What's changed: In-scope coverage: added security (Macie/Inspector/Secrets Manager) to Ch4 §2 and governance/compliance/cost (CloudWatch/Config/Artifact/Audit Manager/Trusted Advisor/Well-Architected Tool/Cost Explorer/Budgets) to Ch4 §3
4.3Governance and Compliance for AI
Understand governance for AI use—defining policies, monitoring and logging usage, accountability, and compliance.
To use AI safely across an organization, governance—policies, monitoring, and accountability—is essential.
4.3.1Elements of governance
- Define policies: set acceptable use, ownership, and approval for AI (who may use what, and how).
- Monitor & log: monitor usage/cost/outputs and record with AWS CloudTrail (API activity), etc.
- Accountability: people/organizations are ultimately responsible for AI outcomes. Data governance: manage the source, quality, and rights of training/usage data.
Governance is "how an organization controls AI." If the previous section’s security is technical defense, governance is the operational framework of rules, monitoring, and accountability. First define usage policies (acceptable uses, prohibitions, approval flow); then record/monitor "who used which model, when and how" with CloudTrail, etc.; finally, people/orgs own the outcomes (accountability). It also includes data governance (managing the source, quality, and rights of training/usage data) and compliance with industry regulations. These operationalize the responsible AI of section 1 at the organizational level.
| Element | What it is | Example |
|---|---|---|
| Define policies | Scope, ownership, approval | Acceptable-use policy |
| Monitor & log | Record usage/cost/outputs | AWS CloudTrail |
| Accountability | People/orgs own outcomes | Human final approval |
| Data governance | Data source/quality/rights | Manage data lineage |
Scenario: company-wide generative AI rollout. First set a usage policy (no confidential data in prompts; approval of use cases) and assign owners per department. Monitor usage and cost with CloudTrail to catch unexpected use. People make final decisions and own them (accountability). Manage the source and rights of training/reference data via data governance. Run technical defense (previous section) and organizational control (this section) together.
Watch the mix-ups: (1) Governance (operational framework of rules/monitoring/responsibility) vs the previous section’s security (technical defense)—complementary but distinct. (2) CloudTrail = activity logging (who did what). (3) Accountability = people/orgs own outcomes (don’t offload responsibility to the AI). (4) Shared responsibility applies to AI; data/access are the customer’s.
Q. Governance vs security? Security is technical defense (IAM, encryption, Guardrails); governance is operational control (policies, monitoring, accountability)—both needed. Q. Why CloudTrail? To log API activity and trace who did what, when (audits, incident response). Q. What is data governance? Managing the source, quality, rights, and lineage of training/usage data.
Common: rules for use = policies, monitoring/logging = CloudTrail, etc., responsibility for outcomes = people/orgs (accountability), managing data source/quality = data governance. The shared responsibility model applies to AI.
4.3.2In-scope governance, compliance, and cost services
AWS services that actually support governance are also in scope for AIF-C01. For monitoring/operations, besides CloudTrail (activity logs), Amazon CloudWatch monitors model operation and anomalies via metrics/logs/alarms, and AWS Config continuously evaluates resource configuration change history and compliance state. For compliance/assessment, AWS Artifact provides third-party audit reports (SOC, ISO, etc.), AWS Audit Manager continuously collects evidence to streamline audits, AWS Trusted Advisor checks recommendations across cost/security/reliability, and the AWS Well-Architected Tool assesses designs against the five pillars. For cost management, since generative AI is token-priced and costs can balloon, AWS Cost Explorer visualizes and analyzes spend while AWS Budgets alerts on threshold breaches. Map them by use: "monitoring = CloudWatch / config compliance = Config / audit material = Artifact & Audit Manager / design review = Trusted Advisor & Well-Architected Tool / cost = Cost Explorer & Budgets."
4.3.3Section summary
- Governance = define policies / monitor & log (CloudTrail) / accountability / data governance & compliance
- Security (technical) and governance (operational) go together; shared responsibility applies to AI
- Supporting services = CloudWatch/Config (monitor/compliance), Artifact/Audit Manager (audit), Trusted Advisor/Well-Architected Tool (review), Cost Explorer/Budgets (cost)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which AWS service helps record AI usage/activity so it can be traced later?
Q2. Which is NOT an element of AI governance?
Q3. How does the shared responsibility model apply to AI solutions?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.