AI Governance and Compliance
Governing AI data and processes: retention and residency strategies, the Generative AI Security Scoping Matrix, and the AWS services that produce audit evidence.
Securing an AI system keeps unauthorized people away from it. Governing one decides what the system is allowed to do in the first place: how long its data may be kept, which countries may process it, who approves a new use, and what evidence an auditor will be handed months later. This topic covers that second half, which is where most production AI projects meet their real gate.
What This Topic Covers
- the difference between data governance and data security, and the question each one answers
- the data lifecycle in an AI system, and the copies a single record leaves behind
- retention defaults that surprise teams, including CloudWatch Logs keeping data indefinitely and the 90-day CloudTrail Event history window
- data residency, and how Amazon Bedrock geographic and global cross-Region inference profiles differ
- the two logging layers for a generative AI call: CloudTrail for the API activity, Bedrock model invocation logging for the content
- monitoring, observation, classification, and data ownership
- the Generative AI Security Scoping Matrix: five scopes from consumer app to self-trained model, the buyer against builder split, and the five security disciplines
- governance protocols in practice: policies, review cadence, review strategies, transparency standards, and team training
- where ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act fit
- the six named AWS services for governance and compliance: AWS Config, Amazon Inspector, AWS Audit Manager, AWS Artifact, AWS CloudTrail, and AWS Trusted Advisor
Why It Matters
Task statement 5.2 of the exam guide is mostly service discrimination under a scenario, and the four services that sound alike are the ones tested: CloudTrail records who called an API, Config records what a resource looked like and whether it complies, Audit Manager assembles your evidence against a framework, and Artifact delivers AWS's own compliance reports. Learn each by the question it answers and the questions stop being interchangeable.
Beyond the exam, this is the topic that decides whether a working prototype ever reaches production. A model that cannot be governed cannot be approved.