Title: AWS re:Inforce 2024 - Navigating privacy and compliance while securing gen AI applications (GAI201)

Insights:

• Session Overview: The session focused on navigating privacy and compliance in generative AI applications, expanding on a previous lightning talk.
• Generative AI Scoping Matrix: Introduced a five-scope model to categorize generative AI applications:
  • Scope 1: Consumer apps with no specific agreements.
  • Scope 2: Enterprise apps with formal agreements.
  • Scope 3: Pre-trained models used as-is.
  • Scope 4: Fine-tuned or customized models.
  • Scope 5: Self-built and trained models.
• Data Privacy Considerations:
  • Scope 1 & 2: Focus on understanding data classification, access control, and terms of data usage by providers.
  • Scope 3 & 4: Emphasize role-based access control, prompt and response handling, and careful selection of training data.
  • Scope 5: Full responsibility for data sourcing, training, and compliance with responsible AI practices.
• Regulatory and Compliance:
  • Legal and Regulatory Churn: Over a thousand pieces of legislation across 69 countries are being written, emphasizing the need for continuous vigilance.
  • Cloud Center of Excellence (CCOE): Recommended to include legal expertise to navigate complex regulations.
  • Key Themes in Legislation:
    • Data Privacy: Avoid recording unnecessary data, use tools like AWS Macy for PII discovery.
    • Transparency and Explainability: Ensure consumers know they are interacting with AI, document data sources and model training processes.
    • Automated Decision and Human Oversight: Maintain human intervention points to correct AI decisions impacting legal rights.
    • Regulatory Classification: Understand and comply with high-risk workload regulations.
    • Profiling: Be cautious with personal data, especially sensitive characteristics.
    • Safety: Ensure independent verification for AI systems that could impact safety, such as autonomous vehicles.
• Practical Tools and Resources:
  • AWS Services: Bedrock, SageMaker Clarify, and Audit Manager for compliance and best practices.
  • External Resources: ISO standards, Information Commissioner's Office guidelines, and executive orders for safety.

Quotes:

• "We stand between you and a whole bunch of drinks and fun in the expo. So much appreciate you being here."
• "It's a mental model, and like all models, it's wrong. But some models are useful, as someone once said."
• "An important point here is who has access to data. So typically an enterprise application... will have role-based access control which segregates data."
• "The rule of thumb here is if there's any data that goes into the model and into the model, I mean makes its way into the model weights, you should assume that that data can and will come out through prompting."
• "When it comes to artificial intelligence and generative AI, with all that legal churn going on, we want your projects to be successful."
• "The easiest mitigant for this is exactly what it says on the slide. Don't record what you do not need."
• "The right of appeal is important, and the right of human intervention is important too."
• "We want you to be successful in your AI workloads and not run afoul of these laws because your success is a success for us as well."
• "Safety is definitely very highly considered in the US, and generally speaking the US is taking a bit of a different tack with AI regulation to what Europe has done."