Data/AI/ML — Good to Know: Rules of Thumb & Mastery Guide

Data/AI/ML — Good to Know: Rules of Thumb & Mastery Guide

This guide covers everything in the data-ai-ml catalogue without a standalone study file: the standard-practice and niche credentials, the standards and regulations you must know cold, the order-of-magnitude numbers for data systems and ML, and the veteran knowledge no exam tests.

1. The standard-practice & niche credentials

AWS (retired and entry tiers)

• AWS Certified Machine Learning – Specialty (MLS-C01) — the retired predecessor of MLA-C02. If you hold it, it's still valid until expiry, but new candidates take MLA-C02. Don't study for it.
• AWS Certified Machine Learning Engineer – Associate (MLA-C01) — retired 2027-01-14 (English last day 2026-09-28); replaced by MLA-C02. Same advice: don't start it now.
• AWS Certified AI Practitioner (AIF-C01) — the conceptual entry: AI/ML vocabulary, AWS AI services at a high level, responsible AI basics. Who needs it: non-engineers (PMs, sales) and engineers warming up for MLA-C02. When: as a 2-week warm-up, not a career credential.

Microsoft (retired and adjacent)

• Azure AI Engineer Associate (AI-102) — replaced by AI-103 (June 2026). The cognitive-services knowledge (Vision, Language, Speech, Search, Document Intelligence) still matters for maintaining existing solutions, but new candidates take AI-103.
• Azure Data Engineer Associate (DP-203) — retired 2025-03-31; replaced by DP-700 (Fabric). Same maintenance-only relevance.

The Databricks associate tier

• Databricks Certified Machine Learning Associate — notebooks, AutoML, basic MLflow, feature basics. Who needs it: ML practitioners entering the Databricks ecosystem. When: before the ML Professional; it's the feeder, not the destination.
• Databricks Context Engineer Associate (AI agents) — noted in the catalogue as a newer credential (not individually verified beyond community trackers). Watch this space: if Databricks formalizes an agent-engineering cert, it becomes the lakehouse-native counterpart to AI-103.

Independent data-platform certs

• Snowflake SnowPro Core (COF-C03) — Snowflake fundamentals: architecture (storage/compute/services separation), virtual warehouses, data sharing, Snowpark basics. Who needs it: anyone working in Snowflake shops — it's the most recognized data-warehouse cert outside the cloud vendors. When: before the Advanced tracks.
• Snowflake SnowPro Advanced: Data Engineer (DEA-C02) — streams/tasks (CDC), Snowpipe (continuous ingestion), dynamic tables (declarative transforms — Snowflake's DLT equivalent), performance tuning (clustering, search optimization, warehouse sizing). Who needs it: data engineers on Snowflake. When: after Core + production Snowflake experience. Veteran note: Snowflake's separation of storage and compute with per-second warehouse billing is the cleanest cost model in warehousing — the cert teaches genuinely good habits (right-size warehouses, auto-suspend aggressively).
• TensorFlow Developer Certificate — Google's exam (in TensorFlow 2.x): model building, CNNs, NLP, sequences. Who needs it: diminishing — it's a framework-skills cert in an era of foundation models. When: if your work is genuinely TF-based (mobile/edge via TFLite, legacy TF codebases). Honest take: framework certs age fast; the ML Professional guides in this folder teach the durable half.

Streaming specialty

• Confluent Certified Developer for Apache Kafka (CCDAK) — Kafka API-level: producers/consumers, partitioning, consumer groups, Schema Registry, Kafka Streams basics. Who needs it: engineers building on Kafka (not just operating it). When: before CCAAK if you're dev-leaning.
• Confluent Certified Administrator for Apache Kafka (CCAAK) — broker ops: replication, ISR, controller/ KRaft, security (SASL/SSL), MirrorMaker, sizing. Who needs it: platform engineers running Kafka/MSK. When: after operating Kafka in production. Veteran note: Kafka's exactly-once (idempotent producer + transactions) and the ISR model are the two concepts that transfer everywhere — learn them deeply regardless of the cert.

Data governance

• DAMA Certified Data Management Professional (CDMP) — the vendor-neutral data-management cert built on DMBOK: governance, architecture, modeling, quality, metadata, security. Who needs it: data governance leads, stewards, architects in regulated enterprises. When: moving from engineering into governance/leadership. It's the data world's closest thing to a professional-standards credential — no legal teeth, but real enterprise recognition.

The meta-lesson

Data/AI/ML has no license to practice, but it has the densest incoming regulation of any software-adjacent field (EU AI Act fully in force, state AI laws multiplying). Careers run on platform depth (one cloud's data+ML stack, or Databricks/Snowflake as the cross-cloud play) plus governance literacy (the regulations below). The highest-ROI pattern: go deep on one platform's professional certs (this folder's eight guides), then add the governance layer (DMBOK/CDMP vocabulary + the AI Act). The engineers who can both build the pipeline and satisfy the auditor are the scarcest and best-paid.

2. Standards & regulations mastery

ISO/IEC 42001:2023 — know cold

The AI management system standard — 27001's structure applied to AI: context, leadership, planning (AI risk assessment), support, operation (AI lifecycle controls in Annex A), performance evaluation, improvement. Know cold: certification audits the management system, not the model; the Statement of Applicability covers Annex A AI controls (data quality, model validation, human oversight, transparency). Demonstration: AI policy, risk register, lifecycle documentation (the MLflow/UC artifacts from the Databricks guides map directly), internal audits. Why it matters: it's becoming the procurement gate for enterprise AI deals, the way 27001 is for SaaS.

ISO/IEC 23894:2023 — know cold

AI risk management guidance (the 27005-style companion to 42001): risk identification, analysis, evaluation, and treatment across the AI lifecycle — including risks 27001 doesn't cover (model bias, opacity, autonomy, data poisoning). Know cold: the lifecycle-stage risk framing (data → development → deployment → decommissioning); each stage has distinct risks and controls. Use it as the risk-assessment methodology inside a 42001 program.

NIST AI RMF 1.0 — know cold

Four functions: Govern (culture, accountability), Map (context, categorization, risk framing), Measure (evaluation, bias testing, red-teaming), Manage (deployment decisions, monitoring, decommissioning). Plus the trustworthy-AI characteristics (valid, safe, secure, accountable, transparent, explainable, privacy-enhanced, fair). Know cold: it's voluntary in the US but it's the vocabulary US enterprises and regulators use — Map/Measure/Manage maps cleanly onto the ML lifecycle (frame → evaluate → deploy/monitor). Demonstration: an AI RMF profile/playbook for your AI use cases, with mapped controls.

ISO/IEC 27001:2022 — know (AI/data implications)

Same standard as the software guide; the AI-specific implications: training data as an information asset (classification, access control), model artifacts in scope (theft/loss = incident), and Annex A controls applied to ML infrastructure (logging of training jobs, change control on models).

DAMA-DMBOK — know cold (for governance roles)

11 knowledge areas: governance, architecture, modeling & design, storage & operations, security, integration & interoperability, documents & content, reference & master data, warehousing & BI, metadata, quality. Know cold as the governance vocabulary: when the CDO says "data quality," DMBOK means the six dimensions (accuracy, completeness, consistency, timeliness, validity, uniqueness) with measurable rules. Demonstration: data-quality SLAs with measured dimensions, a governed data catalog, stewardship RACI. You don't need the CDMP to use the vocabulary — but the vocabulary is what makes governance conversations productive.

EU AI Act — know cold

Know cold: the risk pyramid — unacceptable (banned: social scoring, manipulative subliminal, real-time remote biometric ID in public by law enforcement with narrow exceptions), high-risk (Annex III: hiring, education, law enforcement, migration, critical infrastructure, product safety components — conformity assessment, data governance, human oversight, logging, robustness), limited-risk (transparency: disclose AI interaction, label deepfakes/synthetic content), minimal-risk (everything else, voluntary codes). GPAI/foundation models: technical documentation, copyright compliance, evaluations; systemic-risk tier (compute threshold) adds adversarial testing and incident reporting. Fines: up to €35M or 7% of turnover (prohibited practices). Demonstration: risk classification per use case, conformity documentation, post-market monitoring plan, human-oversight design. Recent change: the Act is in force with phased application — know the timeline for the obligations affecting your systems (prohibitions first, high-risk duties phasing in).

GDPR — know cold (AI/data implications)

Beyond the software-guide basics: AI-specific flashpoints — training-data lawful basis (legitimate interest balancing tests for web-scraped data are being litigated now), automated decision-making rights (Art. 22: the right not to be subject to solely-automated consequential decisions + the right to human review), DPIAs as mandatory for high-risk AI processing, and the erasure-vs-model problem (no settled answer — document your approach: retraining policy, machine-unlearning evaluation, or architectural isolation). Fines to 4% of turnover.

Colorado SB 26-189 (replacing SB 24-205) — know cold (if you deploy consequential AI in Colorado)

Algorithmic discrimination duties for consequential decisions (hiring, lending, housing, insurance, education): developers and deployers must use reasonable care — impact assessments, bias testing, deployer notifications, consumer disclosures and appeal rights. Know cold: this is the US template other states are copying — building the Colorado compliance artifacts (impact assessment, bias audit, disclosure) is building the 50-state compliance kit. (The catalogue notes SB 26-189 replaced SB 24-205 — verify current numbering when relying on it.)

California SB 53 — know

Transparency in Frontier AI: obligations on large developers (safety practices disclosure, whistleblower protections, evaluations). Know: it's aimed at frontier developers, not typical deployers — but its evaluation/transparency norms flow downstream into enterprise procurement questionnaires. Context-level for most engineers.

FDA AI-enabled device regulation (PCCP guidance) — know

Predetermined Change Control Plans: the FDA lets AI/ML device makers pre-specify planned model modifications (what will change, how it's validated, when it ships) — turning the "locked model" problem into a managed lifecycle. Know cold if you do medical AI: the PCCP is the deployment pipeline's regulatory wrapper (validation protocols, monitoring, rollback criteria pre-cleared). Call a regulatory specialist — the guidance is nuanced and submission-specific.

SR 11-7 / OCC 2011-12 — know cold (if you do ML in banking)

Model Risk Management: all models (yes, including ML) need conceptual-soundness review, ongoing monitoring, and outcomes analysis — with independent validation (validators separate from developers, with stature to block deployment). Know cold: the three pillars (development, validation, governance), documentation standards (limitations must be explicit), and that "the model is complex" is never an acceptable limitation without a mitigation. This regime predates the AI hype and it's stricter than most AI-specific rules.

3. Rules of thumb

Data volumes & throughput:

• 1 TB/day ≈ 12 MB/s average (but provision for 10× peaks — averages lie).
• Parquet + Snappy ≈ 5–10× smaller than raw JSON/CSV; partitioned + clustered ≈ 10–100× less scanned. The two multiplications compound: raw JSON → curated Parquet is routinely 50–500× cheaper to query.
• Rule: store everything raw (storage is $0.02/GB-mo), curate aggressively (compute is the cost).

Latency:

• Streaming: event → insight in seconds (Kafka/PubSub + Flink/Dataflow). Micro-batch: minutes. Batch: hours. Don't pay streaming prices for batch freshness needs.
• Feature serving: online store <10 ms; batch precompute for everything latency-tolerant.

ML training:

• Training compute ≈ 6 × params × tokens (transformers) — a 7B model on 1T tokens ≈ 4×10²² FLOPs ≈ thousands of GPU-days. Use for budget sanity checks.
• GPU memory: params × bytes/param (fp16 = 2) × ~4 (weights + gradients + optimizer states for Adam) — a 7B model needs ~56 GB just to train (hence multi-GPU/ZeRO).
• Tabular <100k rows: XGBoost beats deep learning, trains in minutes on CPU. The most expensive ML mistake is using a GPU cluster where a laptop sufficed.
• Labeling: budget $0.05–1.00 per label (human); active learning cuts labels 5–10× for the same accuracy.

ML inference economics:

• Real-time endpoint: you pay for availability (instance-hours), not just predictions. Utilization <20% → switch to serverless/batch.
• Batch inference ≈ 5–20× cheaper per prediction than real-time at scale. The latency requirement is a cost decision.
• LLM serving: output tokens cost 2–4× input tokens; long contexts are a budget line item, not a free feature.

Data quality:

• Expect 10–30% of any new data source to be unusable without cleaning (nulls, dupes, schema drift, timezone chaos). Budget the cleaning.
• Schema drift: will happen. Rescue columns + enforcement + alerts (the Databricks pattern) beats hoping.
• The 1-10-100 rule: $1 to prevent a bad record, $10 to fix it in the pipeline, $100 to fix it after a bad decision shipped.

Estimation reflexes:

• "How long to build the pipeline?" — 2× the optimistic estimate for the happy path, 4× with the edge cases (there are always edge cases).
• Backfill math: backfill time = data volume ÷ (write throughput × parallelism). A 30-day backfill of 1 TB/day at 100 MB/s single-threaded ≈ 3.5 days — parallelize or wait.
• Model decay: assume measurable drift within 1–3 months for behavioral data (fraud, recommendations, demand); 6–12 months for physical data (sensors, vision). Monitor from day one.

4. Veteran knowledge

What exams don't test:

• Data discovery archaeology. Half of real data engineering is finding the data: which table is actually fresh, which pipeline actually runs, who owns the upstream that broke. Data catalogs help; relationships help more.
• Stakeholder translation. "The dashboard is wrong" → is it the data, the logic, the refresh, or the expectation? Debugging requirements is a senior skill no cert covers.
• The political economy of data. Who pays for the warehouse, who owns the quality, who gets blamed for the outage — the org chart shapes the architecture more than the technology does.
• Notebook-to-production grief. The prototype works; production needs tests, monitoring, retries, schema contracts, and on-call. The rewrite is the real project.

Costly beginner mistakes:

1. No data contracts. Consuming upstream tables without freshness/schema SLAs = building on quicksand. Contract first (SLOs on the upstream), pipeline second.
2. *SELECT .** In production pipelines, always. Schema drift + cost blowup + silent breakage — the trifecta.
3. Training on the future. Temporal leakage is the #1 cause of "great offline, terrible live." Time-based splits, as-of joins, always.
4. Ignoring the small-files problem. Streaming into a lake without compaction = slow death by metadata. OPTIMIZE is not optional.
5. No idempotency. Pipelines will retry. Non-idempotent writes = duplicates. Partition-overwrite, merge keys, transactional sinks.
6. Monitoring the pipeline, not the data. "The job succeeded" ≠ "the data is right." Data-quality checks (freshness, volume, distribution) are the real monitoring.
7. Treating the LLM as a database. Fine-tuning for facts, no eval harness, no grounding — the GenAI version of every classic ML mistake at 10× the cost.

When to call a specialist:

• Statistics for experimental design (A/B testing, causal inference): call the statistician when the business decision is expensive — peeking at p-values and ignoring novelty effects have killed more launches than bad models.
• Legal for AI Act/GDPR classification: the engineer builds the hooks (logging, transparency, oversight); counsel makes the classification call.
• Data governance at enterprise scale: call the DMBOK-fluent governance lead before building the 50th ungoverned mart.
• MLOps platform engineering: when every team hand-rolls its own training/serving, call the platform team (or become it) — the toil compounds.
• Model risk validators (banking): engage validation during development, not after — SR 11-7 validators blocking a finished model is the most expensive meeting in finance.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.