The verified answer is D. AWS Artifact. The company needs compliance documentation for submission to regulatory authorities. AWS Artifact is the AWS service designed for this exact requirement. AWS describes AWS Artifact as a self-service portal that provides on-demand access to AWS security and compliance reports and agreements. AWS also states that customers can use AWS Artifact to access AWS and independent software vendor security and compliance reports, download compliance reports, and manage compliance agreements. This directly matches the need to obtain documentation for auditors or regulators.

AWS compliance guidance also explains that AWS supports many security standards and compliance certifications, and AWS reports such as SOC reports help customers and auditors understand AWS controls established to support operations and compliance. AWS Artifact is the mechanism customers use to retrieve many of these compliance documents. Therefore, if the company is using Amazon Bedrock and needs compliance documentation related to AWS services, AWS Artifact is the appropriate service.

AWS Config is incorrect because it records, evaluates, and audits AWS resource configurations. It can help assess whether resources comply with internal rules, but it is not the service for obtaining AWS compliance reports for submission to regulators. Amazon Bedrock is incorrect because Bedrock is the generative AI service being used to process invoices; it does not serve as the compliance report portal. Amazon SageMaker AI is incorrect because SageMaker AI is used to build, train, deploy, and manage machine learning models. It is not the AWS service for downloading AWS compliance documentation.

The question is not asking how to process invoices securely or how to configure Bedrock controls. It is asking where to obtain formal compliance documentation. The correct AWS service is AWS Artifact.