AI on AWS compliant with GDPR and the AI Act

Running a model in the cloud does not make a system compliant with GDPR or the AI Act. AWS secures the infrastructure, while the organisation remains responsible for data scope, service configuration, permissions, retention, monitoring and the way people use the output. Private by design is a set of architectural decisions and evidence, not a property of an AWS account.

This review uses official AWS documentation checked on 30 July 2026. Service and feature availability changes, so confirm the selected Region, model and inference profile again before deployment.

Reference architecture

A typical system has several layers:

1. Input through API Gateway, with authentication, throttling and validation.
2. Documents in S3, encrypted and versioned with restricted access.
3. Extraction through Textract when sources are scans or forms.
4. Retrieval and metadata, such as a knowledge index and DynamoDB for workflow state.
5. Inference in Amazon Bedrock, using an explicitly selected model and routing mode.
6. Guardrails as an additional input/output control — not a replacement for authorisation, evaluation or human oversight.
7. CloudWatch, CloudTrail and optional model invocation logs, configured so that evidence does not become an uncontrolled copy of sensitive data.

Do not assume that Bedrock support in a Region means that every model, Guardrails, Textract and supporting feature is available there. Check the official Region tables separately for Amazon Bedrock, Amazon Textract, Amazon S3, Amazon DynamoDB, Amazon CloudWatch and Amazon API Gateway.

Data location: single-Region is not cross-Region

Amazon Bedrock supports in-Region inference and cross-Region inference profiles. The cross-Region inference documentation distinguishes between:

• a geographic profile, which may route a request to a commercial AWS Region inside a specified geography such as the EU; and
• a global profile, which may use any supported commercial AWS Region.

“EU geographic” does not mean “one named Region”. If policy requires processing only in eu-central-1, do not use a cross-Region profile without a documented exception. Invoke a model available in that Region and verify that the entire chain — OCR, storage, retrieval, logs and backup — follows the same rule. When a cross-Region profile is used, SCPs must allow the destination Regions in the profile or requests may fail.

What Bedrock does with prompts — and what that does not solve

AWS states in the Bedrock data protection documentation that inputs and outputs are not used to train or improve base foundation models. This does not automatically mean zero retention or no provider data sharing for every model. The current data-retention documentation distinguishes model- and configuration-dependent modes: none, default, inherit and provider_data_share. none means that AWS does not persist the request and response or share them with the provider; default follows the model’s policy, while provider_data_share allows retention and provider sharing. Before deployment, check the selected model’s allowed_modes and the effective project or account setting. The API parameter store=false is not by itself proof of zero data retention. The abuse-detection documentation also describes exceptions for content flagged by safety mechanisms.

Regardless of the Bedrock mode, your application may still write content to S3, DynamoDB, a vector index, CloudWatch, an APM tool, chat history or a ticketing system. A separate feature is model invocation logging. It is disabled by default; when enabled, it can store full request data, response data and metadata in CloudWatch Logs or S3. Before enabling it, define scope, access, retention, encryption and redaction. “Bedrock does not train on prompts” does not mean “there is no copy of the prompt anywhere”.

IAM, PrivateLink and KMS are different controls

• IAM limits who, in which role, may invoke a model, read a document or change configuration. The customer defines least-privilege policies, environment separation and access-removal procedures.
• VPC endpoints through AWS PrivateLink let workloads reach Bedrock without exposing traffic to the public internet. See Protect your data using Amazon VPC and AWS PrivateLink. A private network path does not alter the routing rules of a selected cross-Region profile and does not replace authorisation.
• KMS and service encryption protect data at rest. A customer-managed key can add control over policy and audit, but it requires correct permissions, rotation, backup and failure handling. It does not automatically protect data copied to resources outside its scope.

CloudTrail is not a model-content log

CloudTrail for Amazon Bedrock records API activity and helps determine, among other things, who performed an operation, when and from which IP address. Event history is available for management events, but high-volume runtime invocations are data events and are not logged by default without the appropriate configuration. CloudTrail should not be described as an automatic record of every full prompt and completion.

If content is needed for quality control, enable invocation logging separately or store a bounded application artifact. A safer default is to record the request identifier, user or role, system and model version, source identifiers, policy result, escalation and human decision. Full content belongs in a log only when it has a justified purpose, legal basis, restricted access and deletion date.

The shared responsibility model in practice

The AWS Shared Responsibility Model separates security of the cloud from security in the cloud. For an AI system, this produces the following division:

Area	AWS	Customer deploying AI
Physical infrastructure, hosts and managed-service layer	operates and protects cloud infrastructure	verifies requirements and supplier evidence
Region and inference-profile selection	offers Regions, models and routing mechanisms	chooses a compliant route and tests the whole chain
IAM and data access	provides IAM and activity-logging mechanisms	defines roles, policies, separation of duties and access reviews
Inputs and knowledge base	protects the underlying managed services and exposes the model’s supported retention modes	minimises data and owns legal basis, quality, versions, model selection, allowed_modes and the effective retention mode
Logs	provides CloudTrail, CloudWatch, S3 and invocation logging	decides what to log, redact, retain, restrict and monitor
Answer quality	runs the selected model and Guardrails features	owns golden sets, thresholds, evaluations, human oversight and error response
AI Act and GDPR	supplies AWS service compliance documentation	classifies the use, identifies legal roles, performs DPIA/LIA where needed, informs people and keeps evidence

Guardrails are a layer, not an AI policy

Guardrails for Amazon Bedrock can apply content filters, denied topics and sensitive-information controls. They need versioning and tests against your own cases. A guardrail does not decide who may see a document, whether a citation supports a claim or whether a business decision requires approval. We explain the distinction in Guardrails are not AI policy.

Minimum Evidence Pack before production

Before a go/no-go decision, retain:

• a data-flow diagram with Regions and services;
• the selected models, inference profiles and destination Regions;
• the IAM matrix and negative access-test results;
• logging configuration with retention and redaction rules;
• the source, version and data-owner register;
• the golden set, quality thresholds, results and critical errors;
• human-approval, rollback and incident-response rules;
• Guardrails versions and bypass-test results; and
• the process owner’s decision and the next review date.

This pack shows that controls work in one concrete configuration. A cloud certificate or service list alone does not prove compliance of the deployment.

How we start

We start with data and decision flows, not the statement “everything stays in AWS”. During an AI readiness audit, we set Regions, sources, permissions, retention, use classification and acceptance metrics. Only then do we build a bounded proof of concept and check whether the architecture passes the recorded gates.