Security, compliance, and governance
Compliance Standards for AI Systems
Governance builds trust, lets AI scale, and protects the organization from legal and reputational risk such as bias, privacy violations, and unintended consequences. AWS supports 143 security standards and compliance certifications.
Standards to recognize
| Standard | What it covers |
|---|---|
| NIST SP 800-53 | Security controls for US federal information systems: confidentiality, integrity, availability |
| ENISA | The EU cybersecurity agency. Drafts EU cybersecurity certification schemes |
| ISO (ISO/IEC 27002) | Recommended security management practices and controls |
| SOC reports | Independent third-party assessments of AWS controls |
| HIPAA | Protected health information in the US |
| GDPR | Privacy of EU citizens' personal data |
| PCI DSS | Payment card data, run by a council of card companies |
Why AI compliance is different
- Complexity and opacity: hard to audit how an LLM reaches its output.
- Dynamism and adaptability: models change after deployment, so static standards fit poorly.
- Emergent capabilities: unexpected abilities that no one designed.
- Unique risks: algorithmic bias (from biased training data or human bias), privacy, misinformation, job displacement.
- Algorithm accountability: laws requiring transparency, risk assessment, and human oversight, such as the EU AI Act and New York City's Automated Decision Systems law.
Regulated workloads
A workload is regulated when it must meet a framework like HIPAA, GDPR, or PCI DSS, or has regulated processes, outcomes (mortgage and credit decisions), usage (safety-critical systems), or liabilities. Common industries: financial services, healthcare, aerospace. Examples: HR, safety, and inspection workloads.
Questions to ask:
- Do you need to audit this workload?
- Do you need to archive the data for a period of time?
- Will the model's predictions count as a record?
- Does the source data include classifications restricted by internal governance, such as customer addresses?