Exam Bundle

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported supplier-vs-deployer expectations issue at a large multibranch organization in Oslo, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported supplier-vs-deployer expectations issue at a large multibranch organization in Oslo, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported supplier-vs-deployer expectations issue at a large multibranch organization in Oslo, the relevant corrective action is: Clarify governance expectations separately for system supplier, implementing organization, and end users. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to applicable-role analysis, for which an example concern is: A reseller integrates and materially changes a third-party AI product but assumes contractual labels alone decide every regulatory obligation. It could be useful in that different situation, but it would not directly address the gpai model responsibilities deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The role analysis distinguishes foundation-model documentation and related obligations from app deployment controls.

This response relates instead to ai system transparency, for which an example concern is: Users interact with a machine-generated assistant while being told they are communicating with a human employee. It could be useful in that different situation, but it would not directly address the gpai model responsibilities deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The role analysis distinguishes foundation-model documentation and related obligations from app deployment controls.

This response relates instead to regulatory incident reporting, for which an example concern is: A provider identifies a serious incident in a regulated AI system but records it only in an internal help-desk ticket. It could be useful in that different situation, but it would not directly address the gpai model responsibilities deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The role analysis distinguishes foundation-model documentation and related obligations from app deployment controls.

This result would support technical documentation duty, a distinct governance need illustrated by: A regulated model is placed on the market with only a marketing slide deck and no technical or testing records. For the reported gpai model responsibilities issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.

This result would support training-data governance duty, a distinct governance need illustrated by: A provider cannot explain the relevance, representativeness, or known limitations of data supporting a regulated high-risk model. For the reported gpai model responsibilities issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.

This result would support risk-tier classification, a distinct governance need illustrated by: A company considers all AI equally regulated without checking whether a use fits prohibited, high-risk, or transparency-focused categories. For the reported gpai model responsibilities issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Identify model-provider requirements that may apply separately from downstream AI system obligations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the release-readiness evidence deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Release records show test results and blocking issues resolved or explicitly held before launch.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the release-readiness evidence deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Release records show test results and blocking issues resolved or explicitly held before launch.

This response relates instead to versioned release artifacts, for which an example concern is: The team cannot tell whether production serves the approved model version or an experimental checkpoint. It could be useful in that different situation, but it would not directly address the release-readiness evidence deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Release records show test results and blocking issues resolved or explicitly held before launch.

This result would support feedback-to-maintenance loop, a distinct governance need illustrated by: Operators report recurring unsafe recommendations but model-maintenance plans never incorporate frontline feedback. For the reported release-readiness evidence issue at a technology services group in Stockholm, the relevant corrective action is: Require release-readiness review with documented criteria, risks, owners, and signoff status. The offered observation does not establish whether that targeted control succeeded.

This result would support safe rollback operations, a distinct governance need illustrated by: A new model release creates unacceptable errors, but operations lack a tested method to restore the previous safe version. For the reported release-readiness evidence issue at a technology services group in Stockholm, the relevant corrective action is: Require release-readiness review with documented criteria, risks, owners, and signoff status. The offered observation does not establish whether that targeted control succeeded.

This result would support versioned release artifacts, a distinct governance need illustrated by: The team cannot tell whether production serves the approved model version or an experimental checkpoint. For the reported release-readiness evidence issue at a technology services group in Stockholm, the relevant corrective action is: Require release-readiness review with documented criteria, risks, owners, and signoff status. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to post-market monitoring plan, for which an example concern is: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. It could be useful in that different situation, but it would not directly address the deactivation authority deficiency reported at a professional services group in London. The targeted acceptance criterion here is: A kill-switch exercise shows an authorized responder can disable the unsafe capability promptly.

This response relates instead to agentic red-team testing, for which an example concern is: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. It could be useful in that different situation, but it would not directly address the deactivation authority deficiency reported at a professional services group in London. The targeted acceptance criterion here is: A kill-switch exercise shows an authorized responder can disable the unsafe capability promptly.

This response relates instead to ai end-user training, for which an example concern is: New frontline users trust every generated recommendation because the training explains features but omits failure modes. It could be useful in that different situation, but it would not directly address the deactivation authority deficiency reported at a professional services group in London. The targeted acceptance criterion here is: A kill-switch exercise shows an authorized responder can disable the unsafe capability promptly.

This result would support incident containment, a distinct governance need illustrated by: A production chatbot starts producing unauthorized sensitive details, yet operators continue traffic while discussing the root cause. For the reported deactivation authority issue at a professional services group in London, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.

This result would support human override in practice, a distinct governance need illustrated by: An automated decision tool has an override button, but users are penalized for clicking it and cannot access explanations. For the reported deactivation authority issue at a professional services group in London, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported deactivation authority issue at a professional services group in London, the relevant corrective action is: Define and rehearse emergency deactivation criteria and authority for unacceptable risks. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to supplier-vs-deployer expectations, for which an example concern is: A procurement contract labels the system seller as the only accountable party even when the customer will configure and operate the service. It could be useful in that different situation, but it would not directly address the proportional control design deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: Documented control tiers impose stronger evidence for higher-impact systems without losing essential safeguards.

This response relates instead to enterprise inventory ownership, for which an example concern is: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. It could be useful in that different situation, but it would not directly address the proportional control design deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: Documented control tiers impose stronger evidence for higher-impact systems without losing essential safeguards.

This response relates instead to governance change management, for which an example concern is: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. It could be useful in that different situation, but it would not directly address the proportional control design deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: Documented control tiers impose stronger evidence for higher-impact systems without losing essential safeguards.

This result would support enterprise inventory ownership, a distinct governance need illustrated by: Different divisions independently operate AI features and cannot say which systems process sensitive or consequential data. For the reported proportional control design issue at a healthcare service provider in Raleigh, the relevant corrective action is: Scale governance controls to use-case risk, criticality, organizational maturity, and impact. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported proportional control design issue at a healthcare service provider in Raleigh, the relevant corrective action is: Scale governance controls to use-case risk, criticality, organizational maturity, and impact. The offered observation does not establish whether that targeted control succeeded.

This result would support risk tolerance communication, a distinct governance need illustrated by: Product teams make incompatible launch decisions because leadership has never defined unacceptable AI impacts or escalation thresholds. For the reported proportional control design issue at a healthcare service provider in Raleigh, the relevant corrective action is: Scale governance controls to use-case risk, criticality, organizational maturity, and impact. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to gpai model responsibilities, for which an example concern is: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. It could be useful in that different situation, but it would not directly address the regulatory incident reporting deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Incident records track affected authorities, reportability analysis, deadlines, and corrective actions.

This response relates instead to high-risk management system, for which an example concern is: A provider of a potentially high-risk AI system cannot show a documented ongoing process for evaluating foreseeable risks. It could be useful in that different situation, but it would not directly address the regulatory incident reporting deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Incident records track affected authorities, reportability analysis, deadlines, and corrective actions.

This response relates instead to conformity assessment planning, for which an example concern is: A vendor claims a high-risk AI product complies merely because internal stakeholders liked its prototype. It could be useful in that different situation, but it would not directly address the regulatory incident reporting deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: Incident records track affected authorities, reportability analysis, deadlines, and corrective actions.

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported regulatory incident reporting issue at a global platform operator in Berlin, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported regulatory incident reporting issue at a global platform operator in Berlin, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.

This result would support prohibited uses review, a distinct governance need illustrated by: A procurement team plans an AI capability that may fall under a legally prohibited practice without screening its purpose or context. For the reported regulatory incident reporting issue at a global platform operator in Berlin, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.