Exam Bundle

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported third-party role boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported third-party role boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported third-party role boundaries issue at a large multibranch organization in Oslo, the relevant corrective action is: Distinguish provider and deployer tasks and assign the operational duties each party controls. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to incident classification, for which an example concern is: An AI response causes an unsafe operational action, but support treats it as a cosmetic content-quality bug. It could be useful in that different situation, but it would not directly address the continuous model monitoring deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Dashboards detect changes in error rates and assigned owners act on threshold breaches.

This response relates instead to input data drift, for which an example concern is: An AI service receives new types of cases over time, but only the model's uptime is monitored. It could be useful in that different situation, but it would not directly address the continuous model monitoring deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Dashboards detect changes in error rates and assigned owners act on threshold breaches.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the continuous model monitoring deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Dashboards detect changes in error rates and assigned owners act on threshold breaches.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported continuous model monitoring issue at a software services vendor in Lisbon, the relevant corrective action is: Monitor live performance, reliability, fairness, and safety against risk-based baselines. The offered observation does not establish whether that targeted control succeeded.

This result would support post-release audit cadence, a distinct governance need illustrated by: A regulated AI service was approved once and has no periodic review of logs, access, or control effectiveness. For the reported continuous model monitoring issue at a software services vendor in Lisbon, the relevant corrective action is: Monitor live performance, reliability, fairness, and safety against risk-based baselines. The offered observation does not establish whether that targeted control succeeded.

This result would support external transparency materials, a distinct governance need illustrated by: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. For the reported continuous model monitoring issue at a software services vendor in Lisbon, the relevant corrective action is: Monitor live performance, reliability, fairness, and safety against risk-based baselines. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the ai end-user training deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Scenario assessments show users can spot questionable outputs and invoke review routes.

This response relates instead to deployment operating procedure, for which an example concern is: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. It could be useful in that different situation, but it would not directly address the ai end-user training deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Scenario assessments show users can spot questionable outputs and invoke review routes.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the ai end-user training deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Scenario assessments show users can spot questionable outputs and invoke review routes.

This result would support safety and reliability monitoring, a distinct governance need illustrated by: An AI-powered workflow is monitored only for uptime while harmful errors can occur even when the service is available. For the reported ai end-user training issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Train users to recognize uncertainty, report incidents, and apply appropriate independent judgment. The offered observation does not establish whether that targeted control succeeded.

This result would support incident containment, a distinct governance need illustrated by: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. For the reported ai end-user training issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Train users to recognize uncertainty, report incidents, and apply appropriate independent judgment. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported ai end-user training issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Train users to recognize uncertainty, report incidents, and apply appropriate independent judgment. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to generative versus predictive scope, for which an example concern is: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. It could be useful in that different situation, but it would not directly address the data dependency and drift deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Segmented validation reveals whether the new population meets defined performance and fairness thresholds.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the data dependency and drift deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Segmented validation reveals whether the new population meets defined performance and fairness thresholds.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the data dependency and drift deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Segmented validation reveals whether the new population meets defined performance and fairness thresholds.

This result would support generative versus predictive scope, a distinct governance need illustrated by: A procurement team evaluates an open-ended text drafting model solely with a conventional numeric regression error metric. For the reported data dependency and drift issue at a technology services group in Stockholm, the relevant corrective action is: Examine representation and distribution shift before expanding the system to new populations. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported data dependency and drift issue at a technology services group in Stockholm, the relevant corrective action is: Examine representation and distribution shift before expanding the system to new populations. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported data dependency and drift issue at a technology services group in Stockholm, the relevant corrective action is: Examine representation and distribution shift before expanding the system to new populations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the regular control audit deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Audit findings are tracked to closure with evidence of effective controls.

This response relates instead to deployment operating procedure, for which an example concern is: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. It could be useful in that different situation, but it would not directly address the regular control audit deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Audit findings are tracked to closure with evidence of effective controls.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the regular control audit deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Audit findings are tracked to closure with evidence of effective controls.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported regular control audit issue at a regional technology consortium in Auckland, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support threat modeling new data flow, a distinct governance need illustrated by: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. For the reported regular control audit issue at a regional technology consortium in Auckland, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.

This result would support secondary use prevention, a distinct governance need illustrated by: A model built for service support is later reused for employee performance scoring without any new impact assessment. For the reported regular control audit issue at a regional technology consortium in Auckland, the relevant corrective action is: Conduct periodic audits, security tests, and risk reassessments based on evolving conditions. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to class-imbalance testing, for which an example concern is: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. It could be useful in that different situation, but it would not directly address the model interpretability checks deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Reviewers can consistently understand relevant model behavior and method limitations.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the model interpretability checks deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Reviewers can consistently understand relevant model behavior and method limitations.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the model interpretability checks deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: Reviewers can consistently understand relevant model behavior and method limitations.

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported model interpretability checks issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.

This result would support class-imbalance testing, a distinct governance need illustrated by: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. For the reported model interpretability checks issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported model interpretability checks issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.