removal, model/data handling, records, and dependencies. The offered observation does not establish whether that targeted control succeeded.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported retirement and disposal issue at a professional services group in London, the relevant corrective action is: Create a controlled AI decommission process for access removal, model/data handling, records, and dependencies. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist measure function, for which an example concern is: A system's risks are discussed qualitatively but no evaluation method or measurable evidence has been selected. It could be useful in that different situation, but it would not directly address the nist govern function deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Responsibilities, policies, and accountability mechanisms are established across the AI lifecycle.

This response relates instead to nist manage function, for which an example concern is: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. It could be useful in that different situation, but it would not directly address the nist govern function deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Responsibilities, policies, and accountability mechanisms are established across the AI lifecycle.

This response relates instead to nist map function, for which an example concern is: A team collects model metrics without first establishing whom the system affects or what its deployment context is. It could be useful in that different situation, but it would not directly address the nist govern function deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Responsibilities, policies, and accountability mechanisms are established across the AI lifecycle.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported nist govern function issue at a regional technology consortium in Auckland, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.

This result would support nist manage function, a distinct governance need illustrated by: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. For the reported nist govern function issue at a regional technology consortium in Auckland, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported nist govern function issue at a regional technology consortium in Auckland, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.