Exam Bundle

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported incident classification issue at a global platform operator in Berlin, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.

This result would support external transparency materials, a distinct governance need illustrated by: Deployers are offered a high-impact model without understandable operational instructions, limitations, or monitoring information. For the reported incident classification issue at a global platform operator in Berlin, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.

This result would support root-cause collaboration, a distinct governance need illustrated by: After an AI failure, engineering blames users without checking data quality, model brittleness, configuration, and workflow context. For the reported incident classification issue at a global platform operator in Berlin, the relevant corrective action is: Classify AI incidents by actual safety, privacy, security, and operational consequences. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the generative versus predictive scope deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The evaluation protocol checks drafted content and failure modes rather than only numeric prediction error.

This response relates instead to safety versus raw accuracy, for which an example concern is: An industrial anomaly detector improves average accuracy but produces rare unsafe false negatives in a safety-critical process. It could be useful in that different situation, but it would not directly address the generative versus predictive scope deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The evaluation protocol checks drafted content and failure modes rather than only numeric prediction error.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the generative versus predictive scope deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The evaluation protocol checks drafted content and failure modes rather than only numeric prediction error.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported generative versus predictive scope issue at a software services vendor in Lisbon, the relevant corrective action is: Classify the task as generative and choose task-appropriate evaluation of factuality, safety, and usefulness. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported generative versus predictive scope issue at a software services vendor in Lisbon, the relevant corrective action is: Classify the task as generative and choose task-appropriate evaluation of factuality, safety, and usefulness. The offered observation does not establish whether that targeted control succeeded.

This result would support supervised learning limits, a distinct governance need illustrated by: A project promises highly reliable supervised predictions but has only unlabeled historical records and no ground-truth outcomes. For the reported generative versus predictive scope issue at a software services vendor in Lisbon, the relevant corrective action is: Classify the task as generative and choose task-appropriate evaluation of factuality, safety, and usefulness. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to purpose and success definition, for which an example concern is: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. It could be useful in that different situation, but it would not directly address the design decision trace deficiency reported at a professional services group in London. The targeted acceptance criterion here is: An auditor can trace the feature decision to evidence, approval, and later reassessments.

This response relates instead to risk-mitigation hierarchy, for which an example concern is: The team responds to an unacceptable safety risk only with user disclaimers despite a feasible safer design. It could be useful in that different situation, but it would not directly address the design decision trace deficiency reported at a professional services group in London. The targeted acceptance criterion here is: An auditor can trace the feature decision to evidence, approval, and later reassessments.

This response relates instead to human oversight by design, for which an example concern is: A financial approval workflow inserts a reviewer screen but gives the reviewer no relevant evidence or ability to override. It could be useful in that different situation, but it would not directly address the design decision trace deficiency reported at a professional services group in London. The targeted acceptance criterion here is: An auditor can trace the feature decision to evidence, approval, and later reassessments.

This result would support impact assessment in design, a distinct governance need illustrated by: A high-impact model architecture is finalized before anyone assesses possible harm to vulnerable users. For the reported design decision trace issue at a professional services group in London, the relevant corrective action is: Maintain design decisions, rationales, owners, review outcomes, and risk exceptions in a versioned record. The offered observation does not establish whether that targeted control succeeded.

This result would support purpose and success definition, a distinct governance need illustrated by: Developers start building a mental-health chatbot before agreeing whether it will educate users, triage needs, or make clinical recommendations. For the reported design decision trace issue at a professional services group in London, the relevant corrective action is: Maintain design decisions, rationales, owners, review outcomes, and risk exceptions in a versioned record. The offered observation does not establish whether that targeted control succeeded.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported design decision trace issue at a professional services group in London, the relevant corrective action is: Maintain design decisions, rationales, owners, review outcomes, and risk exceptions in a versioned record. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the secondary use prevention deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Access controls and approval records block unreviewed repurposing of the model.

This response relates instead to deployment operating procedure, for which an example concern is: An AI decision-support service goes live with no instructions for operators on appropriate inputs, exceptions, or prohibited uses. It could be useful in that different situation, but it would not directly address the secondary use prevention deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Access controls and approval records block unreviewed repurposing of the model.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the secondary use prevention deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Access controls and approval records block unreviewed repurposing of the model.

This result would support regular control audit, a distinct governance need illustrated by: A deployed AI system has unchanged governance paperwork despite major operational changes and no control re-testing. For the reported secondary use prevention issue at a recruitment services group in Dublin, the relevant corrective action is: Reassess materially changed or secondary uses and restrict functions until governance approval. The offered observation does not establish whether that targeted control succeeded.

This result would support threat modeling new data flow, a distinct governance need illustrated by: A deployed assistant is connected to a new internal file store, but the team does not update its leakage threat model. For the reported secondary use prevention issue at a recruitment services group in Dublin, the relevant corrective action is: Reassess materially changed or secondary uses and restrict functions until governance approval. The offered observation does not establish whether that targeted control succeeded.

This result would support production fairness monitoring, a distinct governance need illustrated by: A hiring classifier passed predeployment bias tests, but no one checks whether group error rates shift after launch. For the reported secondary use prevention issue at a recruitment services group in Dublin, the relevant corrective action is: Reassess materially changed or secondary uses and restrict functions until governance approval. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to policy exception governance, for which an example concern is: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. It could be useful in that different situation, but it would not directly address the lifecycle gate policy deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Each system has traceable approvals and evidence for its current lifecycle stage.

This response relates instead to use-case assessment, for which an example concern is: Business units select models first and only later ask whether automation fits the actual problem or creates new risks. It could be useful in that different situation, but it would not directly address the lifecycle gate policy deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Each system has traceable approvals and evidence for its current lifecycle stage.

This response relates instead to privacy/security policy integration, for which an example concern is: A security team treats model prompts as outside existing access-control and data-retention policies. It could be useful in that different situation, but it would not directly address the lifecycle gate policy deficiency reported at a regional technology consortium in Auckland. The targeted acceptance criterion here is: Each system has traceable approvals and evidence for its current lifecycle stage.

This result would support retirement and disposal, a distinct governance need illustrated by: A discontinued predictive service remains callable with old credentials and retained training data after business shutdown. For the reported lifecycle gate policy issue at a regional technology consortium in Auckland, the relevant corrective action is: Implement stage-appropriate governance gates from use-case intake through design, tests, deployment, and retirement. The offered observation does not establish whether that targeted control succeeded.

This result would support policy exception governance, a distinct governance need illustrated by: Teams bypass required bias testing by citing a launch deadline without any time-bounded exception decision. For the reported lifecycle gate policy issue at a regional technology consortium in Auckland, the relevant corrective action is: Implement stage-appropriate governance gates from use-case intake through design, tests, deployment, and retirement. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported lifecycle gate policy issue at a regional technology consortium in Auckland, the relevant corrective action is: Implement stage-appropriate governance gates from use-case intake through design, tests, deployment, and retirement. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the downstream harm forecasts deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: System-level tests cover chained actions, affected individuals, and recovery steps.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the downstream harm forecasts deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: System-level tests cover chained actions, affected individuals, and recovery steps.

This response relates instead to deactivation authority, for which an example concern is: A model shows a serious new safety defect, but no role is empowered to suspend its use until an executive meeting next month. It could be useful in that different situation, but it would not directly address the downstream harm forecasts deficiency reported at a corporate AI adoption program in Zurich. The targeted acceptance criterion here is: System-level tests cover chained actions, affected individuals, and recovery steps.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported downstream harm forecasts issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported downstream harm forecasts issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.

This result would support localization control, a distinct governance need illustrated by: A system is lawful in one region but its operating constraints are unsuitable in a newly entered jurisdiction. For the reported downstream harm forecasts issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.