Exam-style
A risk reviewer asks for two things before a generative feature goes live: a report mapping collected evidence to named controls, and a document stating what the model is approved to do, its risk rating, and its evaluation results. Which pair of artefacts answers that?
Reveal the answer
B. AWS Audit Manager's generative AI best practices framework for the report, and a SageMaker Model Card for the approved-use record
Audit Manager’s generative AI best practices framework collects evidence continuously and maps it to controls, which is what turns raw logs into an assessment report a reviewer can sign. The Model Card is the governance document that states intended use, risk rating, and evaluation results in one place. AI Service Cards are AWS’s own disclosures about their models, not a statement of what your application is approved to do, and evaluation results or guardrail policies are inputs to the story rather than the audit artefact itself.
Q. The reviewer wants a control-mapped report and a statement of what the model is approved for. Two artifacts?
A. AWS Audit Manager’s generative-AI best-practices framework maps collected evidence to controls and produces the assessment report; a SageMaker Model Card documents intended use, risk rating, and evaluation results.
Why? Raw logs are not an audit; the framework makes the report, and the Model Card is the governance document.