🤖 Exam Guide: AI Practitioner
Domain 5: Security, Compliance, and Governance for AI Solutions
📘Task Statement 5.2
🎯 Objectives
This task is about understanding how organizations prove their AI systems are controlled, auditable, and compliant.
Focus on recognizing common compliance standards, knowing which AWS services support audits/governance, and understanding core data governance practices and governance processes.
1) Regulatory Compliance Standards You Should Recognize
Examples of standards/laws that influence AI systems include:
1.1 ISO (International Organization for Standardization)
Broad set of standards used to demonstrate security and quality management controls often relevant to information security programs and risk management.
1.2 SOC (System and Organization Controls)
Audit reports (e.g., SOC 1/2/3) that provide assurance about an organization’s controls for security, availability, confidentiality, processing integrity, and privacy.
1.3 Algorithm Accountability Laws / Regulations
Emerging or existing laws requiring transparency, risk management, auditing, and responsible use of automated decision systems especially when decisions impact people.
You typically won’t be tested on legal details, more on recognizing that regulations exist and drive requirements like auditability, transparency, and controls.
2) AWS Services/Features That Assist With Governance And Compliance
2.1 AWS Config
Tracks and evaluates resource configurations against desired rules which is useful for compliance posture and drift detection.
2.2 Amazon Inspector
Helps identify vulnerabilities and security issues commonly for workloads like EC2/container aka “vulnerability management”.
2.3 AWS Audit Manager
Helps collect evidence and map controls to compliance frameworks to reduce manual audit effort.
2.4 AWS Artifact
Central place to access AWS compliance reports and agreements, e.g., SOC reports, ISO reports needed for audits.
2.5 AWS CloudTrail
Records API activity for auditing (who did what, when).
Which is critical for governance, incident investigation, and proving controls.
2.6 AWS Trusted Advisor
Provides recommendations across cost, performance, security, and fault tolerance including security checks that can support governance goals.
3) Data Governance Strategies
Key strategies you should be able to describe:
3.1 Data Lifecycle Management
Define how data is collected, stored, used (training/inference), shared, archived, and deleted.
3.2 Logging
Record access and important events such as data access, model endpoint calls and admin changes to support audits and investigations.
3.3 Residency
Ensure data stays in required geographic locations/Regions to satisfy regulatory or contractual obligations.
3.4 Monitoring / Observation
Monitor for policy violations, abnormal access, drift, and operational issues to support ongoing compliance.
3.5 Retention
Keep data/logs for required durations, then dispose of them safely when no longer needed, you should avoid keeping sensitive data longer than necessary.
4) Processes To Follow Governance Protocols
Governance is not just tools, it’s repeatable processes.
Common governance processes include:
4.1 Policies
Written rules for acceptable use, data handling, model usage, human oversight, and incident response.
4.2 Review Cadence
Scheduled reviews for models, prompts, datasets, permissions, and controls.
4.3 Review Strategies
Human review for high-risk outputs, red-teaming, approvals for model changes, and documented sign-offs.
4.4 Governance Frameworks
Use structured frameworks to scope and manage GenAI security risk for example, the Generative AI Security Scoping Matrix and align teams on required controls by use case risk level.
4.5 Transparency Standards
Documentation and communication about model behavior, limitations, and data usage: model cards, user disclosures, citations where appropriate).
4.6 Team Training Requirements
Ensure teams understand privacy, security, compliance, and safe GenAI usage which reduces accidental policy violations
💡 Quick Questions
1. Name two compliance standards or regulation categories that can influence AI systems.
2. Which AWS service provides an audit trail of API calls for governance?
3. What does AWS Artifact provide that’s useful for audits?
4. Name two data governance strategies from the list in this task.
5. What does review cadence mean in an AI governance program?
Additional Resources
✅ Answers to Quick Questions
1. ISO standards and SOC reports
also valid: algorithm accountability laws.
2. AWS CloudTrail.
3. Access to AWS compliance reports and agreements, e.g., SOC/ISO documentation for audit evidence.
4. Data lifecycle management and residency.
also valid: logging, monitoring/observation, retention.
5. A defined schedule for recurring governance reviews, e.g., periodic reviews of models, data, permissions, and controls.
Top comments (0)