Exam-style
A risk reviewer asks for two things before a generative feature goes live: a report mapping collected evidence to named controls, and a document stating what the model is approved to do, its risk rating, and its evaluation results. Which pair of artefacts answers that?
Reveal the answer
B. AWS Audit Manager's generative AI best practices framework v2 for the report, and a SageMaker Model Card for the approved-use record
Audit Manager’s generative AI best practices framework v2 collects evidence across Amazon Bedrock and Amazon SageMaker AI and maps it to 72 automated and 38 manual controls, grouped into eight control sets. Selected evidence exports as an assessment report in PDF, which is what a reviewer signs off. A SageMaker Model Card records intended uses, a risk rating of high, medium, low or unknown, and evaluation results in one versioned document. AI Service Cards are AWS’s own disclosures about AWS models, not a record of what your application is approved to do, and evaluation results or guardrail policies feed the report rather than standing in for it. One caveat on the tooling: Audit Manager is transitioning to maintenance mode, and from 30 April 2026 it can no longer be set up in new accounts, nor extended to Regions where it was not already set up, so only an existing deployment can run this assessment. AWS points new work at AWS Config conformance packs, which cover the detective controls but produce no equivalent audit report.
Q. The reviewer wants a control-mapped report and a statement of what the model is approved for. Two artefacts?
A. AWS Audit Manager’s generative AI best practices framework v2 maps evidence collected across Bedrock and SageMaker AI to controls, and exports the assessment report; a SageMaker Model Card documents intended uses, risk rating, and evaluation results. Audit Manager is in maintenance mode and closed to new accounts from 30 April 2026, so only accounts and Regions where it was already set up can run the assessment.
Why? Raw logs are not an audit. The framework produces the report, and the Model Card is the governance document.