Exam-style
A risk reviewer asks for two things before a generative feature goes live: a report mapping collected evidence to named controls, and a document stating what the model is approved to do, its risk rating, and its evaluation results. Which pair of artefacts answers that?
Reveal the answer
B. AWS Audit Manager's generative AI best practices framework v2 for the report, and a SageMaker Model Card for the approved-use record
Audit Manager’s generative AI best practices framework v2 collects evidence across Amazon Bedrock and Amazon SageMaker AI and maps it to 72 automated and 38 manual controls, grouped into eight control sets. Selected evidence exports as an assessment report in PDF, which is what a reviewer signs off. A SageMaker Model Card records intended uses, a risk rating of high, medium, low or unknown, and evaluation results in one versioned document. AI Service Cards are AWS’s own disclosures about AWS models, not a record of what your application is approved to do, and evaluation results or guardrail policies feed the report rather than standing in for it. One caveat on the tooling: Audit Manager moved to maintenance mode on 30 April 2026, and since then it cannot be set up in new accounts or new Regions, so only an existing deployment can run this assessment. AWS points new work at AWS Config conformance packs, which cover the detective controls but produce no equivalent audit report.
Q. The reviewer wants a control-mapped report and a statement of what the model is approved for. Two artefacts?
A. AWS Audit Manager’s generative AI best practices framework v2 maps evidence collected across Bedrock and SageMaker AI to controls, and exports the assessment report; a SageMaker Model Card documents intended uses, risk rating, and evaluation results. Audit Manager has been in maintenance mode since 30 April 2026, so only accounts that already had it enabled can run the assessment.
Why? Raw logs are not an audit. The framework produces the report, and the Model Card is the governance document.