What you need to know
Compliance for AI systems is not a statement in a design document. It is a set of controls that can be shown to work. The exam expects you to know the main regimes at an architect's level and, above all, to connect each obligation to something enforceable and provable.
The regimes you will meet
| Regime | Applies to | What it means for the architecture |
|---|---|---|
| HIPAA | US protected health information handled for covered entities | A Business Associate Agreement must cover the specific service and configuration; features outside that coverage (often beta features) cannot touch PHI |
| GDPR | Personal data of people in the EU | A lawful basis, data minimization, a data processing agreement, rights such as access and erasure, and lawful mechanisms for transfers outside the EU |
| Data residency | Contractual, regulatory or internal rules on where data is processed and stored | The model's processing location and every copy: logs, caches, traces, backups, vector stores |
| FedRAMP | US federal cloud workloads | Only routes authorized at the required impact level qualify |
| Sector and internal rules | Financial, legal, public sector, company policy | Approved vendors and routes, retention periods, privilege and audit requirements |
Note that GDPR does not by itself demand that data stay in the EU; an explicit residency requirement does. Read the requirement in the scenario carefully.
The control register
For every obligation, record four things:
| Field | Question |
|---|---|
| Obligation | What must be true? |
| Control | What enforces it, technically? |
| Owner | Who is accountable for keeping it working? |
| Evidence | What artifact proves it works, and when was it last checked? |
| Obligation | Control | Owner | Evidence |
|---|---|---|---|
| PHI only through BAA-covered services | Route and feature allowlist in the gateway; non-covered features disabled | Security lead | Signed BAA, gateway configuration, quarterly config export |
| Data stays in the approved region | Regional deployment for model calls, storage, logs, caches and vector store | Data owner | Data-flow record showing every copy; configuration screenshots; test results |
| Decisions can be explained | Decision logs with inputs, retrieved sources, outputs, routing and approver | Architect | A real decision reconstructed from production logs |
| Retention limits | Automatic deletion jobs | Platform owner | Deletion job reports |
Keep it current
Configurations drift, vendors add features, new routes appear, and evidence goes stale. Re-validate the register on a schedule and after every significant change (a new model, a new feature, a new data source).
Constraints come first
Check compliance before choosing the integration route. A route that fails a regulatory or procurement requirement is ruled out regardless of its technical merits (lesson 3.1).
In the exam
Compliance questions describe a regulated workload and offer designs or evidence. Strong answers select a route covered for the exact configuration, account for every copy of the data, and map obligations to controls, owners and evidence. Distractors rely on prompt instructions ("handle PHI carefully"), general certifications, or documentation without proof.
Check your understanding
A healthcare startup has a BAA with its AI provider and wants to use a new beta feature on patient notes. What must be checked first?
Show answer
Answer: B. BAA coverage is specific to services and features. A beta feature outside that coverage cannot process PHI, however useful it is.
Which is acceptable evidence that decisions can be explained to a regulator?
Show answer
Answer: A. Evidence must show the control working. Reconstructing an actual decision proves the logs contain what an explanation needs.
A contract requires that customer data never leave Canada. Which TWO items must the design cover besides the model call?
Show answer
Answer: A, B. Every copy of customer data counts toward residency, including observability data, embeddings, caches and backups.
Apply it: Build St. Aldric's control register
Build the control register for St. Aldric's discharge-summary drafter, using the case facts.
- List the obligations: at least five, from HIPAA, residency, audit, retention and the hospital's own rules.
- For each, name the control, the owner and the evidence.
Done when: every evidence item is something you could hand to an auditor. - Map every copy of PHI in the system, so residency can be shown.
- Set the re-validation schedule and the events that trigger an early check.
Show model answer
1 and 2. Register
| Obligation | Control | Owner | Evidence |
|---|---|---|---|
| PHI only through BAA-covered services | Claude through the hospital's AWS route under its BAA; gateway allowlist of covered features | Privacy and compliance officer | BAA, gateway configuration export, feature allowlist |
| Data stays in the US | US region for model calls, storage, logs, traces, vector index and backups | Health IT director | Data-flow record (below) and regional configuration evidence |
| Every summary signed by a physician | The EHR will not release a summary without a signature event | CMIO | Monthly report: summaries sent vs signatures recorded |
| No suggested medication changes | Output check plus pharmacy-sourced medication section (lesson 4.2) | AI product owner | Evaluation results; production check logs |
| Six-year audit trail | Immutable logs of draft, sources, edits and signer | Health IT director | Sample reconstruction of a summary from logs |
| Minimum necessary PHI | Only the stay's notes are sent; identifiers limited to what the summary needs | Privacy officer | Request payload review, quarterly |
3. Copies of PHI. EHR (source); the drafting service's request and response logs; traces in the observability tool; the evaluation dataset (de-identified, in the test environment); temporary storage of day summaries; backups of each. Every one is in the US region, and the observability tool is configured to exclude message content.
4. Re-validation. Quarterly, plus early checks after any new model or feature, a new data source, a change of observability vendor, or a change to the BAA.