Exam Bundle

This result would support agentic red-team testing, a distinct governance need illustrated by: An agent gains new tools for external actions, but the last red team exercised only its conversational answers. For the reported downstream harm forecasts issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.

This result would support post-market monitoring plan, a distinct governance need illustrated by: A regulated AI deployment has no documented plan to collect evidence about its ongoing performance after release. For the reported downstream harm forecasts issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.

This result would support localization control, a distinct governance need illustrated by: A system is lawful in one region but its operating constraints are unsuitable in a newly entered jurisdiction. For the reported downstream harm forecasts issue at a corporate AI adoption program in Zurich, the relevant corrective action is: Evaluate foreseeable downstream effects and dependencies beyond the model's immediate output. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to supplier-vs-deployer expectations, for which an example concern is: A procurement contract labels the system seller as the only accountable party even when the customer will configure and operate the service. It could be useful in that different situation, but it would not directly address the named decision owner deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The decision record identifies the accountable owner and accepted conditions or unresolved blockers.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the named decision owner deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The decision record identifies the accountable owner and accepted conditions or unresolved blockers.

This response relates instead to governance change management, for which an example concern is: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. It could be useful in that different situation, but it would not directly address the named decision owner deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: The decision record identifies the accountable owner and accepted conditions or unresolved blockers.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported named decision owner issue at a regional service provider in Singapore, the relevant corrective action is: Assign named governance decision rights and escalation ownership for accepting or rejecting AI risk. The offered observation does not establish whether that targeted control succeeded.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported named decision owner issue at a regional service provider in Singapore, the relevant corrective action is: Assign named governance decision rights and escalation ownership for accepting or rejecting AI risk. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported named decision owner issue at a regional service provider in Singapore, the relevant corrective action is: Assign named governance decision rights and escalation ownership for accepting or rejecting AI risk. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to cloud deployment trade-offs, for which an example concern is: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. It could be useful in that different situation, but it would not directly address the classic versus generative choice deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The selected method meets defined quality, cost, explainability, and safety criteria.

This response relates instead to open-source license review, for which an example concern is: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. It could be useful in that different situation, but it would not directly address the classic versus generative choice deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The selected method meets defined quality, cost, explainability, and safety criteria.

This response relates instead to agentic orchestration risk, for which an example concern is: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. It could be useful in that different situation, but it would not directly address the classic versus generative choice deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The selected method meets defined quality, cost, explainability, and safety criteria.

This result would support multimodal capability decision, a distinct governance need illustrated by: A document workflow requires understanding diagrams and photographs, but procurement tests only text-only model capability. For the reported classic versus generative choice issue at a global platform operator in Berlin, the relevant corrective action is: Compare classic predictive methods and generative options for the specific decision task. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported classic versus generative choice issue at a global platform operator in Berlin, the relevant corrective action is: Compare classic predictive methods and generative options for the specific decision task. The offered observation does not establish whether that targeted control succeeded.

This result would support small versus large model, a distinct governance need illustrated by: An edge device must operate offline, but a team selects a large remote model based only on headline benchmark scores. For the reported classic versus generative choice issue at a global platform operator in Berlin, the relevant corrective action is: Compare classic predictive methods and generative options for the specific decision task. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to supplier-vs-deployer expectations, for which an example concern is: A procurement contract labels the system seller as the only accountable party even when the customer will configure and operate the service. It could be useful in that different situation, but it would not directly address the named decision owner deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The decision record identifies the accountable owner and accepted conditions or unresolved blockers.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the named decision owner deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The decision record identifies the accountable owner and accepted conditions or unresolved blockers.

This response relates instead to governance change management, for which an example concern is: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. It could be useful in that different situation, but it would not directly address the named decision owner deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: The decision record identifies the accountable owner and accepted conditions or unresolved blockers.

This result would support employee ai literacy, a distinct governance need illustrated by: Staff begin using generative assistants with customer data without learning permitted uses, limitations, or escalation procedures. For the reported named decision owner issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assign named governance decision rights and escalation ownership for accepting or rejecting AI risk. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported named decision owner issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assign named governance decision rights and escalation ownership for accepting or rejecting AI risk. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported named decision owner issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Assign named governance decision rights and escalation ownership for accepting or rejecting AI risk. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to board-level oversight, for which an example concern is: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. It could be useful in that different situation, but it would not directly address the employee ai literacy deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Completion and scenario-based assessments show staff can recognize risky prompts and escalation triggers.

This response relates instead to cross-functional review, for which an example concern is: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. It could be useful in that different situation, but it would not directly address the employee ai literacy deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Completion and scenario-based assessments show staff can recognize risky prompts and escalation triggers.

This response relates instead to third-party role boundaries, for which an example concern is: A buyer assumes the vendor's training obligations automatically cover every human oversight task at the buyer's own deployment. It could be useful in that different situation, but it would not directly address the employee ai literacy deficiency reported at a recruitment services group in Dublin. The targeted acceptance criterion here is: Completion and scenario-based assessments show staff can recognize risky prompts and escalation triggers.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported employee ai literacy issue at a recruitment services group in Dublin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported employee ai literacy issue at a recruitment services group in Dublin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.

This result would support governance change management, a distinct governance need illustrated by: A company adds agentic features to existing chatbots without telling policy owners or updating approval responsibilities. For the reported employee ai literacy issue at a recruitment services group in Dublin, the relevant corrective action is: Deliver role-specific AI literacy and acceptable-use training before privileged operational access. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to contract change monitoring, for which an example concern is: A model supplier changes its terms to allow new data processing while contract owners do not reassess the AI use. It could be useful in that different situation, but it would not directly address the documentation and traceability deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: An audit reconstructs the applicable model, controls, and responsible decision-maker.

This response relates instead to use-case assessment, for which an example concern is: Business units select models first and only later ask whether automation fits the actual problem or creates new risks. It could be useful in that different situation, but it would not directly address the documentation and traceability deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: An audit reconstructs the applicable model, controls, and responsible decision-maker.

This response relates instead to privacy/security policy integration, for which an example concern is: A security team treats model prompts as outside existing access-control and data-retention policies. It could be useful in that different situation, but it would not directly address the documentation and traceability deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: An audit reconstructs the applicable model, controls, and responsible decision-maker.

This result would support use-case assessment, a distinct governance need illustrated by: Business units select models first and only later ask whether automation fits the actual problem or creates new risks. For the reported documentation and traceability issue at a global platform operator in Berlin, the relevant corrective action is: Require versioned documentation and logging of system changes, inputs, review, and decision provenance. The offered observation does not establish whether that targeted control succeeded.

This result would support ai acceptable-use policy, a distinct governance need illustrated by: Employees paste confidential documents into unapproved public AI tools despite an existing generic IT policy. For the reported documentation and traceability issue at a global platform operator in Berlin, the relevant corrective action is: Require versioned documentation and logging of system changes, inputs, review, and decision provenance. The offered observation does not establish whether that targeted control succeeded.

This result would support privacy/security policy integration, a distinct governance need illustrated by: A security team treats model prompts as outside existing access-control and data-retention policies. For the reported documentation and traceability issue at a global platform operator in Berlin, the relevant corrective action is: Require versioned documentation and logging of system changes, inputs, review, and decision provenance. The offered observation does not establish whether that targeted control succeeded.