AWS Artifact now includes Assurance Assistant for compliance inquiries
AI-generated, citation-backed answers to compliance questionnaires — free, in minutes, sourced directly from AWS SOC, ISO, and C5 docs.
View original announcement →Visual Summary
graph TD
A{{Assurance Assistant}}:::announced
B((Compliance Users)):::external
C([Single-Question Mode]):::feature
D([Questionnaire Upload]):::feature
E(AWS Artifact):::compute
F(IAM Access Control):::compute
G([Citation-Backed Responses]):::feature
H([XLSX Export]):::feature
B ==>|"submits questions"| A
A -->|"hosted within"| E
A -->|"immediate query"| C
A -->|"bulk XLSX processing"| D
C -->|"generates"| G
D -->|"generates"| G
G -.->|"exports to"| H
F -->|"controls access"| A
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
AWS Artifact has launched Assurance Assistant, an AI-powered capability that generates citation-backed answers to security and compliance questions about AWS services. It is designed to accelerate vendor assessments and due diligence questionnaire (DDQ) completion by grounding responses in verified AWS compliance documentation such as SOC reports, ISO certifications, and C5 attestation packages. The feature supports both single-question and bulk questionnaire upload modes, and is available at no additional charge to all AWS customers.
How It Works
- Question Mapping: Assurance Assistant maps each submitted question to relevant AWS security controls, then searches across verified AWS compliance documentation to construct a substantive response.
- Single-Question Mode: Users can submit individual compliance questions directly in the AWS Artifact console and receive immediate, on-screen responses with source citations.
- Questionnaire Upload Mode: Users can upload XLSX files containing bulk questions — including industry-standard formats like CAIQ (Consensus Assessments Initiative Questionnaire) and SIG (Standardized Information Gathering) — for batch processing.
- Citation-Backed Responses: Every response includes citations pointing to specific source documents (SOC reports, ISO certifications, C5 attestation packages), enabling independent verification of the information provided.
- Export Flexibility: Completed responses can be exported selectively or in full, with or without citations, preserving the original XLSX file format for easy downstream use.
- IAM Access Control: Two new IAM managed policies —
AWSArtifactComplianceInquiriesReadOnlyAccessandAWSArtifactComplianceInquiriesFullAccess— allow administrators to grant appropriately scoped permissions to different user roles. - Scope Limitation: Assurance Assistant addresses questions about AWS's own security controls, compliance posture, and operational practices; it does not answer questions about customer-side implementation or non-compliance-related topics.
Why It's Important
- Dramatic Time Savings: Vendor assessments and DDQ completion traditionally take weeks of manual research; Assurance Assistant compresses this to minutes by automating the lookup and synthesis of AWS compliance evidence.
- Reduced Human Error: By grounding responses in verified documentation rather than relying on individual knowledge, the tool reduces the risk of inaccurate or outdated answers in compliance submissions.
- Audit-Ready Evidence Trail: Built-in citations allow auditors and reviewers to trace every answer back to its authoritative source document, strengthening the defensibility of compliance submissions.
- Broad Stakeholder Value: The tool serves multiple personas — third-party risk managers, compliance officers, security engineers, auditors, and legal teams — consolidating a previously fragmented workflow into a single interface.
- Cost Efficiency: No additional licensing or usage fees means organizations can scale compliance operations without increasing tooling budgets.
- Standardized Output: Support for CAIQ, SIG, and custom DDQ formats ensures responses align with the questionnaire structures that regulators, customers, and partners already expect.
How It's Different
- Grounded in Authoritative AWS Documentation: Unlike generic AI assistants or manual research, Assurance Assistant exclusively draws from verified AWS compliance artifacts (SOC, ISO, C5), eliminating the risk of hallucinated or unverifiable answers.
- Native AWS Integration: Being embedded directly in AWS Artifact means users access compliance documentation and AI-generated responses in the same console, without exporting data to third-party tools.
- Citation Transparency: Most AI-powered compliance tools provide answers without traceable sources; Assurance Assistant mandates citations, enabling independent verification — a critical requirement for regulated industries.
- Bulk Processing at Scale: The questionnaire upload mode handles entire XLSX-based DDQs in one operation, whereas point solutions or manual processes require question-by-question effort.
- Zero Additional Cost: Competing third-party GRC and vendor risk management platforms that offer similar AI features typically charge per user or per assessment; Assurance Assistant is included at no extra charge.
- IAM-Native Access Control: Fine-grained permission management via AWS IAM managed policies integrates seamlessly with existing AWS identity governance, unlike standalone SaaS tools that require separate user management.
When to Prefer It
- Completing Customer-Issued DDQs: When your organization needs to respond to security questionnaires from enterprise customers or partners asking about your AWS infrastructure's compliance posture.
- Third-Party Risk Assessments of AWS: When a risk or procurement team needs to evaluate AWS as a vendor and must populate a standardized questionnaire (CAIQ, SIG) with evidence-backed answers.
- Audit Preparation: When preparing for an internal or external audit that requires documented evidence of AWS's security controls, and you need to quickly locate and cite the relevant compliance reports.
- High-Volume Questionnaire Seasons: When your team faces a surge of simultaneous DDQ requests (e.g., during annual vendor reviews or new customer onboarding cycles) and manual completion is not scalable.
- Regulated Industry Compliance: When operating in financial services, healthcare, or government sectors where compliance submissions must be traceable to authoritative source documents.
- Reducing Dependency on AWS Specialist Knowledge: When compliance or legal staff without deep AWS technical expertise need to produce accurate, sourced answers about AWS security controls without escalating to a cloud architect.
Availability
- GA Status: Generally Available (GA) as of July 1, 2026; this is not a preview or beta release.
- Regional Availability: Available in all commercial AWS Regions; AWS Artifact is a globally accessible service, so users do not need to select a specific Region to use Assurance Assistant.
- Pricing: No additional charge; included as part of AWS Artifact, which is itself a free service.
- Supported File Formats: Questionnaire upload mode supports XLSX files, including CAIQ, SIG, and custom DDQ formats.
- Scope Limitation: Assurance Assistant only addresses questions about AWS's security controls and compliance posture; customer-side implementation questions, incomplete questions, and non-compliance-related queries are out of scope.
- IAM Policies: Two new managed policies (
AWSArtifactComplianceInquiriesReadOnlyAccessandAWSArtifactComplianceInquiriesFullAccess) are available for access control configuration. - Access Point: Available through the AWS Artifact console; no separate service endpoint or additional setup required beyond IAM policy assignment.
