What's changed: Initial: 4 sections for Domain 3 (AI safety, security, and governance)
3.3AI Governance and Compliance Mechanisms
Learn governance for compliance and traceability: SageMaker model cards, data lineage/catalog with Glue, CloudTrail auditing, and continuous monitoring (misuse, drift, policy violations, bias drift).
For compliance, you must trace and document which model, on which data, used how. Meet accountability with model cards, data lineage, audit logs, and continuous monitoring.
3.3.1Governance building blocks
- SageMaker model cards: document a model purpose, limitations, and risks for regulatory review.
- Data lineage: track data origin/lineage with AWS Glue (Data Catalog) and record source attribution for generated content via metadata.
- Audit logs: record API calls with CloudTrail and collect decision logs with CloudWatch Logs.
- Continuous monitoring: auto-detect misuse, drift, policy violations, and bias drift, with alerting/remediation and token-level redaction.
Common: document model purpose/limits = model cards, track data origin = Glue lineage/catalog, audit API calls = CloudTrail, continuously detect bias/behavior drift = continuous monitoring.
Governance rests on three pillars: documentation, tracing, and monitoring. Document with SageMaker model cards (purpose, limitations, risks, evaluation results) generated programmatically and aligned to org policy, regulations, and Responsible AI principles. Trace by registering data sources in AWS Glue data lineage and the Data Catalog, tagging generated content with source-attribution metadata, and retaining audit logs with CloudTrail. Monitor continuously: auto-detect misuse, model drift, policy violations, and bias drift, wiring them to CloudWatch alerts/remediation workflows, and apply token-level redaction or response-log filtering as needed. At the organizational level, establish a consistent governance framework aligned to policy to stay audit- and regulator-ready. Together this delivers explainable AI operations.
| Goal | Use | Outcome |
|---|---|---|
| Document the model | SageMaker model cards | Record purpose/limits/risks |
| Track data lineage | Glue lineage/catalog | Origin and source attribution |
| Audit API | CloudTrail | Who called what |
| Monitor behavior/bias | Continuous monitoring + CloudWatch | Drift detection and remediation |
Trap: “auditing is sufficient with just CloudWatch metric numbers” is wrong—the audit trail of who called which API is CloudTrail (config evaluation is AWS Config). Also “model cards store the model encryption keys” is wrong—they document purpose, limitations, and risks.
3.3.2Section summary
- Document = model cards / trace = Glue lineage + CloudTrail / monitor = continuous (drift/bias)
- Stay audit/regulator-ready with consistent organizational governance
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. For regulatory review, you want to systematically document each production model purpose, limitations, known risks, and evaluation results. Best option?
Q2. For compliance, you must track the origin and lineage of data referenced by the GenAI and retain source attribution. Best option?
Q3. You want to continuously detect bias drift or policy violations in production model outputs over time and respond automatically. Appropriate approach?