1.3.2. Shared Responsibility and the Cloud Adoption Framework for AI
💡 First Principle: Whenever two parties operate a system together, failures happen in the gaps where each assumes the other is responsible. The AWS shared responsibility model removes that ambiguity: AWS is responsible for security of the cloud, and the customer is responsible for security and appropriate use in the cloud. The AWS Cloud Adoption Framework (AWS CAF) applies the same discipline to the organization: it names the capabilities, beyond technology, that a business must build to adopt cloud and AI successfully.
The shared responsibility model applied to AI. Using a managed service changes how much you operate, not whether you are accountable for your use of it.
| Responsibility | AWS | Customer |
|---|---|---|
| Physical data centers, hardware, global network | ✅ | |
| Security and availability of the managed AI service itself | ✅ | |
| Foundation model hosting and patching (managed services) | ✅ | |
| What data you send to the model and whether you are allowed to use it | ✅ | |
| Who can access the AI application, its data, and its outputs | ✅ | |
| How the service is configured (guardrails, logging, encryption choices) | ✅ | |
| Whether the use case is appropriate, fair, and lawful | ✅ | |
| How outputs are reviewed, used, and communicated to customers | ✅ |
The more you build yourself, the more of the stack moves into your column. With SageMaker AI you also own the model's training data, evaluation, and behavior; with Bedrock you own your prompts, retrieval data, and guardrail settings; with an application like Amazon Quick you still own access, data connections, and how employees use results. At every layer, compliance with laws that govern your use case (privacy, anti-discrimination, sector regulation) remains yours.
The AWS Cloud Adoption Framework for AI. AWS CAF organizes organizational capabilities into six perspectives: Business, People, Governance, Platform, Security, and Operations. The first three are business-facing; the last three are technical. AWS published an AI-specific version (CAF-AI) that enriches existing capabilities and adds new ones that AI demands, such as responsible use of AI under Governance and AI-oriented product management under Business. CAF-AI also describes an adoption journey that iterates through envisioning opportunities, aligning the organization, launching pilots, and scaling what works. You will use CAF thinking throughout Domain 4 when assessing readiness and planning transformation.
Why does a framework matter on a business exam? Because it changes the question from "Is our technology ready?" to "Are our people, governance, and operating model ready?" Organizations rarely stall on AI because the cloud is missing; they stall because sponsorship, skills, data ownership, or governance are missing.
⚠️ Exam Trap: If a scenario implies that AWS is accountable for biased outputs, unlawful data use, or employees' access to sensitive information because "the service is managed," reject that option. Those responsibilities stay with the customer. Likewise, an answer that treats AI readiness as a purely technical (Platform) question ignores five of the six CAF perspectives.
Reflection Question: A company uses a managed generative AI service to summarize customer complaints, and an employee pastes in a customer's full medical history. Under the shared responsibility model, whose responsibility was it to prevent that, and which CAF perspectives would you involve in fixing it?
