Security, Compliance and Governance · Topic 5 of 5
AI Governance and Data Policies
Set up AI governance with data lifecycle, retention, residency and logging rules, policy reviews, team training and the GenAI Security Scoping Matrix.
- 5 min
- Includes a diagram
- Data governance covers lifecycle, logging, residency, monitoring, retention, classification and ownership.
- Residency means keeping data in required Regions or countries, which you control on AWS by choosing the Region.
- Retention means keeping data only as long as needed, and Amazon S3 lifecycle rules can automate it.
What it is
Governance is the set of rules, roles and routines that keep AI use under control. It answers who may build or use AI, with what data, under which checks, and who is accountable when something goes wrong.
It has two parts: governing the data that AI uses, and governing the AI process itself.
How it works
Data governance strategies
| Strategy | What it means |
|---|---|
| Data lifecycle management | Control data from creation to storage, use, archive and deletion |
| Logging | Record who accessed or changed data and when |
| Residency | Keep data in the Region or country the rules require |
| Monitoring and observation | Watch data flows, quality and access for problems |
| Retention | Keep data for as long as needed, and no longer, based on rules and need |
| Classification | Label data by sensitivity so controls match the risk |
| Ownership | Name who is responsible for each dataset |
On AWS you choose the Region where data is stored and processed, which helps with residency rules. Lifecycle settings on Amazon S3 can move or delete data on a schedule, which supports retention. AWS CloudTrail and logging services give the records.
Governance of the AI process
Governance protocols set out how AI work is approved and reviewed.
| Element | Purpose |
|---|---|
| Policies | Written rules on allowed uses, data, and review steps |
| Governance framework | A structure that defines roles, decision rights and controls |
| Review cadence | How often models, data and policies are reviewed |
| Review strategies | Methods such as technical review, risk review and legal review |
| Transparency standards | What to disclose about AI use, data and limits |
| Team training | Staff learn the rules, the risks and the tools |
| Incident process | A route for reporting and fixing problems |
A good policy covers the whole lifecycle: approval of use cases, data sourcing, model choice, testing, deployment, monitoring and retirement.
Review cadence and strategies
Reviews should be regular, not only at launch. A typical pattern is a full review before release, scheduled reviews afterwards, and extra reviews when the model, data or law changes. Use several review types: technical (quality and security), ethical (fairness and harm), and legal (rights and rules).
Generative AI Security Scoping Matrix
The Generative AI Security Scoping Matrix is an AWS framework that sorts a GenAI use case into one of five scopes, according to how much of the stack you own and control. The more you own, the more security and governance work falls on you.
| Scope | Type of use | Your main duties |
|---|---|---|
| 1 | Consumer application: a public GenAI service used as is | Usage policy and what data staff may share |
| 2 | Enterprise application: a business app with GenAI features | Usage policy, data shared and access settings |
| 3 | Pre trained model: you build your own app on an existing model | The application, your data, access and prompts |
| 4 | Fine tuned model: you adapt a model with your data | All of scope 3, plus the tuning data and the custom model |
| 5 | Self trained model: you build and train a model from scratch | Everything, including training data, model protection and lifecycle |
In scopes 1 and 2 the provider runs most of the stack. From scope 3 upward, you secure more of it, and at scope 5 you own nearly all of it.
Transparency standards
Set clear standards for what you tell users and stakeholders: that AI is used, what data it relies on, its known limits and how to raise a concern. Keep documentation current, for example with model cards.
Training the team
Governance fails if people do not know it. Train developers, reviewers and business users on policy, safe prompting, data handling and how to report problems. Repeat training as tools and rules change.
Metrics for governance
Track measures such as the share of models with documentation, the time to fix incidents, the number of policy exceptions and the results of audits. These show whether governance works.
What to remember for the exam
- Data governance covers lifecycle, logging, residency, monitoring, retention, classification and ownership.
- Residency means keeping data in required Regions or countries, which you control on AWS by choosing the Region.
- Retention means keeping data only as long as needed, and Amazon S3 lifecycle rules can automate it.
- Governance of the AI process uses policies, a framework, review cadence, transparency standards and team training.
- Reviews should be regular and cover technical, ethical and legal views.
- The Generative AI Security Scoping Matrix has five scopes: consumer app, enterprise app, pre trained model, fine tuned model and self trained model.
- Owning more of the model means taking more security and governance duties.
- Training and clear roles keep governance real.
When a question links the level of customer responsibility to how much of the model the customer builds or tunes, the answer is the Generative AI Security Scoping Matrix.
Common mistakes
Treating governance as a one time document. It needs regular review and updates.
Keeping data forever. Over retention raises risk and may break rules.
Ignoring residency. Storing data in the wrong Region can break legal duties.
Skipping team training. Policy that nobody knows will not be followed.
Assuming a provider's model removes your duties. Your responsibilities rise with how much you customise.
Check yourself
What is data residency?
The requirement to keep data in a particular Region or country.
Name two parts of AI process governance.
Examples are policies, a governance framework, review cadence, transparency standards and team training.
What does the Generative AI Security Scoping Matrix help you do?
It sorts a GenAI use case into one of five scopes by how much of the stack you own, which shows how many security duties fall on you.
Topic 5 of 5 in Security, Compliance and Governance
Test yourself on Security, Compliance and Governance
The full AWS AIF-C01 question bank has 849 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.