Exam Bundle

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported nist govern function issue at a regional technology consortium in Auckland, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.

This result would support nist manage function, a distinct governance need illustrated by: An assessment reveals material AI harm but the project never prioritizes or acts on the findings. For the reported nist govern function issue at a regional technology consortium in Auckland, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported nist govern function issue at a regional technology consortium in Auckland, the relevant corrective action is: Use the NIST AI RMF Govern function to define oversight, culture, and risk ownership. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the rag versus fine-tuning deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Answers reference maintained authorized material and updates do not require full model retraining.

This response relates instead to multimodal capability decision, for which an example concern is: A document workflow requires understanding diagrams and photographs, but procurement tests only text-only model capability. It could be useful in that different situation, but it would not directly address the rag versus fine-tuning deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Answers reference maintained authorized material and updates do not require full model retraining.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the rag versus fine-tuning deficiency reported at a professional services group in London. The targeted acceptance criterion here is: Answers reference maintained authorized material and updates do not require full model retraining.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported rag versus fine-tuning issue at a professional services group in London, the relevant corrective action is: Evaluate retrieval-augmented generation with controlled up-to-date sources before unnecessary fine-tuning. The offered observation does not establish whether that targeted control succeeded.

This result would support classic versus generative choice, a distinct governance need illustrated by: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. For the reported rag versus fine-tuning issue at a professional services group in London, the relevant corrective action is: Evaluate retrieval-augmented generation with controlled up-to-date sources before unnecessary fine-tuning. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported rag versus fine-tuning issue at a professional services group in London, the relevant corrective action is: Evaluate retrieval-augmented generation with controlled up-to-date sources before unnecessary fine-tuning. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the concept drift deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Postchange validation detects changed predictive relationships and supports treatment decisions.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the concept drift deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Postchange validation detects changed predictive relationships and supports treatment decisions.

This response relates instead to feedback-to-maintenance loop, for which an example concern is: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. It could be useful in that different situation, but it would not directly address the concept drift deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Postchange validation detects changed predictive relationships and supports treatment decisions.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported concept drift issue at a technology services group in Stockholm, the relevant corrective action is: Check outcome relationships and labeled performance over time for concept drift. The offered observation does not establish whether that targeted control succeeded.

This result would support input data drift, a distinct governance need illustrated by: An AI service receives new types of cases over time, but only the model's uptime is monitored. For the reported concept drift issue at a technology services group in Stockholm, the relevant corrective action is: Check outcome relationships and labeled performance over time for concept drift. The offered observation does not establish whether that targeted control succeeded.

This result would support safe rollback operations, a distinct governance need illustrated by: A new model release creates unacceptable errors, but operations lack a tested method to restore the previous safe version. For the reported concept drift issue at a technology services group in Stockholm, the relevant corrective action is: Check outcome relationships and labeled performance over time for concept drift. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to automated decisions and contestability, for which an example concern is: An automated eligibility tool rejects people with legal or similarly significant effects and offers no human reconsideration process. It could be useful in that different situation, but it would not directly address the lawful basis before training deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The processing record states the legal basis, purpose assessment, and safeguards before training begins.

This response relates instead to data minimization, for which an example concern is: A fraud prototype retains entire identity documents when only limited verified attributes are required for the decision. It could be useful in that different situation, but it would not directly address the lawful basis before training deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The processing record states the legal basis, purpose assessment, and safeguards before training begins.

This response relates instead to cross-border processing, for which an example concern is: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. It could be useful in that different situation, but it would not directly address the lawful basis before training deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: The processing record states the legal basis, purpose assessment, and safeguards before training begins.

This result would support purpose limitation, a distinct governance need illustrated by: A retailer repurposes support-chat transcripts to train an employee surveillance classifier without evaluating the new purpose. For the reported lawful basis before training issue at a technology services group in Stockholm, the relevant corrective action is: Assess and document an applicable legal basis and compatible purpose before collecting or reusing personal data. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-border processing, a distinct governance need illustrated by: A vendor migrates AI prompts to a different country while the controller assumes location changes never affect compliance. For the reported lawful basis before training issue at a technology services group in Stockholm, the relevant corrective action is: Assess and document an applicable legal basis and compatible purpose before collecting or reusing personal data. The offered observation does not establish whether that targeted control succeeded.

This result would support sensitive biometric data, a distinct governance need illustrated by: A face-analysis project treats biometric identification data exactly like routine website telemetry during governance review. For the reported lawful basis before training issue at a technology services group in Stockholm, the relevant corrective action is: Assess and document an applicable legal basis and compatible purpose before collecting or reusing personal data. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the third-party role boundaries deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A responsibility matrix includes vendor information duties and the buyer's monitoring and intervention roles.

This response relates instead to named decision owner, for which an example concern is: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. It could be useful in that different situation, but it would not directly address the third-party role boundaries deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A responsibility matrix includes vendor information duties and the buyer's monitoring and intervention roles.

This response relates instead to employee ai literacy, for which an example concern is: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. It could be useful in that different situation, but it would not directly address the third-party role boundaries deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: A responsibility matrix includes vendor information duties and the buyer's monitoring and intervention roles.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported third-party role boundaries issue at a regional technology consortium in Auckland, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported third-party role boundaries issue at a regional technology consortium in Auckland, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported third-party role boundaries issue at a regional technology consortium in Auckland, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to classic versus generative choice, for which an example concern is: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. It could be useful in that different situation, but it would not directly address the cloud deployment trade-offs deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The deployment decision includes data-location controls and contractual safeguards.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the cloud deployment trade-offs deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The deployment decision includes data-location controls and contractual safeguards.

This response relates instead to on-premises option, for which an example concern is: An organization assumes moving an AI model on-premises automatically makes it safe despite missing patching and monitoring capabilities. It could be useful in that different situation, but it would not directly address the cloud deployment trade-offs deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: The deployment decision includes data-location controls and contractual safeguards.

This result would support proprietary vendor model, a distinct governance need illustrated by: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. For the reported cloud deployment trade-offs issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported cloud deployment trade-offs issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.

This result would support open-source license review, a distinct governance need illustrated by: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. For the reported cloud deployment trade-offs issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.