Exam Bundle

This result would support proprietary vendor model, a distinct governance need illustrated by: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. For the reported cloud deployment trade-offs issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported cloud deployment trade-offs issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.

This result would support open-source license review, a distinct governance need illustrated by: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. For the reported cloud deployment trade-offs issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the post-release audit cadence deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Audit logs show scheduled assessments, findings, owners, and remediation verification.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the post-release audit cadence deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Audit logs show scheduled assessments, findings, owners, and remediation verification.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the post-release audit cadence deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Audit logs show scheduled assessments, findings, owners, and remediation verification.

This result would support feedback-to-maintenance loop, a distinct governance need illustrated by: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. For the reported post-release audit cadence issue at a technology services group in Stockholm, the relevant corrective action is: Establish periodic AI audit and control-testing cadence proportional to use-case risk. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported post-release audit cadence issue at a technology services group in Stockholm, the relevant corrective action is: Establish periodic AI audit and control-testing cadence proportional to use-case risk. The offered observation does not establish whether that targeted control succeeded.

This result would support release-readiness evidence, a distinct governance need illustrated by: A new model is promoted into production while safety-test failures and unresolved critical issues remain undocumented. For the reported post-release audit cadence issue at a technology services group in Stockholm, the relevant corrective action is: Establish periodic AI audit and control-testing cadence proportional to use-case risk. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to nist measure function, for which an example concern is: A system's risks are discussed qualitatively but no evaluation method or measurable evidence has been selected. It could be useful in that different situation, but it would not directly address the nist manage function deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: High-priority risk findings have owners, mitigation actions, and verified disposition.

This response relates instead to nist map function, for which an example concern is: A team collects model metrics without first establishing whom the system affects or what its deployment context is. It could be useful in that different situation, but it would not directly address the nist manage function deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: High-priority risk findings have owners, mitigation actions, and verified disposition.

This response relates instead to nist govern function, for which an example concern is: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. It could be useful in that different situation, but it would not directly address the nist manage function deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: High-priority risk findings have owners, mitigation actions, and verified disposition.

This result would support iso 42001 aims, a distinct governance need illustrated by: A multinational wants organization-wide procedures for managing AI systems but focuses only on a single model's technical tests. For the reported nist manage function issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Use the NIST AI RMF Manage function to prioritize treatment and allocate risk response. The offered observation does not establish whether that targeted control succeeded.

This result would support iso terminology and impact scope, a distinct governance need illustrated by: A procurement team confuses ISO/IEC 22989 terminology work with the impact-assessment role of ISO/IEC 42005. For the reported nist manage function issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Use the NIST AI RMF Manage function to prioritize treatment and allocate risk response. The offered observation does not establish whether that targeted control succeeded.

This result would support nist govern function, a distinct governance need illustrated by: An AI risk project starts measuring accuracy but nobody has established accountability or organizational risk-management policy. For the reported nist manage function issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Use the NIST AI RMF Manage function to prioritize treatment and allocate risk response. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the monitoring ownership deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Alert drills reach accountable people and produce documented triage decisions.

This response relates instead to deployment operating procedure, for which an example concern is: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. It could be useful in that different situation, but it would not directly address the monitoring ownership deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Alert drills reach accountable people and produce documented triage decisions.

This response relates instead to production fairness monitoring, for which an example concern is: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. It could be useful in that different situation, but it would not directly address the monitoring ownership deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Alert drills reach accountable people and produce documented triage decisions.

This result would support human override in practice, a distinct governance need illustrated by: An automated decision tool has an override button, but users are penalized for clicking it and cannot access explanations. For the reported monitoring ownership issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assign alert owners, severity thresholds, response expectations, and escalation procedures. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported monitoring ownership issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assign alert owners, severity thresholds, response expectations, and escalation procedures. The offered observation does not establish whether that targeted control succeeded.

This result would support maintenance after drift, a distinct governance need illustrated by: A deployed forecasting model gradually deteriorates, but updates are scheduled only annually regardless of monitoring results. For the reported monitoring ownership issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Assign alert owners, severity thresholds, response expectations, and escalation procedures. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the privacy-preserving data treatment deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: The retained training data meets documented necessity and privacy controls.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the privacy-preserving data treatment deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: The retained training data meets documented necessity and privacy controls.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the privacy-preserving data treatment deficiency reported at a hospital group in Melbourne. The targeted acceptance criterion here is: The retained training data meets documented necessity and privacy controls.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported privacy-preserving data treatment issue at a hospital group in Melbourne, the relevant corrective action is: Apply proportionate minimization, de-identification, and access restriction while validating utility. The offered observation does not establish whether that targeted control succeeded.

This result would support data leakage between splits, a distinct governance need illustrated by: The same customer's near-identical records appear in both training and evaluation datasets, inflating model performance. For the reported privacy-preserving data treatment issue at a hospital group in Melbourne, the relevant corrective action is: Apply proportionate minimization, de-identification, and access restriction while validating utility. The offered observation does not establish whether that targeted control succeeded.

This result would support representative sampling, a distinct governance need illustrated by: A voice model trained almost entirely on one accent is marketed as equally reliable for all language communities. For the reported privacy-preserving data treatment issue at a hospital group in Melbourne, the relevant corrective action is: Apply proportionate minimization, de-identification, and access restriction while validating utility. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to employee ai literacy, for which an example concern is: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. It could be useful in that different situation, but it would not directly address the third-party role boundaries deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A responsibility matrix includes vendor information duties and the buyer's monitoring and intervention roles.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the third-party role boundaries deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A responsibility matrix includes vendor information duties and the buyer's monitoring and intervention roles.

This response relates instead to named decision owner, for which an example concern is: A high-risk AI deployment is approved by a rotating committee without any identified person accountable for residual risk. It could be useful in that different situation, but it would not directly address the third-party role boundaries deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: A responsibility matrix includes vendor information duties and the buyer's monitoring and intervention roles.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported third-party role boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported third-party role boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported third-party role boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.