Exam Bundle

This result would support portability and exit, a distinct governance need illustrated by: A proprietary vendor becomes unavailable and the company cannot export necessary settings or transition critical processes. For the reported residual-risk acceptance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.

This result would support vendor training-data terms, a distinct governance need illustrated by: An AI API contract does not say whether customer prompts will be retained or used to improve the provider's model. For the reported residual-risk acceptance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.

This result would support licensing restrictions, a distinct governance need illustrated by: A team embeds a model in a public product although the vendor license restricts its distribution and certain uses. For the reported residual-risk acceptance issue at a cross-sector corporate group in Dublin, the relevant corrective action is: Record a locally accountable deployment decision informed by independent vendor and contextual assessments. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to continuous model monitoring, for which an example concern is: A production classifier has no monitoring because engineers assume prelaunch validation remains sufficient forever. It could be useful in that different situation, but it would not directly address the versioned release artifacts deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: The installed model hash and configuration match the approved release package.

This response relates instead to release-readiness evidence, for which an example concern is: A new model is promoted into production while safety-test failures and unresolved critical issues remain undocumented. It could be useful in that different situation, but it would not directly address the versioned release artifacts deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: The installed model hash and configuration match the approved release package.

This response relates instead to concept drift, for which an example concern is: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. It could be useful in that different situation, but it would not directly address the versioned release artifacts deficiency reported at a healthcare service provider in Raleigh. The targeted acceptance criterion here is: The installed model hash and configuration match the approved release package.

This result would support release-readiness evidence, a distinct governance need illustrated by: A new model is promoted into production while safety-test failures and unresolved critical issues remain undocumented. For the reported versioned release artifacts issue at a healthcare service provider in Raleigh, the relevant corrective action is: Control model artifacts and deployment configurations with versioned, auditable release records. The offered observation does not establish whether that targeted control succeeded.

This result would support concept drift, a distinct governance need illustrated by: A prediction model's learned relationship degrades after policy changes although the input-value distribution appears stable. For the reported versioned release artifacts issue at a healthcare service provider in Raleigh, the relevant corrective action is: Control model artifacts and deployment configurations with versioned, auditable release records. The offered observation does not establish whether that targeted control succeeded.

This result would support safe rollback operations, a distinct governance need illustrated by: A new model release creates unacceptable errors, but operations lack a tested method to restore the previous safe version. For the reported versioned release artifacts issue at a healthcare service provider in Raleigh, the relevant corrective action is: Control model artifacts and deployment configurations with versioned, auditable release records. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to confidential business material, for which an example concern is: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. It could be useful in that different situation, but it would not directly address the insurance underwriting fairness deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: The model approval includes a sector-specific legal analysis and fairness evidence.

This response relates instead to credit fairness, for which an example concern is: A lender checks statistical prediction accuracy but ignores how its automated score affects borrowers subject to fair-lending rules. It could be useful in that different situation, but it would not directly address the insurance underwriting fairness deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: The model approval includes a sector-specific legal analysis and fairness evidence.

This response relates instead to legal regime inventory, for which an example concern is: A global AI feature passes a single AI Act checklist while ignoring intellectual-property, privacy, and sectoral laws. It could be useful in that different situation, but it would not directly address the insurance underwriting fairness deficiency reported at an insurance provider in Toronto. The targeted acceptance criterion here is: The model approval includes a sector-specific legal analysis and fairness evidence.

This result would support consumer deception, a distinct governance need illustrated by: An AI-powered shopping assistant claims it performed a professional inspection that never occurred. For the reported insurance underwriting fairness issue at an insurance provider in Toronto, the relevant corrective action is: Review the relevant insurance and consumer-protection obligations for features, pricing, and explanations. The offered observation does not establish whether that targeted control succeeded.

This result would support confidential business material, a distinct governance need illustrated by: An employee uploads trade-secret pricing data to a third-party assistant without checking confidentiality commitments. For the reported insurance underwriting fairness issue at an insurance provider in Toronto, the relevant corrective action is: Review the relevant insurance and consumer-protection obligations for features, pricing, and explanations. The offered observation does not establish whether that targeted control succeeded.

This result would support copyright in training data, a distinct governance need illustrated by: A model team scrapes copyrighted technical manuals for training and treats public accessibility as a universal license. For the reported insurance underwriting fairness issue at an insurance provider in Toronto, the relevant corrective action is: Review the relevant insurance and consumer-protection obligations for features, pricing, and explanations. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to on-premises option, for which an example concern is: An organization assumes moving an AI model on-premises automatically makes it safe despite missing patching and monitoring capabilities. It could be useful in that different situation, but it would not directly address the cloud deployment trade-offs deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The deployment decision includes data-location controls and contractual safeguards.

This response relates instead to fine-tuning governance, for which an example concern is: A foundation model is fine-tuned on confidential case files without analyzing memorization, access controls, or changed behavior. It could be useful in that different situation, but it would not directly address the cloud deployment trade-offs deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The deployment decision includes data-location controls and contractual safeguards.

This response relates instead to classic versus generative choice, for which an example concern is: A team chooses an open-ended generative model to perform a simple constrained numerical classification without comparing simpler alternatives. It could be useful in that different situation, but it would not directly address the cloud deployment trade-offs deficiency reported at a software services vendor in Lisbon. The targeted acceptance criterion here is: The deployment decision includes data-location controls and contractual safeguards.

This result would support deployment fit assessment, a distinct governance need illustrated by: A company selects a chatbot product without checking the language, user population, performance, or data needed for its actual service. For the reported cloud deployment trade-offs issue at a software services vendor in Lisbon, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.

This result would support proprietary vendor model, a distinct governance need illustrated by: Procurement selects a proprietary AI provider without checking model change notices, data handling, or service continuity. For the reported cloud deployment trade-offs issue at a software services vendor in Lisbon, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.

This result would support open-source license review, a distinct governance need illustrated by: A vendor proposes an open-weight model and assumes its availability means unrestricted commercial use and no governance duties. For the reported cloud deployment trade-offs issue at a software services vendor in Lisbon, the relevant corrective action is: Compare cloud hosting with privacy, security, cost, availability, and legal constraints. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to dataset provenance, for which an example concern is: Training files have been merged from several suppliers with no trace of which sources contain disputed records. It could be useful in that different situation, but it would not directly address the data-use rights deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Dataset intake records include rights assessment and prohibited-use constraints.

This response relates instead to adversarial robustness, for which an example concern is: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. It could be useful in that different situation, but it would not directly address the data-use rights deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Dataset intake records include rights assessment and prohibited-use constraints.

This response relates instead to bias mitigation validation, for which an example concern is: A team changes training weights to address one group's error disparity without checking if performance worsened for others. It could be useful in that different situation, but it would not directly address the data-use rights deficiency reported at a technology services group in Stockholm. The targeted acceptance criterion here is: Dataset intake records include rights assessment and prohibited-use constraints.

This result would support representative sampling, a distinct governance need illustrated by: A voice model trained almost entirely on one accent is marketed as equally reliable for all language communities. For the reported data-use rights issue at a technology services group in Stockholm, the relevant corrective action is: Check rights, permissions, and lawful usage limits before incorporating datasets into training. The offered observation does not establish whether that targeted control succeeded.

This result would support adversarial robustness, a distinct governance need illustrated by: An image model passes clean benchmarks but fails when small realistic perturbations are introduced. For the reported data-use rights issue at a technology services group in Stockholm, the relevant corrective action is: Check rights, permissions, and lawful usage limits before incorporating datasets into training. The offered observation does not establish whether that targeted control succeeded.

This result would support label-quality audit, a distinct governance need illustrated by: Moderators disagree about which examples are harmful, yet the team treats all labels as flawless ground truth. For the reported data-use rights issue at a technology services group in Stockholm, the relevant corrective action is: Check rights, permissions, and lawful usage limits before incorporating datasets into training. The offered observation does not establish whether that targeted control succeeded.

This response relates instead to autonomous agent boundaries, for which an example concern is: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. It could be useful in that different situation, but it would not directly address the probabilistic output and review deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Repeated and edge-case tests reveal output variability and route uncertain decisions for human scrutiny.

This response relates instead to algorithmic unfairness, for which an example concern is: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. It could be useful in that different situation, but it would not directly address the probabilistic output and review deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Repeated and edge-case tests reveal output variability and route uncertain decisions for human scrutiny.

This response relates instead to data dependency and drift, for which an example concern is: A prediction service trained on urban customers is introduced into rural locations with very different input distributions but no new validation. It could be useful in that different situation, but it would not directly address the probabilistic output and review deficiency reported at a multinational enterprise in Amsterdam. The targeted acceptance criterion here is: Repeated and edge-case tests reveal output variability and route uncertain decisions for human scrutiny.

This result would support safety versus raw accuracy, a distinct governance need illustrated by: An industrial anomaly detector improves average accuracy but produces rare unsafe false negatives in a safety-critical process. For the reported probabilistic output and review issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Establish testable quality thresholds and an exception-review path reflecting probabilistic outputs. The offered observation does not establish whether that targeted control succeeded.

This result would support algorithmic unfairness, a distinct governance need illustrated by: An AI screening tool achieves high overall accuracy while a protected demographic group has substantially worse false-negative rates. For the reported probabilistic output and review issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Establish testable quality thresholds and an exception-review path reflecting probabilistic outputs. The offered observation does not establish whether that targeted control succeeded.

This result would support autonomous agent boundaries, a distinct governance need illustrated by: An agent is permitted to make irreversible account changes on its own because it performed well in a few chat demonstrations. For the reported probabilistic output and review issue at a multinational enterprise in Amsterdam, the relevant corrective action is: Establish testable quality thresholds and an exception-review path reflecting probabilistic outputs. The offered observation does not establish whether that targeted control succeeded.