Obtain use-case evidence and record limitations: Which control directly addresses the gap?
Supplier evidence must cover the actual use case, with limitations documented before approval.
The question
Under the bank's global, NIST-aligned internal AI governance policy, EU AI Act obligations that apply are assumed satisfied. A supplier provides a certification and aggregate benchmark for automated financial-document processing, but neither covers the bank's document types, and known limitations are unexplained. All other prerequisites are satisfied. Which control directly addresses the gap?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Approve after adding quarterly monitoring and human review.Monitoring and human review can mitigate operational risk, but they do not supply the missing evidence or explain limitations before approval.
- Obtain use-case evidence and record limitations. ✓The bank should assess evidence against its actual document types and document limitations before approving deployment.
- Record the evidence gap.Recording the gap preserves an important issue, but by itself it does not obtain evidence or establish the system's limitations for this use case.
- Request a refreshed aggregate benchmark from the supplier.A refreshed aggregate benchmark may still omit the bank's document types and therefore may not address the deployment-specific evidence gap.
The trap
Check whether supplier evidence matches the real data and workflow, not merely whether evidence exists. How to remember it
Supplier evidence must cover the actual use case, with limitations documented before approval.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Deployment and Use questions
- Assess impacts in this factory workflow: What is the most direct action? →
- Amend the contract with audit: Which control is missing? →
- Add contractual incident triggers and information-sharing: Which control is most direct? →
- All 424 Understanding How to Govern AI Deployment and Use questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Deployment and Use ·
Every answer, right and wrong, comes with its own explanation.