Get Audit-Ready for AWS MSP Validation Checklist 8.0
The AI-First Gap Analysis: what's confirmed new, what's updated, and what's unchanged, plus a fillable checklist for all 61 controls.
On August 21, 2026, AWS released VCL 8.0 for the MSP Program and called it the "AI-First" release. It becomes the only accepted version on January 1, 2027. AWS's public Summary of Changes names just 19 controls; the other 42 are left for partners to work out. This bundle gives you both halves of the job: a 9-page guide that breaks down every confirmed change and is honest about what AWS hasn't published, and a fillable PDF checklist to track Met/Not Met status, owners and evidence across all 61 controls. Download both and know exactly where your practice stands before your next renewal or Full Audit.
Get the Guide and Checklist
Fill in a few details to get instant access.
THE VCL 8.0 NUMBERS
Controls in VCL 8.0 across Business, People, Governance, Platform, Security and Operations
Mandatory controls, the rest are recommended
Controls AWS individually named in its Summary of Changes as new, updated or retained
Controls left unconfirmed, for partners to verify against their own VCL 7.1 records
Controls whose requirement text references AI, agent or model capabilities
The day VCL 8.0 becomes the only accepted checklist version
The change log conceals more than it reveals.
CONFIRMED NEW
12 controls with no VCL 7.1 predecessor
Responsible AI Policy, Data Governance for AI, Prompt Injection Prevention and the AI Transformation Roadmap are mandatory and new. There is no prior-audit evidence to reuse, so these carry the highest audit risk.
CONFIRMED UPDATED
Existing controls now carry AI requirements
Change Management, Vulnerability Management and FinOps passed in your last audit. Each now explicitly covers AI workloads, models and agents. Prior evidence is unlikely to be sufficient on its own.
NOT INDIVIDUALLY PUBLISHED
42 controls AWS did not itemize
AWS confirmed roughly a dozen more new or updated controls and 15 retirements beyond the ones it named, without listing them by ID. Several unconfirmed controls, like Bedrock proficiency and AI/ML certifications, read like AI-era additions. Treating them as unchanged is a risky assumption.
EXEMPTIONS
You may already qualify for a dozen controls
MSSP, AI, DevOps, Migration and Modernization, and Industry Competency holders are waived from specific controls. Confirm which apply before building new evidence from scratch.
VCL 8.0 raises the bar from "can you manage cloud infrastructure?" to "can you prove AI-driven delivery at scale with measurable business outcomes?"
BUILT FOR THE PEOPLE ACCOUNTABLE FOR THE AUDIT
MSP Practice Leaders and Partner Alliance Managers
You own the AWS relationship and the renewal date. Use the guide to brief leadership on what changed and the checklist to assign owners and track readiness across all six sections.
Compliance, Governance and Security Leads
Responsible AI, Data Governance for AI and Prompt Injection Prevention are mandatory and new. You will be writing documentation most MSPs have never produced. Start with the 12 confirmed new controls.
Cloud Operations and Platform Teams
Change Management, Vulnerability Management, FinOps and Configuration Management now explicitly cover AI workloads. Your existing runbooks and evidence need an AI layer before the next audit.
Partners Preparing a First-Time MSP Application
You are being validated against 8.0 from day one, with no 7.1 history to lean on. The checklist gives you the full 61-control inventory and a dashboard to plan the build in priority order.