Anatomy of the lens: eight focus areas, one lifecycle

Lesson 2 of 5 in The Responsible AI Lens: Well-Architected for Trustworthy AI.

Where the GenAI Lens organised itself around the six Well-Architected pillars, the Responsible AI Lens organises itself around the life of an AI project: eight focus areas, each aligned to a phase of the ML lifecycle, running from should we build this? to how do we switch it off? Together they hold 99 best practices.

The ID grammar parses the same way as its sibling’s. RAIUC01-BP01 is the Use case focus area (RAIUC), its first question (01), first best practice (BP01). Learn the eight prefixes and you can navigate the whole document — and cite findings unambiguously in a risk registry:

Eight focus areas, 99 best practices, one lifecycle
Focus area	Prefix · BPs	Lifecycle moment	What it interrogates
Use case	`RAIUC` · 11	Before anything	What specific problem is this — inputs, outputs, stakeholders, AI type (traditional, generative, agentic), and who must approve it
Benefits and risks	`RAIBR` · 17	Design	Beneficial and harmful events per dimension, likelihood × severity, a maintained risk registry
Release criteria	`RAIRC` · 16	Design	Testable criteria the system must meet before release — metrics and thresholds per dimension
Dataset planning	`RAIDP` · 18	Data preparation	A dataset registry, representativeness of the population served, and documentation (datasheets for datasets)
System planning	`RAISP` · 18	Architecture	Where protections live — in the core system or bolted on — plus provenance indicators and test design
Evaluate and release	`RAIER` · 7	Pre-release	Whether the evidence actually supports releasing — corroboration, statistical confidence, and the option to narrow the use case
User guidance	`RAIGT` · 5	Release	Transparency strategy and system cards — what users and deployers are told
Monitoring	`RAIMON` · 7	Operation → end of life	Deviations from expected behaviour, feedback response, and decommissioning obligations

Every best practice carries a risk label — High or Medium — and the definition repays a careful read: it is the level of risk exposed to your project or business if the best practice is not established. Not legal risk. Not regulatory exposure. The lens says so explicitly and tells readers to consult counsel for that. RAIBR03-BP03 (assign an overall risk level to each potential harm) is labelled High because skipping it is how projects ship harms they never enumerated — not because a statute demands a risk matrix.

The how to use guidance sets four more rules of engagement. Read sequentially, work in any order — the focus areas are presented in lifecycle order, but AI development is iterative and nonlinear, so you will revisit earlier areas as later ones teach you things. Every question and best practice is a consideration, not a requirement — the lens asks you to consider each practice for your use case, not to implement all 99. The guidance deliberately excludes cloud security, privacy engineering, and project management — the base framework and other lenses cover those, so absence here is not permission. And practices appear only when sufficiently mature — the lens omits techniques the science does not yet support, which is why it is shorter than the blogosphere.

Two lenses, one workload — how the siblings divide the labour
Aspect	Responsible AI Lens	Generative AI Lens
Organising spine	Eight focus areas along the ML lifecycle	The six Well-Architected pillars
Unit of analysis	One AI use case — the problem being solved	One GenAI workload — the system being run
Vocabulary	Ten responsible AI dimensions	Pillar-shaped concerns (throughput, cost per token, guardrails…)
Scope	Traditional ML, generative, and agentic applications — any specific AI use case	Generative AI workloads on Bedrock, SageMaker AI, or Amazon Q
Asks	Should this system exist, is it safe to release, and how will you know?	Is this workload well built — secure, reliable, performant, efficient?
Out of scope	Building foundation models; general-purpose systems; compliance	Classical predictive ML (the older ML Lens covers it)

They compose rather than compete. A generative AI use case gets both: the Responsible AI Lens interrogates the use case — harms, release criteria, user guidance — while the GenAI Lens interrogates the workload — endpoints, quotas, guardrail wiring, spend. The overlap is deliberate and small: where GENSEC02 asks are guardrails implemented?, RAISP asks the prior question, should this protection live in the core system design at all? Run the Responsible AI Lens early, when the use case is still negotiable; run the GenAI Lens once there is an architecture to review; keep both sets of findings in the same improvement plan.

Key terms: Well-Architected lens, AWS Well-Architected Tool, AI lifecycle, risk register, AWS Well-Architected Framework

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.