Exam Bundle

This result would support deployer operational duties, a distinct governance need illustrated by: A customer believes purchasing a compliant high-risk model removes obligations to use it as instructed and monitor local outcomes. For the reported regulatory incident reporting issue at a global platform operator in Berlin, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.

This result would support gpai model responsibilities, a distinct governance need illustrated by: An organization offering a general-purpose foundation model assumes only downstream app developers ever have governance duties. For the reported regulatory incident reporting issue at a global platform operator in Berlin, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.

This result would support prohibited uses review, a distinct governance need illustrated by: A procurement team plans an AI capability that may fall under a legally prohibited practice without screening its purpose or context. For the reported regulatory incident reporting issue at a global platform operator in Berlin, the relevant corrective action is: Determine relevant regulatory reporting and cooperation obligations and activate the incident escalation process. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the proprietary vendor model deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Due diligence documents service terms, change management, data controls, and exit feasibility.

This response relates instead to agentic orchestration risk, for which an example concern is: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. It could be useful in that different situation, but it would not directly address the proprietary vendor model deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Due diligence documents service terms, change management, data controls, and exit feasibility.

This response relates instead to edge inference suitability, for which an example concern is: A factory needs near-real-time machine alerts when disconnected from the internet, but its design relies entirely on a remote endpoint. It could be useful in that different situation, but it would not directly address the proprietary vendor model deficiency reported at a regional service provider in Singapore. The targeted acceptance criterion here is: Due diligence documents service terms, change management, data controls, and exit feasibility.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported proprietary vendor model issue at a regional service provider in Singapore, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.

This result would support agentic orchestration risk, a distinct governance need illustrated by: A multi-agent workflow executes purchases and messages without explicit tool permission or a plan for cascading failures. For the reported proprietary vendor model issue at a regional service provider in Singapore, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.

This result would support cloud deployment trade-offs, a distinct governance need illustrated by: An AI use case includes restricted processing data but the chosen cloud arrangement has not been assessed for residency and vendor access. For the reported proprietary vendor model issue at a regional service provider in Singapore, the relevant corrective action is: Assess supplier controls and vendor dependence before committing to a proprietary AI service. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to benchmark relevance, for which an example concern is: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. It could be useful in that different situation, but it would not directly address the probability-severity matrix deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The documented risk ranking reflects severity as well as probability and affected population.

This response relates instead to affected-party design feedback, for which an example concern is: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. It could be useful in that different situation, but it would not directly address the probability-severity matrix deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The documented risk ranking reflects severity as well as probability and affected population.

This response relates instead to architecture security review, for which an example concern is: An AI model is connected to privileged enterprise tools without evaluating injection, exfiltration, or privilege boundaries. It could be useful in that different situation, but it would not directly address the probability-severity matrix deficiency reported at a global platform operator in Berlin. The targeted acceptance criterion here is: The documented risk ranking reflects severity as well as probability and affected population.

This result would support evaluation-threshold setting, a distinct governance need illustrated by: Engineers approve a classifier because it scored well in a demo with no predeclared acceptance criteria. For the reported probability-severity matrix issue at a global platform operator in Berlin, the relevant corrective action is: Assess both likelihood and potential severity of AI harms when prioritizing mitigations. The offered observation does not establish whether that targeted control succeeded.

This result would support benchmark relevance, a distinct governance need illustrated by: A vendor presents a generic language benchmark to justify clinical workflow use without evaluating the clinical tasks. For the reported probability-severity matrix issue at a global platform operator in Berlin, the relevant corrective action is: Assess both likelihood and potential severity of AI harms when prioritizing mitigations. The offered observation does not establish whether that targeted control succeeded.

This result would support affected-party design feedback, a distinct governance need illustrated by: A tenant-screening AI is designed using only landlord opinions, excluding people who could be unfairly rejected. For the reported probability-severity matrix issue at a global platform operator in Berlin, the relevant corrective action is: Assess both likelihood and potential severity of AI harms when prioritizing mitigations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to employment discrimination, for which an example concern is: A hiring model ranks applicants by a proxy feature that creates unjustified unequal outcomes for protected groups. It could be useful in that different situation, but it would not directly address the credit fairness deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: The compliance review documents legally relevant group outcomes and required remediation.

This response relates instead to legal regime inventory, for which an example concern is: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. It could be useful in that different situation, but it would not directly address the credit fairness deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: The compliance review documents legally relevant group outcomes and required remediation.

This response relates instead to insurance underwriting fairness, for which an example concern is: An insurer approves a pricing model without considering whether sensitive proxies violate applicable insurance discrimination rules. It could be useful in that different situation, but it would not directly address the credit fairness deficiency reported at a banking group in Zurich. The targeted acceptance criterion here is: The compliance review documents legally relevant group outcomes and required remediation.

This result would support legal regime inventory, a distinct governance need illustrated by: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. For the reported credit fairness issue at a banking group in Zurich, the relevant corrective action is: Evaluate applicable lending discrimination obligations and disparate effects in the intended decision process. The offered observation does not establish whether that targeted control succeeded.

This result would support housing access equality, a distinct governance need illustrated by: A property service uses a ranking algorithm that could disadvantage protected applicants and claims general AI policies are enough. For the reported credit fairness issue at a banking group in Zurich, the relevant corrective action is: Evaluate applicable lending discrimination obligations and disparate effects in the intended decision process. The offered observation does not establish whether that targeted control succeeded.

This result would support product safety liability, a distinct governance need illustrated by: A manufacturer integrates AI into a safety device but evaluates only the vendor's standalone model accuracy. For the reported credit fairness issue at a banking group in Zurich, the relevant corrective action is: Evaluate applicable lending discrimination obligations and disparate effects in the intended decision process. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to proportional control design, for which an example concern is: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. It could be useful in that different situation, but it would not directly address the risk tolerance communication deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Teams consistently apply the same documented tolerance thresholds when approving new use cases.

This response relates instead to cross-functional review, for which an example concern is: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. It could be useful in that different situation, but it would not directly address the risk tolerance communication deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Teams consistently apply the same documented tolerance thresholds when approving new use cases.

This response relates instead to board-level oversight, for which an example concern is: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. It could be useful in that different situation, but it would not directly address the risk tolerance communication deficiency reported at an enterprise digital assurance office in Toronto. The targeted acceptance criterion here is: Teams consistently apply the same documented tolerance thresholds when approving new use cases.

This result would support cross-functional review, a distinct governance need illustrated by: A credit-related model is reviewed only by engineers although its use may affect fairness, privacy, and consumer rights. For the reported risk tolerance communication issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.

This result would support proportional control design, a distinct governance need illustrated by: A small internal autocomplete pilot receives the same resource-intensive approvals as a high-impact medical triage system. For the reported risk tolerance communication issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.

This result would support board-level oversight, a distinct governance need illustrated by: A company announces AI as strategically important but leadership receives no risk, exception, or incident information. For the reported risk tolerance communication issue at an enterprise digital assurance office in Toronto, the relevant corrective action is: Translate organizational risk appetite into clear launch criteria, prohibited uses, and exception routes. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to portability and exit, for which an example concern is: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. It could be useful in that different situation, but it would not directly address the residual-risk acceptance deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The risk decision names an owner, conditions, unresolved issues, and a follow-up date.

This response relates instead to vendor model changes, for which an example concern is: A supplier regularly changes the hosted model behind an unversioned API without assuring customers of behavioral stability. It could be useful in that different situation, but it would not directly address the residual-risk acceptance deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The risk decision names an owner, conditions, unresolved issues, and a follow-up date.

This response relates instead to licensing restrictions, for which an example concern is: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. It could be useful in that different situation, but it would not directly address the residual-risk acceptance deficiency reported at a cross-sector corporate group in Dublin. The targeted acceptance criterion here is: The risk decision names an owner, conditions, unresolved issues, and a follow-up date.

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported residual-risk acceptance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.

This result would support vendor training-data terms, a distinct governance need illustrated by: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. For the reported residual-risk acceptance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported residual-risk acceptance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.