Security, Compliance and Governance · Topic 4 of 5
Compliance Standards and AWS Tools
Recognise AI compliance standards and laws such as ISO, SOC and the EU AI Act, and AWS tools that help: Artifact, Config, Audit Manager and CloudTrail.
- 4 min
- Compliance standards and rules include ISO/IEC 27001, ISO/IEC 42001, SOC reports, GDPR and the EU AI Act.
- Many AI rules are risk based, with stricter duties for high risk uses.
- Algorithm accountability laws focus on fairness, transparency and review of automated decisions.
What it is
Compliance means showing that your AI system follows the laws, standards and internal rules that apply to it. Regulators, customers and auditors may all ask for proof.
The exam asks you to recognise the main kinds of standards and regulations, and to match AWS services to compliance jobs.
How it works
Kinds of standards and rules
| Type | Examples | What it covers |
|---|---|---|
| Security and management standards | ISO/IEC 27001, ISO/IEC 42001 | Information security management, and management systems for AI |
| Assurance reports | SOC (System and Organization Controls) reports | Independent reports on how a service provider handles security and related controls |
| Data protection laws | GDPR (General Data Protection Regulation) | Rights over personal data and how it is processed |
| AI specific laws | EU AI Act | Rules for AI that rise with the risk of the use |
| Algorithm accountability rules | Laws and proposals that require checks on automated decisions | Fairness, transparency and impact assessments |
| Industry rules | Rules for finance, health and similar fields | Sector specific duties |
The exact laws that apply depend on the country, the industry and the use. For the exam, you need the idea that regulation exists at several levels, and that compliance is a shared effort between provider and customer.
AI specific regulation
Many AI rules take a risk based approach. Uses with low risk face light duties, and uses with high risk, such as decisions on hiring, credit or health, face stricter ones. Typical duties include documenting the system, testing for bias, keeping human oversight, being open that AI is in use, and keeping records.
Algorithm accountability laws focus on automated decisions about people. They push organisations to assess impact, explain decisions and allow people to challenge them.
Challenges for compliance with AI
- Rules differ between regions and change often.
- Models can be hard to explain, which clashes with duties to give reasons.
- Training data may include personal data or content with unclear rights.
- Outputs can vary, which makes consistent behaviour harder to prove.
AWS services that help
| Service | Compliance job |
|---|---|
| AWS Artifact | Self service access to AWS compliance reports, such as SOC reports, and to agreements |
| AWS Config | Records resource settings and checks them against rules, to detect drift from policy |
| AWS Audit Manager | Collects evidence continuously to help prepare for audits |
| AWS CloudTrail | Logs API activity for an audit trail |
| Amazon Inspector | Finds software vulnerabilities in workloads |
| AWS Trusted Advisor | Gives recommendations on best practices in areas including security |
| Amazon SageMaker Model Cards | Documents model purpose, data and limits |
AWS Artifact is where you get proof of AWS's own compliance. The customer still has to prove that its own use of the services is compliant.
Using the tools together
A typical flow sets the rules, checks resources against them with AWS Config, records activity with CloudTrail, and gathers evidence for auditors with Audit Manager. Artifact supplies AWS's own reports to attach.
Shared responsibility again
AWS keeps its infrastructure and services compliant with many programs. The customer must configure services correctly, handle data lawfully and keep its own records. A compliant platform does not make a non compliant application compliant.
What to remember for the exam
- Compliance standards and rules include ISO/IEC 27001, ISO/IEC 42001, SOC reports, GDPR and the EU AI Act.
- Many AI rules are risk based, with stricter duties for high risk uses.
- Algorithm accountability laws focus on fairness, transparency and review of automated decisions.
- AWS Artifact provides AWS compliance reports and agreements.
- AWS Config records resource settings and checks them against rules.
- AWS Audit Manager collects evidence for audits.
- AWS CloudTrail logs API activity, and AWS Trusted Advisor gives best practice recommendations.
- AWS compliance does not automatically make the customer's application compliant.
Need an AWS compliance report for an auditor, think Artifact. Need to check resource settings against rules, think Config. Need to gather audit evidence, think Audit Manager.
Common mistakes
Assuming AWS certification covers your application. The customer must prove its own compliance.
Mixing up Artifact and Audit Manager. Artifact provides AWS's reports. Audit Manager gathers evidence about your own resources.
Confusing Config with CloudTrail. Config tracks resource settings. CloudTrail tracks API activity.
Treating AI rules as the same everywhere. Laws differ by region and use, so check what applies.
Ignoring documentation duties. Many rules need records of data, testing and decisions.
Check yourself
Which service gives access to AWS compliance reports such as SOC reports?
AWS Artifact.
Which service checks resource configurations against rules and records changes?
AWS Config.
What does a risk based AI regulation do?
It sets stricter duties for higher risk uses of AI and lighter duties for lower risk uses.
Topic 4 of 5 in Security, Compliance and Governance
Test yourself on Security, Compliance and Governance
The full AWS AIF-C01 question bank has 849 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.