← Agent Frameworks 🕐 20 min read
Agent Frameworks

Bedrock Compliance, Data Residency, and Regulatory Cost Implications (2026)

1. Bedrock Data Residency Controls · March 2026

Amazon Bedrock processes model invocations in the AWS Region you specify at call time. Prompts, context, and responses do not leave that Region's infrastructure for standard invocation.

Audience: Platform engineers, general counsel, and compliance officers at regulated enterprises in financial services, healthcare, and government.

Bottom line up front: AWS Bedrock offers a credible compliance posture for regulated deployments when scoped correctly — HIPAA BAA coverage (including Bedrock as of February 2026), FedRAMP High authorization in GovCloud, SOC 2 Type II attestation, and a GDPR-compliant EU data residency path via the AWS DPA. The gaps are architectural rather than certification-level: the BAA does not self-enforce PHI boundaries, SEC Rule 17a-4 creates record-retention obligations that most teams haven’t operationalized for AI-generated content, SR 26-2 explicitly excludes GenAI from its model risk framework while signaling a follow-on RFI, and the EU AI Act’s Annex III triggers (August 2, 2026 enforcement) will classify many Bedrock-powered systems in financial services and healthcare as high-risk — requiring conformity assessments that few teams have started.

What AWS Commits To

Amazon Bedrock processes model invocations in the AWS Region you specify at call time. Prompts, context, and responses do not leave that Region’s infrastructure for standard invocation. AWS states explicitly that it does not store or log prompts and completions outside of customer-controlled services, and it does not use customer inputs to train foundation models or share them with third parties.

These commitments are encoded in:

  • AWS Service Terms (Section governing Bedrock): model invocation data is transient; no persistent storage of inputs/outputs at the service layer.
  • AWS Data Processing Addendum (DPA): incorporated into the Service Terms, covers GDPR Article 28 obligations and includes Standard Contractual Clauses (SCCs) for EU-to-third-country transfers.
  • Model Invocation Logging: when enabled, logs land in a customer-controlled S3 bucket and/or CloudWatch Logs group — AWS does not retain a copy.

Region Availability for Data Residency

Jurisdiction Primary Regions Compliance Relevance
EU (GDPR) eu-central-1 (Frankfurt), eu-west-1 (Ireland) Data stays within EU EEA; DPA + SCCs cover residual transfer risk
EU (emerging) eu-south-1 (Milan), eu-west-3 (Paris) Bedrock available; fewer foundation models in catalog
Switzerland eu-central-2 (Zurich) Cross-region inference guide published; records log to source region
Canada ca-central-1 (Montreal) PIPEDA compliance; PHIPA-relevant for Ontario health data
US Government us-gov-west-1, us-gov-east-1 (GovCloud) FedRAMP High + DoD IL-4/5 authorized as of May 2025

Critical caveat on cross-region inference: Bedrock’s cross-region inference feature routes requests to the nearest available Region when capacity is constrained in the source Region. CloudTrail and invocation logs always record in the source Region, satisfying log residency. However, the model invocation itself may execute in a different Region. For strict GDPR or sovereignty requirements, cross-region inference must be disabled. AWS provides the inferenceProfileIdentifier parameter to force single-region routing, but this is not the default.

PrivateLink: What It Prevents and What It Doesn’t

AWS PrivateLink for Bedrock (runtime endpoint; expanded February 2026 to include the bedrock-mantle endpoint) routes traffic through the AWS backbone rather than the public internet. This eliminates internet egress and satisfies regulators who require traffic to remain within the AWS network fabric.

What PrivateLink prevents:

  • Traffic leaving via NAT gateway or internet gateway
  • Public IP exposure of the calling workload
  • Data egress charges on high-volume inference

What PrivateLink does not prevent:

  • Cross-AZ traffic within a Region (Bedrock is a multi-AZ service; your VPC endpoint terminates in a specific AZ, Bedrock compute may be in another)
  • AWS’s own administrative access to the service plane
  • Cross-region inference if not explicitly disabled

Configuration checklist for strict data residency:

1. Create interface VPC endpoint for com.amazonaws.<region>.bedrock-runtime
2. Attach endpoint policy restricting to your account's principals
3. Set S3 bucket policy on invocation log bucket to deny non-VPC access
4. Add aws:RequestedRegion condition key in IAM policies to block calls to non-approved regions
5. Set cross-region inference to DISABLED in Bedrock console or via API
6. Enable VPC Flow Logs to S3 for network-level audit trail

What AWS Does Not Guarantee

  • AWS does not guarantee the specific availability zone within a region where compute executes.
  • AWS does not guarantee that Bedrock service-plane operations (capacity management, model updates) are restricted to a single region.
  • AWS does not indemnify customers against GDPR fines resulting from misconfigured cross-region inference.
  • The DPA’s SCC obligations cover transfers to non-EEA countries but do not eliminate the risk of regulatory challenges under post-Schrems II adequacy decisions.

2. FINRA, SEC Rule 17a-4, and Financial Services Compliance

SEC Rule 17a-4 and AI-Generated Content

SEC Rule 17a-4 (Exchange Act Rule 17a-4) requires broker-dealers to preserve electronic communications and records for defined retention periods in a non-rewriteable, non-erasable (WORM) format for the first two years of accessibility:

Record Type Retention Period
Customer communications (emails, chat, AI-generated output) 6 years
Order tickets, blotters 6 years
Most other broker-dealer records 3 years
Records most recently required (first 2 years) Immediately accessible

The AI-generated content question: Rule 17a-4(b)(4) requires preservation of “originals of all communications received and copies of all communications sent relating to the broker-dealer’s business.” Regulators have not issued formal guidance on whether AI-generated client communications constitute “communications sent” for 17a-4 purposes. The conservative position — and the operationally defensible one — treats any AI-generated text that reaches a client as a covered communication. This means:

  • Bedrock-generated emails, chat responses, or advisory summaries sent to clients require WORM archival.
  • The prompt that generated the response and the model version used should be preserved alongside the response for defensibility.
  • FINRA’s 2026 Annual Regulatory Oversight Report explicitly calls out AI-assisted communications as a supervision focus area.

FINRA Rule 3110 — AI Supervision

FINRA Rule 3110 requires broker-dealers to establish, maintain, and enforce a written supervisory procedures (WSP) system sufficient to supervise the activities of associated persons. FINRA’s position as of 2025–2026 is that this extends to AI systems that generate or assist in generating communications or recommendations to customers.

Practical implications:

  • WSPs must name the specific AI systems in use (including Bedrock as the hosting layer and the foundation model).
  • A designated principal must review AI-generated communications on a risk-based sampling schedule.
  • Firms must document how they detect and remediate AI hallucinations or inappropriate outputs before they reach clients.
  • If the AI system adapts based on user feedback (fine-tuning, RAG updates), the WSP must address model change management.

SR 26-2 GenAI Exclusion Gap

SR 26-2 (Revised Interagency Guidance on Model Risk Management, issued April 17, 2026, jointly by the Federal Reserve, OCC, and FDIC) is the first revision to the model risk management framework since SR 11-7 in 2011. The guidance reaffirms the core SR 11-7 principles (model development, validation, governance) and extends them to newer model types.

Critical exclusion: SR 26-2 explicitly states that generative AI and agentic AI models are “novel and rapidly evolving” and are outside the scope of this guidance. The agencies simultaneously signaled a forthcoming Request for Information (RFI) on model risk management for AI and GenAI systems.

Implication for Bedrock deployments: Banking organizations subject to SR 26-2 (generally those with >$30B in total assets regulated by the Federal Reserve) cannot point to SR 26-2 compliance as evidence of adequate governance for Bedrock-powered systems. The guidance directs institutions to apply “existing risk management and governance practices” to systems outside its scope — which, for GenAI, means SR 26-2 auditors will ask what framework the institution applied in the absence of formal guidance.

Recommended posture: Develop an internal GenAI Model Risk Policy that maps SR 26-2 principles to LLM-specific controls (pre-deployment red teaming, post-deployment drift monitoring, human oversight requirements, model card documentation). Reference NIST AI RMF 1.0 as the framework backbone until the RFI produces updated interagency guidance.

Compliance Infrastructure Cost — Financial Services Bedrock Deployment

For a broker-dealer using Bedrock for client-facing communications at moderate volume (1M invocations/month, ~2KB average prompt+response):

Component Purpose Est. Monthly Cost
CloudTrail (Data Events) Bedrock invocation audit trail ~$2/100K events = $20/1M events
S3 Object Lock (WORM) 17a-4 compliant archival; 6-year retention ~$0.004/GB-month; 2GB/1M invocations ≈ $0.008/month storage; lifecycle to Glacier Deep Archive after 2 years
S3 Glacier Deep Archive Long-term 17a-4 retention (years 2–6) ~$0.00099/GB-month
Amazon Macie PII detection on archived prompts/responses $1/GB for data scanned + $0.10/1K S3 objects
CloudWatch Logs Real-time operational audit trail $0.50/GB ingestion; $0.03/GB storage
Amazon A2I (Augmented AI) Human review queue for flagged outputs $0.14/human review task
Security Hub Compliance posture dashboard $0.0010/finding ingested

At 1M invocations/month, rough compliance overhead: $300–$600/month on a ~$3,000–$15,000/month inference cost (depending on model), yielding a compliance overhead ratio of 3–10% of inference cost at this scale. The ratio compresses at higher volume as storage and CloudTrail costs grow sublinearly relative to inference spend.

At 10M invocations/month, compliance overhead reaches approximately $2,000–$4,000/month, while inference costs scale to $30,000–$150,000, bringing the ratio down to under 3%.

3. HIPAA on Bedrock

BAA Coverage

AWS includes Amazon Bedrock in its HIPAA-eligible service list. The AWS HIPAA Eligible Services Reference was last updated February 10, 2026, and explicitly lists Amazon Bedrock and Amazon Bedrock AgentCore as HIPAA-eligible.

To process PHI through Bedrock under HIPAA coverage:

  1. Designate your AWS account as a HIPAA-eligible account in AWS Artifact.
  2. Execute (or confirm execution of) the AWS Business Associate Addendum — available through AWS Artifact, no separate negotiation required.
  3. Implement HIPAA Required Controls under the AWS Shared Responsibility Model.
  4. Confirm that the specific foundation model(s) you are using are within the HIPAA-eligible scope.

Model-specific coverage nuance: Not all foundation models available through Bedrock are covered by the BAA. Third-party model providers (Anthropic, Meta, Mistral, Cohere) each have their own sub-processor agreements with AWS. AWS’s BAA covers the Bedrock service layer. Whether the underlying model provider’s sub-processing arrangement is HIPAA-compliant must be verified per model. As of 2026, AWS has confirmed BAA coverage for Anthropic Claude models, Amazon Nova models, and Amazon Titan models running on Bedrock. Verify current coverage in AWS Artifact before deploying with any newly added model.

PHI in Prompts — Technically Allowed, High Risk

Under the executed BAA, sending PHI in Bedrock prompts is technically permissible. In practice, this carries significant risk:

  • Prompt injection: PHI in the prompt is recoverable by adversarial inputs designed to exfiltrate context.
  • Invocation log exposure: When invocation logging is enabled (required for HIPAA audit trails), PHI appears in the logged prompt. The log bucket requires its own encryption, access controls, and retention management.
  • Model output risk: Bedrock models may inadvertently surface PHI from earlier in the conversation context in unexpected outputs.
  • De-identification is the safer architecture pattern (see Section 7).

De-identification Pipeline — Cost Model

Pre-sending PHI de-identification using Amazon Comprehend Medical:

Step Service Cost
NER / entity detection Amazon Comprehend Medical DetectPHI $0.01/100 characters (~$10/1M characters)
Custom NER (supplemental) SageMaker endpoint (ml.m5.large) ~$0.10/hr = ~$75/month always-on
Re-identification mapping DynamoDB (token ↔ PHI store) $1.25/million writes; $0.25/million reads
Encryption at rest (token store) KMS $1/month/key + $0.03/10K API calls

For a healthcare application processing 500K patient queries/month at ~200 characters average prompt, Comprehend Medical PHI detection costs approximately $1,000/month. This adds 7–20% to inference cost but eliminates the highest-risk exposure pattern.

Bedrock Guardrails for HIPAA PII Redaction

Bedrock Guardrails’ sensitive information filters detect and redact 50+ PII entity types, including PHI-relevant types: name, date of birth, SSN, medical record number, phone, address, and medical information. Guardrails pricing is included in the Bedrock service charge (no additional per-request fee for PII redaction as of 2026). Guardrails apply at the API layer before the prompt reaches the model and before the response is returned, providing bidirectional PII interception.

Guardrails limitation: Guardrails perform pattern-matching and contextual entity detection. They do not perform semantic de-identification or replace PHI with synthetic surrogates in a way that preserves clinical meaning for downstream NLP. For structured clinical workflows, Comprehend Medical plus a token-restore pipeline remains the stronger architecture.

HIPAA Audit Trail Requirements

HIPAA Security Rule §164.312(b) requires audit controls that record and examine activity in information systems containing PHI. For Bedrock deployments, the minimum audit trail consists of:

  • CloudTrail Data Events on Bedrock API calls (InvokeModel, InvokeModelWithResponseStream): records who invoked, when, from which IAM principal, which model, and the API parameters (but not payload content).
  • Bedrock Invocation Logging (opt-in): records prompt and response content to customer-controlled S3/CloudWatch Logs. Required for HIPAA §164.312(b) compliance because CloudTrail alone does not capture the content of the request.
  • S3 Object Lock (WORM) on the invocation log bucket: HIPAA does not specify WORM storage, but it is best practice and defensible under audit.
  • KMS encryption (CMK required, not AWS-managed key): enables independent key rotation audit and supports separation of duties between storage and decryption.
  • CloudWatch Alarms on IAM-denied Bedrock calls: anomaly detection for access control violations.

4. EU AI Act and GDPR Implications for Bedrock

GDPR Compliance Path

AWS’s GDPR compliance framework for Bedrock rests on three instruments:

  1. AWS Data Processing Addendum (DPA): Incorporated into AWS Service Terms. Covers GDPR Article 28 processor obligations. Updated to include Standard Contractual Clauses (SCCs, 2021 EU Commission version) for any transfers outside the EEA. No separate negotiation is required — the DPA applies by accepting the Service Terms.

  2. EU Region data residency: When calling Bedrock in eu-central-1 or eu-west-1, model invocation processing stays within the EU. The DPA’s SCC module covers residual risk from AWS service-plane operations that may involve US personnel with administrative access to infrastructure.

  3. Right to erasure (GDPR Article 17): Bedrock does not persist prompt/response data. However, if invocation logging is enabled to S3, those logs contain processing records. Erasure requests must account for log retention — implement S3 lifecycle policies and Object Lock expiration aligned to the minimum required retention period.

GDPR Article 22 — Automated Decision-Making

Article 22 restricts decisions based “solely on automated processing” that produce “legal or similarly significant effects” on individuals. A Bedrock-powered system that:

  • Automatically denies a loan application
  • Denies a healthcare claim without human review
  • Generates a performance evaluation that feeds directly into an employment decision

…triggers Article 22. The controller must provide:

  • Meaningful information about the logic involved
  • The right to obtain human review of the decision
  • The right to contest the decision

EU AI Act and GDPR operate concurrently for high-risk systems. Article 22 compliance is a floor; for systems that also qualify as high-risk under the AI Act, full conformity assessment obligations layer on top.

EU AI Act — High-Risk Classification Under Annex III

The EU AI Act’s Annex III high-risk system list is in full enforcement as of August 2, 2026 for providers and deployers of high-risk systems. Bedrock-powered systems that fall under Annex III:

Use Case Annex III Category Trigger
Credit scoring, loan eligibility assessment Financial services (creditworthiness evaluation) Any automated scoring with legal/financial effect
Insurance risk pricing (life, health) Financial services (risk assessment and pricing) Actuarial or AI models affecting premium or coverage
Healthcare eligibility, treatment recommendations Healthcare / essential services AI affecting access to or quality of healthcare services
Employment screening, performance evaluation Employment and workers management AI affecting hiring, promotion, or performance outcomes
Benefits eligibility assessment Essential public services AI affecting access to public or private essential services

For financial services specifically: A Bedrock-powered system that assists in credit underwriting, generates risk narratives fed into loan decisions, or automates portions of KYC/AML review is likely a high-risk system under Annex III. The provider (if custom-deploying) or deployer (if using a third-party Bedrock application) bears the conformity assessment obligation.

EU AI Act Conformity Assessment Requirements for High-Risk Systems

For self-assessed high-risk systems (the majority of Annex III cases not involving biometrics or critical infrastructure where third-party assessment is mandatory):

  • Technical documentation: Full system documentation covering training data, model architecture, performance benchmarks, known limitations, and intended use. For Bedrock-hosted foundation models, AWS provides model cards; the deployer must document the application layer.
  • Fundamental rights impact assessment: New requirement under the Act; required before deploying high-risk systems.
  • Human oversight measures: Technical mechanisms enabling human operators to understand, monitor, and override the AI system. For Bedrock deployments, this maps to Amazon A2I integration or equivalent human review queues.
  • Accuracy, robustness, and cybersecurity: Ongoing performance monitoring; incident reporting obligations.
  • EU Database registration: High-risk AI systems must be registered in the EU AI Act database before deployment.
  • Quality management system (QMS): Required for providers (those who develop and deploy under their own name).

Enforcement and penalties:

  • Non-compliance with high-risk obligations: up to €15 million or 3% of global annual turnover.
  • Prohibited practices or serious violations: up to €35 million or 7% of global annual turnover.
  • Providing false information to notified bodies or authorities: up to €7.5 million or 1% of turnover.

Conformity assessment program cost estimate (mid-complexity system):

  • External legal/compliance counsel: $50,000–$150,000 for initial assessment and documentation
  • Technical documentation authoring: 200–400 person-hours internal engineering
  • Fundamental rights impact assessment: $25,000–$75,000 (external consultant) or equivalent internal
  • QMS implementation (if not already ISO 9001 certified): $30,000–$80,000
  • Ongoing annual compliance program: $20,000–$60,000/year for monitoring and audit
  • Total Year 1 cost range for a single high-risk Bedrock system: $125,000–$365,000

5. SOC 2 Type II for AI Systems

AWS Bedrock’s Own Certifications

AWS maintains the following certifications covering Amazon Bedrock:

  • SOC 2 Type II (available via AWS Artifact — no additional charge)
  • SOC 3 (publicly available)
  • ISO 27001, 27017, 27018
  • FedRAMP High (GovCloud regions; Claude 3.5 Sonnet v1, Claude 3 Haiku, Llama 3 8B/70B, Bedrock Agents/Guardrails/Knowledge Bases)
  • DoD CC SRG IL-4/IL-5 (GovCloud)
  • HIPAA BAA
  • PCI DSS

AWS Artifact provides audit reports on demand. The AWS SOC 2 report covers the service layer infrastructure; it does not cover how a customer deploys Bedrock or the data flows within a customer’s application.

Scoping Bedrock Into Your Own SOC 2

When a customer builds a SOC 2-scoped system on Bedrock, auditors expect:

Trust Services Criteria (TSC) mapping for AI-specific controls:

TSC Criterion AI-Specific Control Expectation
CC6.1 (Logical and physical access) IAM policies restricting Bedrock model access; VPC endpoint policies; least-privilege for InvokeModel
CC6.6 (Logical access for external users) Review of Bedrock foundation model sub-processors; AWS SOC 2 report as compensating evidence
CC7.2 (System monitoring) CloudWatch alarms on Bedrock error rates, latency, and anomalous invocation volume
CC8.1 (Change management) Model version pinning; change tickets for switching foundation models; prompt template version control
A1.2 (Availability) Bedrock SLA monitoring; fallback model or region configuration
C1.1–C1.2 (Confidentiality) Invocation log encryption (KMS CMK); access controls on log bucket; Guardrails PII redaction
P3.1–P3.2 (Privacy, collection) Data minimization in prompts; PHI/PII de-identification pipeline before Bedrock

Emerging AI-specific SOC 2 evidence auditors now request (2026):

  1. Model registry with version, training timestamp, dataset identifiers, approval trail for each model version deployed to production.
  2. Prompt template version control with change history and approvals.
  3. Drift monitoring records: evidence that model output quality is measured over time (e.g., downstream task accuracy, Bedrock Guardrails violation rate trends).
  4. Red team / adversarial testing records: evidence of pre-deployment evaluation for prompt injection, jailbreaks, and hallucination rates.
  5. Vendor risk assessment for foundation model providers (Anthropic, Meta, etc.) as material sub-processors.
  6. Incident records for any Guardrails-triggered violations that reached human review.
  7. Training completion records for personnel operating the AI system.

SOC 2 Scope Expansion Cost Estimate

Adding Bedrock to an existing SOC 2 Type II scope (assuming mature existing SOC 2 program):

Item Effort/Cost
Scoping workshop with auditor $5,000–$15,000
Control gap assessment for AI-specific criteria 80–150 engineering/compliance hours
Evidence automation tooling (CloudTrail queries, model registry integration) $10,000–$30,000 one-time engineering
Auditor incremental fee for expanded scope $15,000–$40,000/year
Ongoing evidence collection tooling maintenance $5,000–$10,000/year
Total Year 1 incremental cost $35,000–$100,000

6. Compliance Infrastructure Cost Model

Component-Level Cost Table

All estimates based on AWS public pricing (US East/West; EU pricing is 5–15% higher for equivalent services).

Service Pricing Unit Unit Cost
CloudTrail (Data Events) Per 100,000 events $0.10
S3 Standard Per GB-month $0.023
S3 Object Lock (WORM) No additional charge; priced as S3 Standard —
S3 Glacier Instant Retrieval Per GB-month $0.004
S3 Glacier Deep Archive Per GB-month $0.00099
Amazon Macie (data scanning) Per GB scanned $1.00
Amazon Macie (S3 object evaluation) Per 1,000 objects $0.10
CloudWatch Logs ingestion Per GB $0.50
CloudWatch Logs storage Per GB-month $0.03
Amazon A2I (human review) Per task $0.14
Amazon Comprehend Medical DetectPHI Per 100 characters $0.01
AWS KMS (CMK) Per key/month + API calls $1.00/key + $0.03/10K calls
AWS Config Per configuration item $0.003
Security Hub Per finding $0.0010

Total Compliance Overhead at Scale

The following models assume: Bedrock model invocations with average 2KB prompt+response (2,000 characters), 70% captured in invocation logs, Macie scans run weekly on the log bucket.

Small deployment (100K invocations/month):

Component Monthly Cost
CloudTrail Data Events $0.10
S3 invocation log storage (0.2 GB) $0.005
CloudWatch Logs ingestion (0.14 GB) $0.07
Macie (weekly scan, 0.2 GB) $0.80
KMS (1 key + ~10K calls) $1.03
Total compliance overhead ~$2/month
Inference cost (Claude Haiku @ $0.80/$4 per 1M) ~$80–$500/month
Overhead as % of inference 0.4–2.5%

Medium deployment (1M invocations/month):

Component Monthly Cost
CloudTrail Data Events $1.00
S3 invocation log storage (2 GB) $0.046
CloudWatch Logs ingestion (1.4 GB) $0.70
Macie (weekly scan, 8 GB) $8.00
KMS $1.03
A2I (1% of invocations flagged for review = 10K tasks) $1,400
Comprehend Medical PHI de-identification (if enabled, 200M characters) $20,000
Total compliance overhead (without PHI pipeline) ~$11/month
Total compliance overhead (with PHI pipeline + A2I) ~$21,400/month
Inference cost (Claude Sonnet @ $3/$15 per 1M; mixed input/output) ~$9,000–$18,000/month
Overhead as % of inference (without PHI pipeline) <0.1%
Overhead as % of inference (with PHI pipeline + A2I) 50–120% (PHI pipeline dominates)

Key insight: The Comprehend Medical PHI de-identification pipeline and A2I human review are the dominant compliance cost factors at scale, not the audit trail infrastructure. Teams that can reduce A2I sample rate to 0.1% of invocations and implement smart PHI pre-screening (flag only records with known PHI markers before running full Comprehend Medical) can reduce compliance overhead to under 10% of inference cost even at high volume.

Large deployment (10M invocations/month, financial services, no PHI pipeline):

Component Monthly Cost
CloudTrail Data Events $10
S3 WORM storage (20 GB new/month; 7-year retention, tiered to Glacier after 2 years) ~$25/month blended
CloudWatch Logs ingestion $7
Macie (weekly scan, 80 GB) $80
KMS $2
Security Hub + Config ~$300
Total compliance overhead ~$430/month
Inference cost (Claude Sonnet, mixed load) $90,000–$150,000/month
Overhead as % of inference <0.5%

For financial services deployments, the significant cost is not the AWS tooling — it is the labor: compliance analyst review of flagged outputs, legal review of AI-generated communications, and the 17a-4 archival system integration with WORM-compliant archival vendors (Smarsh, Global Relay, Veritas) that sit upstream of the S3 bucket. Those vendor contracts typically run $50,000–$200,000/year for mid-size broker-dealers, independent of Bedrock volume.

7. Compliance-Aware Architecture Patterns

Pattern 1: PHI-Safe Bedrock Pipeline (Healthcare)

┌─────────────────┐    ┌──────────────────────────┐    ┌──────────────────────────┐
│  Patient Input  │───▶│  Comprehend Medical /     │───▶│  Token Replace           │
│  (may contain   │    │  Bedrock Guardrails       │    │  PHI → <TOKEN_XXX>       │
│  PHI)           │    │  PHI Detection            │    │  Store map in DynamoDB   │
└─────────────────┘    └──────────────────────────┘    └──────────────┬───────────┘
                                                                       │
                                                        ┌──────────────▼───────────┐
                                                        │  Bedrock InvokeModel     │
                                                        │  (de-identified prompt)  │
                                                        │  via PrivateLink         │
                                                        └──────────────┬───────────┘
                                                                       │
┌─────────────────┐    ┌──────────────────────────┐    ┌──────────────▼───────────┐
│  Final Response │◀───│  Token Re-substitution   │◀───│  Bedrock Response        │
│  (PHI restored  │    │  (DynamoDB lookup)       │    │  (no PHI in response)    │
│  for context)   │    └──────────────────────────┘    └──────────────────────────┘
└─────────────────┘
         │
         ▼
┌─────────────────────────────────┐
│  Invocation Log (de-identified) │
│  S3 WORM bucket, KMS-CMK       │
│  CloudTrail Data Events         │
└─────────────────────────────────┘

Key properties: PHI never enters Bedrock in plaintext. Invocation logs contain only de-identified prompts. Token map in DynamoDB is the high-risk store — encrypt at rest (KMS CMK), enable point-in-time recovery, restrict IAM access to only the re-identification service.

Pattern 2: SEC 17a-4 Compliant Communication Pipeline (Financial Services)

┌──────────────────────────────────────────────────────────────────┐
│  Client Communication Request (advisor drafts or AI-generates)   │
└───────────────────────────────┬──────────────────────────────────┘
                                │
                    ┌───────────▼───────────┐
                    │  Bedrock InvokeModel  │
                    │  (prompt + context)   │
                    │  PrivateLink VPC EP   │
                    └───────────┬───────────┘
                                │
              ┌─────────────────┼─────────────────────────────────┐
              │                 │                                   │
  ┌───────────▼────────┐  ┌─────▼──────────────┐  ┌──────────────▼──────────┐
  │  Invocation Log    │  │  Compliance Check   │  │  Draft Response         │
  │  S3 Object Lock    │  │  (Guardrails +      │  │  to advisor/UI          │
  │  (WORM, 6yr)       │  │  custom rules)      │  └─────────────────────────┘
  │  KMS-CMK encrypted │  └─────────┬───────────┘
  └────────────────────┘            │
                           ┌────────▼────────┐
                           │  Flagged?       │
                           │  ──────────     │
                           │  YES → A2I     │
                           │  (human review) │
                           │  NO → Archive  │
                           └────────┬────────┘
                                    │
                    ┌───────────────▼───────────────┐
                    │  Communication Archive         │
                    │  (17a-4 WORM + FINRA Rule 4511)│
                    │  S3 Object Lock OR             │
                    │  Smarsh/Global Relay connector │
                    └───────────────────────────────┘

Model version pinning: Pin to a specific Bedrock model version (e.g., anthropic.claude-3-5-sonnet-20241022-v2:0) and log the model ARN with each invocation. When a client challenges an AI-generated communication six years later, you must be able to reconstruct which model produced it.

Pattern 3: SOC 2 Evidence Collection Automation

# Example: CloudTrail query for SOC 2 auditor evidence request
# "Provide all Bedrock invocations by privileged users in the past 90 days"

import boto3

client = boto3.client('cloudtrail')
response = client.lookup_events(
    LookupAttributes=[
        {'AttributeKey': 'EventName', 'AttributeValue': 'InvokeModel'},
    ],
    StartTime=start_time,
    EndTime=end_time,
    MaxResults=50
)

# Filter for privileged IAM roles
privileged_events = [
    e for e in response['Events']
    if any(role in e['CloudTrailEvent']
           for role in PRIVILEGED_ROLE_ARNS)
]

Automate this query as an AWS Lambda function triggered by a tag on audit-period S3 objects. Output directly to a PDF report signed by KMS for tamper-evidence. Reduces auditor evidence turnaround from 5–10 business days to same-day.

Pattern 4: Cost-Optimized Compliance Sampling

Not all invocations require deep audit processing. A tiered approach reduces Macie and Comprehend Medical costs significantly:

Tier Trigger Processing
Surface-level (100%) All invocations CloudTrail + invocation log to S3 WORM. No Macie scan.
Mid-level (10%) Random sample Macie PII scan on log content. Flag for review queue if PII detected.
Deep audit (1%) High-risk signals: large tokens, anomalous latency, specific user segments, Guardrails flags Full Macie + Comprehend Medical + A2I human review

This reduces Macie cost by 90% and Comprehend Medical cost by 99% versus scanning all invocations, while maintaining defensible audit coverage. Document the sampling methodology and statistical confidence intervals in the compliance program documentation — auditors accept risk-based sampling when the methodology is sound.

Summary: Compliance Posture Assessment Matrix

Regulatory Requirement Bedrock Native Support Customer Action Required Residual Risk
HIPAA BAA ✅ BAA available, Bedrock HIPAA-eligible Execute BAA; enable invocation logging; implement PHI de-identification PHI in prompts if de-identification skipped
GDPR data residency ✅ EU regions available; DPA + SCCs in Service Terms Disable cross-region inference; use PrivateLink; select EU region AWS admin access to service plane (SCC mitigated)
EU AI Act (high-risk) ⚠️ Guardrails + model cards assist Full conformity assessment, technical documentation, FRIA, EU DB registration Penalty risk if high-risk classification missed
GDPR Article 22 ⚠️ No native A2I in Bedrock Integrate A2I or equivalent human oversight; document logic disclosure Automated decision without human override = violation
SEC Rule 17a-4 ⚠️ S3 Object Lock enables WORM Configure WORM bucket; archive AI-generated communications; pin model versions No formal SEC guidance on AI-generated content scope
FINRA Rule 3110 ⚠️ No native supervision feature Update WSPs; implement sampling review; document model governance Exam finding risk if AI supervision not documented
SR 26-2 (GenAI) ❌ Explicitly excluded from scope Build internal GenAI MRM policy; reference NIST AI RMF Regulatory gap until RFI produces updated guidance
FedRAMP High ✅ GovCloud; specific models authorized Use GovCloud regions; confirm model authorization status Non-GovCloud deployments not FedRAMP covered
SOC 2 Type II ✅ AWS SOC 2 report in Artifact Scope Bedrock into own SOC 2; build AI-specific controls Auditors adding AI criteria; emerging evidence requirements
PCI DSS ✅ PCI DSS certified Implement cardholder data isolation from prompts Cardholder data in prompts creates in-scope Bedrock

Sources