Exam Bundle

This result would support bias mitigation validation, a distinct governance need illustrated by: A team changes training weights to address one group's error disparity without checking if performance worsened for others. For the reported model interpretability checks issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.

This result would support class-imbalance testing, a distinct governance need illustrated by: A rare safety incident makes up very little of a dataset, but the team celebrates a high overall accuracy score. For the reported model interpretability checks issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported model interpretability checks issue at a software services vendor in Lisbon, the relevant corrective action is: Evaluate whether interpretability methods are reliable and meaningful for the actual oversight task. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the use-case assessment deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The intake decision compares AI and non-AI options before model selection.

This response relates instead to documentation and traceability, for which an example concern is: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. It could be useful in that different situation, but it would not directly address the use-case assessment deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The intake decision compares AI and non-AI options before model selection.

This response relates instead to lifecycle gate policy, for which an example concern is: AI pilots enter production after a demo because no defined checkpoints exist from concept approval through monitoring. It could be useful in that different situation, but it would not directly address the use-case assessment deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The intake decision compares AI and non-AI options before model selection.

This result would support documentation and traceability, a distinct governance need illustrated by: A team cannot reconstruct which model version, policy, dataset, or approval produced a disputed AI decision. For the reported use-case assessment issue at a regional service provider in Singapore, the relevant corrective action is: Require an initial use-case assessment documenting purpose, alternatives, affected groups, and intended outcomes. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported use-case assessment issue at a regional service provider in Singapore, the relevant corrective action is: Require an initial use-case assessment documenting purpose, alternatives, affected groups, and intended outcomes. The offered observation does not establish whether that targeted control succeeded.

This result would support ai incident response, a distinct governance need illustrated by: A chatbot reveals confidential information yet the existing incident plan contains no AI-specific containment or communication steps. For the reported use-case assessment issue at a regional service provider in Singapore, the relevant corrective action is: Require an initial use-case assessment documenting purpose, alternatives, affected groups, and intended outcomes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to vendor training-data terms, for which an example concern is: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. It could be useful in that different situation, but it would not directly address the licensing restrictions deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The licensing checklist confirms the intended product and geographic uses are authorized.

This response relates instead to vendor model changes, for which an example concern is: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. It could be useful in that different situation, but it would not directly address the licensing restrictions deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The licensing checklist confirms the intended product and geographic uses are authorized.

This response relates instead to service availability contract, for which an example concern is: A mission-critical deployment relies on a third-party model with no incident notification or service recovery obligations. It could be useful in that different situation, but it would not directly address the licensing restrictions deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The licensing checklist confirms the intended product and geographic uses are authorized.

This result would support pre-deployment impact review, a distinct governance need illustrated by: A business buys a public-sector AI screening service and relies entirely on its marketing accuracy claim without assessing local impacts. For the reported licensing restrictions issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support vendor training-data terms, a distinct governance need illustrated by: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. For the reported licensing restrictions issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported licensing restrictions issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Verify permitted distribution, adaptation, and end-use terms before deployment. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the reliability regression tests deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Upgrade reports compare old and new releases on the same safety-critical benchmarks.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the reliability regression tests deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Upgrade reports compare old and new releases on the same safety-critical benchmarks.

This response relates instead to external transparency materials, for which an example concern is: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. It could be useful in that different situation, but it would not directly address the reliability regression tests deficiency reported at a large multibranch organization in Oslo. The targeted acceptance criterion here is: Upgrade reports compare old and new releases on the same safety-critical benchmarks.

This result would support red-teaming schedule, a distinct governance need illustrated by: A conversational model passed one initial safety test but has never undergone adversarial probing after new tools were added. For the reported reliability regression tests issue at a large multibranch organization in Oslo, the relevant corrective action is: Retain risk-based regression test suites covering prior critical failure modes. The offered observation does not establish whether that targeted control succeeded.

This result would support continuous model monitoring, a distinct governance need illustrated by: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. For the reported reliability regression tests issue at a large multibranch organization in Oslo, the relevant corrective action is: Retain risk-based regression test suites covering prior critical failure modes. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported reliability regression tests issue at a large multibranch organization in Oslo, the relevant corrective action is: Retain risk-based regression test suites covering prior critical failure modes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the human override in practice deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Oversight testing shows trained people can disagree and reverse erroneous outcomes without obstruction.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the human override in practice deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Oversight testing shows trained people can disagree and reverse erroneous outcomes without obstruction.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the human override in practice deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Oversight testing shows trained people can disagree and reverse erroneous outcomes without obstruction.

This result would support deactivation authority, a distinct governance need illustrated by: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. For the reported human override in practice issue at a technology services group in Stockholm, the relevant corrective action is: Ensure intervention is feasible, encouraged when justified, and supported by reviewable evidence. The offered observation does not establish whether that targeted control succeeded.

This result would support ai end-user training, a distinct governance need illustrated by: New frontline users trust every generated recommendation because the training explains features but omits failure modes. For the reported human override in practice issue at a technology services group in Stockholm, the relevant corrective action is: Ensure intervention is feasible, encouraged when justified, and supported by reviewable evidence. The offered observation does not establish whether that targeted control succeeded.

This result would support monitoring ownership, a distinct governance need illustrated by: The deployment team forwards model alerts to an unstaffed mailbox without named responders or on-call coverage. For the reported human override in practice issue at a technology services group in Stockholm, the relevant corrective action is: Ensure intervention is feasible, encouraged when justified, and supported by reviewable evidence. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to feedback-to-maintenance loop, for which an example concern is: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. It could be useful in that different situation, but it would not directly address the incident classification deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The incident record reflects severity, escalation, containment, and corrective action.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the incident classification deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The incident record reflects severity, escalation, containment, and corrective action.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the incident classification deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The incident record reflects severity, escalation, containment, and corrective action.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported incident classification issue at a global platform operator in Berlin, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.

This result would support external transparency materials, a distinct governance need illustrated by: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. For the reported incident classification issue at a global platform operator in Berlin, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.

This result would support root-cause collaboration, a distinct governance need illustrated by: After an AI failure, engineering blames users without checking data quality, model brittleness, configuration, and workflow context. For the reported incident classification issue at a global platform operator in Berlin, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.