OpenAI - Bedrock Claude Migration Assessment — HIPAA + Cost Delta

Eight adjacent OpenAI → Bedrock assessment listings exist on AWS Marketplace today, and 100% of them hide behind "request private offer." Kriv's differentiator: published fixed-fee pricing + regulated-industry overlay (HIPAA eligibility delta, SR 11-7, NAIC, EU AI Act) + Anthropic CPN credibility + Claude-specific variant mapping.

Enterprises running OpenAI API in production face a predictable cluster of concerns: OpenAI data-retention and training-opt-out terms that trigger CISO / TPRM review; OpenAI API not HIPAA-eligible without Azure OpenAI BAA routing (Amazon Bedrock Claude IS HIPAA-eligible under AWS BAA); OpenAI contract renewal pressure with cost uncertainty; shadow AI on personal ChatGPT; unspent AWS Enterprise Discount Program (EDP) or Migration Acceleration Program (MAP) commitments; capability delta uncertainty (will Claude meet the existing use-case bar?); migration risk unknowns (prompt portability, model behavior differences). These concerns compound in regulated industries where HIPAA, SR 11-7, and NAIC Model Bulletin add eligibility + model-risk scrutiny.

N38 is a 2–3 week fixed-fee assessment-only engagement that answers the decision: should we migrate OpenAI → Bedrock Claude, and if yes, how? Customer then engages Kriv's N36 Claude on Bedrock Migration for full implementation ($45K–$115K) or self-executes with Kriv's playbook. N38 is the natural pre-cursor; N36 is the execution.

Assessment methodology. OpenAI usage inventory (catalog every API call site per use case — model version (GPT-4o / o1 / o3 / GPT-5), prompt library, monthly token spend, p50/p95 latency, compliance constraints, data classification). Security + compliance review (data retention, training opt-out, HIPAA eligibility, sub-processor inventory, regional deployment, IP retention). Target-state mapping (recommend Claude variant per use case — Opus 4.6 for high-stakes reasoning, Sonnet 4.6 for 1M-context daily development + tool use, Haiku 4.5 for high-volume classification). Capability delta analysis (Claude vs OpenAI across tool use, vision, extended thinking, code generation, math reasoning, RAG grounding). Cost model (per-use-case monthly projection; AWS EDP / MAP burn; sensitivity bands; typical 20–50% savings for high-volume workloads — projection only). Risk assessment (prompt portability, model behavior, regression, rollback complexity). Staged migration plan (canary 1–5% → shadow → cutover → deprecate, with feature-flag rollback). Prompt-porting proof (Standard / Enterprise — XML structure + extended thinking + native tool use; side-by-side output). Bedrock Guardrails design starter (Enterprise — denied topics, content filters, PII redaction, contextual grounding; integrates with N28). Regulated-industry overlay (Enterprise — HIPAA, SR 11-7, NAIC, EU AI Act Article 25). CISO / TPRM vendor-exit dossier (Enterprise — rationale, risk mitigation, migration plan, governance handoff).

Reference architecture (target-state). Amazon Bedrock with Claude Opus 4.6 / Sonnet 4.6 / Haiku 4.5; Bedrock Model Invocation Logging → CloudWatch + S3 Object Lock; Bedrock Guardrails per use case; AWS PrivateLink (no public egress); AWS KMS customer-managed CMKs per data classification; AWS IAM Identity Center with MLOps / Data Scientist / AI Governance roles.

Three tiers. Foundation $15K (2 weeks; 1 use-case inventory + cost model + target Claude variant mapping + 10-page assessment report + 30-minute executive readout). Standard $25K (2.5 weeks; 3–5 use cases + full security + compliance review + capability delta analysis + cost model + migration plan + prompt-porting proof on 1 representative use case + Bedrock Guardrails design starter). Enterprise $35K (3 weeks; 10+ use cases + regulated-industry overlay HIPAA / SR 11-7 / NAIC / EU AI Act + full CISO / TPRM vendor-exit dossier + full migration plan + Bedrock Guardrails design starter + N36 implementation handoff). Optional Extra Use Case $8K each.

Important disclosures. Kriv does NOT execute the migration (N38 is assessment-only; migration execution is the separate N36 engagement). Kriv does NOT terminate OpenAI contracts (Customer procurement). No cost-savings guarantee (projection only). No capability-parity guarantee (model behavior varies). Kriv issues no certifications. No legal / regulatory / compliance advice. OpenAI / Anthropic API / Amazon Bedrock consumption separate. Anthropic CPN membership (April 9, 2026) — Kriv is a CPN partner, not an Anthropic-authorized reseller. Outcomes depend on representativeness of sample use cases provided by Customer during Week 1 inventory.