Entering the Regulated World

If you work in a hospital, a bank, or a government agency, you cannot just "say" you are secure. You must prove it. You need a third-party auditor to verify that the "Cloud" you are using follows international standards.

On the AWS Certified AI Practitioner exam, you must know where to get these "Proof Documents."

1. Compliance Frameworks in AI

As a Practitioner, you should recognize these acronyms:

SOC (Service Organization Control): Proof that AWS manages its data centers securely. (SOC 1, 2, and 3).
HIPAA (Health Insurance Portability and Accountability Act): Required for handling medical data in the US.
GDPR (General Data Protection Regulation): The high-level privacy standard for the European Union.
ISO 27001: An international standard for information security management.

2. The Service: AWS Artifact

AWS Artifact is your go-to, central resource for compliance-related information. It provides on-demand access to AWS’s security and compliance reports.

What's inside Artifact?

Compliance Reports: Download the latest SOC 2 report to send to your insurance company.
Agreements: Sign the Business Associate Addendum (BAA) which is legally required before you put private patient data into Amazon Bedrock or SageMaker.

3. The "Inherited" Compliance Concept

One of the best reasons to use AWS for AI is that you "Inherit" the security built-in.

AWS is responsible for the physical security of the region.
By using a HIPAA-Eligible Service (like Bedrock), you start with a baseline of security that would take you years to build on your own.

4. Visualizing the Audit Process

graph TD
    A[Global Regulator: e.g. EU AI Act] --> B[Standard Set: e.g. ISO 27001]
    B --> C[3rd Party Auditor visits AWS]
    C --> D[Auditor issues Certificate]
    D --> E[AWS Uploads Certificate to AWS ARTIFACT]
    F[The Customer: YOU] -->|Downloads Report| E
    E --> G[Proof for your own Legal Team]

5. Summary: Compliance is a Search Tool

If an exam question mentions:

"Accessing a SOC 2 report"
"Signing a HIPAA agreement (BAA)"
"Downloading a security certification" The answer is always AWS Artifact.

Exercise: Identify the Compliance Hub

A fintech startup is applying for a banking license. The regulators need to see exactly how AWS protects its physical hardware in the London data centers. Which service should the startup use to find this information?

A. AWS Trusted Advisor.
B. AWS Artifact.
C. Amazon Inspector.
D. AWS Shield.

The Answer is B! AWS Artifact is the portal where you download these physical and logical security compliance reports.

Knowledge Check

?Knowledge Check

Your legal department needs to download the SOC 2 or HIPAA compliance reports for the AWS infrastructure to prove it meets industry standards. Where should they go?

What's Next?

We have the reports, the monitors, and the audits. How do we bring it all together for the whole lifecycle of the model? In our final lesson of Module 12, we look at Governance tools for the AI lifecycle.

The Compliance Shield: AWS Artifact