AI, LLM and real-time · AWS · AI, ML and deep learning

AI vs machine learning vs deep learning: the differences, and a use-case architecture on AWS for each

A plain explanation of how artificial intelligence, machine learning and deep learning relate, with a comparison table, practical guidance for South Australian businesses, councils and agencies, and three reference architectures on AWS: council document processing with managed AI services, demand forecasting with Amazon SageMaker AI, and road defect detection with deep learning and Amazon Bedrock.

A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.

OECD definition of an AI system
NIST AI Risk Management Framework
ISO/IEC 22989
ISO/IEC 42001
Guidance for AI Adoption (National AI Centre)
Policy for the responsible use of AI in government
ASD Essential Eight
Australian Privacy Principles

What each term means

The three terms are nested, not competing. Artificial intelligence is the whole field. Machine learning is one way of building AI, where the system learns its behaviour from data instead of following rules a person wrote. Deep learning is one family of machine learning that uses neural networks with many layers. Transformers, and the large language models and other generative AI built on them, sit inside deep learning.

In practice most useful systems mix them. A council form-processing workflow can combine plain business rules, a pre-trained deep learning model behind a managed AI service, and a person who reviews uncertain cases. The question is not which label is better, but which approach solves the problem with the least data, cost, risk and explanation burden.

Artificial intelligence (AI)

The broad field of building machine-based systems that, for explicit or implicit objectives, infer from their inputs how to produce outputs such as predictions, content, recommendations or decisions. It includes rule-based expert systems, search and planning, optimisation, knowledge graphs and all of machine learning. AI systems differ in how autonomous they are and whether they keep adapting after deployment.

Based on the OECD definition of an AI system (updated 2023 and 2024), which the NIST AI RMF and Australian Government guidance draw on.

Machine learning (ML)

A branch of AI in which a model's parameters are optimised from data or experience, so its behaviour reflects that data rather than hand-written rules. Supervised learning learns from labelled examples (churn yes or no, next week's demand). Unsupervised learning finds structure in unlabelled data (customer segments, anomalies). Reinforcement learning learns a policy by trial, error and reward (scheduling, control).

Consistent with the machine learning concepts in ISO/IEC 22989:2022.

Deep learning (DL)

Machine learning with artificial neural networks that have many layers, which learn their own features from raw data such as images, audio and text. Convolutional networks and vision transformers suit images; recurrent networks and transformers suit sequences. It usually needs much more data and compute than classic ML, or a pre-trained model to start from.

Consistent with ISO/IEC 22989 and the AWS description of deep learning.

Generative AI and LLMs

Deep learning models, mostly transformers, trained on very large datasets to generate new text, images, code or audio. Large language models (LLMs) are the text form, and foundation models are large pre-trained models adapted to many tasks through prompting, retrieval (RAG) or fine-tuning. They are a subset of deep learning, not a separate field.

Consistent with the NIST AI 600-1 Generative AI Profile.

How they nest

Each boundary sits inside the one around it. Every deep learning system is machine learning, and every machine learning system is AI, but not the reverse. The examples are typical techniques at each level, not a complete list.

Architecture diagram. Tinted boundaries show regions, accounts, networks and trust zones. Numbered arrows match the flow below.

AI and ML
Monitoring, audit and analytics
Request or data flow
Asynchronous or optional
Boundary: region, account, network or trust zone

Side-by-side comparison

	Rules-based and managed AI services	Classic machine learning	Deep learning and generative AI
What it is	Rules, search and optimisation written by people, plus pre-trained AI services called through an API.	Statistical models trained on your structured data.	Many-layered neural networks trained on large or unstructured data, or a pre-trained foundation model.
Data needs	Little or none of your own, beyond test samples and the rules themselves.	Hundreds to millions of labelled, tabular rows with history, depending on the problem.	Large labelled sets to train from scratch, or a modest labelled set to fine-tune a pre-trained model. Prompting and RAG need none for training.
Compute	Low. Pay per request on managed services.	Moderate. CPU training is often enough, with scheduled retraining.	High for training and fine-tuning (GPUs or AI accelerators). Inference can also be heavy.
Explainability	High for rules. Managed services return confidence scores but their internals are opaque.	Medium to high. Linear models and trees can be explained, and SHAP-style tools help with ensembles.	Low. Explanations are approximate, so evaluation, human review and monitoring carry more of the assurance.
Typical algorithms and services	Decision tables, workflow rules, OCR and document AI (Amazon Textract), NLP APIs (Amazon Comprehend), Step Functions.	Linear and logistic regression, decision trees, random forests, gradient boosting (XGBoost), k-means, time-series models, on SageMaker AI.	CNNs, vision transformers, LSTMs, transformers and LLMs, on SageMaker AI, Amazon Rekognition Custom Labels or Amazon Bedrock.
When to use it	The task is well defined, a managed service already does it, or decisions must be fully traceable.	You have good historical, structured data and need a prediction or score you can test and explain.	The input is images, audio or free text, patterns are too complex for features you can design, or you need generation.

Practical guidance for SA businesses, councils and government

Start from the problem and the decision it supports, then pick the simplest approach that works. Many council and small business wins come from rules plus a managed AI service, with no model training at all.
Record every AI use in an AI inventory with an owner and a risk tier before you build, as described in our AI governance framework guide. Government agencies should also follow the Policy for the responsible use of AI in government, and South Australian agencies should check current state guidance with their own policy teams.
Treat a prediction or score about a person as a decision with consequences. Keep a human in the loop for anything affecting rights, eligibility, money or safety, and give people a way to ask for a review.
Keep data in the Sydney Region where you can, check which features are offered there, and run a privacy impact assessment before you use personal information to train or prompt a model.
Measure before and after. Agree accuracy, error and fairness thresholds with the business owner, test against them before go-live, and monitor for drift after.
Prefer managed and pre-trained options first, then fine-tune, then train from scratch, because each step up adds data, compute, cost and assurance work.

Use case A · AI

Council document processing with rules and managed AI services

Residents and staff submit applications, permits and correspondence. Amazon Textract reads the documents, Amazon Comprehend classifies them and finds personal information, business rules in Step Functions and Lambda decide where each one goes, and staff review anything the services are unsure about. No model is trained, but the services use pre-trained deep learning behind their APIs.

Architecture diagram. Tinted boundaries show regions, accounts, networks and trust zones. Numbered arrows match the flow below.

People and clients
Object and file storage
Messaging, events and workflow
AI and ML
Compute and containers
Security and identity
SaaS and business systems
Monitoring, audit and analytics
Request or data flow
Asynchronous or optional
Boundary: region, account, network or trust zone

Numbered flow

A resident or staff member submits a form, letter or attachment through the council portal or a monitored mailbox. The file lands in an encrypted, versioned S3 intake bucket.
An S3 event starts a Step Functions workflow for the document, so every step, retry and outcome is recorded.
Amazon Textract extracts text, key-value pairs, tables and answers to set questions such as the applicant name or property address, each with a confidence score.
Amazon Comprehend classifies the document type with a custom classifier and detects personal information so it can be redacted from copies that do not need it.
Business rules in Lambda check the results against thresholds and council policy, for example required fields present, classification confidence high enough, and the right team for this request type.
Anything below threshold, or any request type the council has marked as sensitive, goes to an Amazon A2I human review task, where an officer corrects the fields and confirms the route.
The workflow files the document and extracted data in the records system and raises or updates the case in the CRM or ServiceNow, with a link back to the source file.

Security and governance

Rules are versioned code, so every routing decision can be traced to a rule and a confidence score.
Personal information is detected and redacted where it is not needed, and data stays in Sydney.
Officers make the decisions; the pipeline only extracts, classifies and routes.
Record the use case in the AI inventory and test it on a representative sample of real documents.

When to use it

High volumes of similar forms and correspondence
You want results quickly without training a model
Routing decisions must be fully explainable

When not to

Documents are rare or highly varied
The decision itself, not just the routing, needs judgement

Use case B · Machine learning

Demand forecasting and churn scoring with Amazon SageMaker AI

A retailer, service business or council service forecasts demand or scores which customers are likely to leave, from historical structured data. This is supervised machine learning on tabular data: AWS Glue prepares features, SageMaker AI trains and registers a model, an approver releases it, batch transform scores new data each night, and Model Monitor watches for drift.

Architecture diagram. Tinted boundaries show regions, accounts, networks and trust zones. Numbered arrows match the flow below.

SaaS and business systems
Object and file storage
Databases and data
AI and ML
Monitoring, audit and analytics
Security and identity
Request or data flow
Asynchronous or optional
Boundary: region, account, network or trust zone

Numbered flow

Sales, booking, customer and service history are extracted each day from the point-of-sale, ERP or CRM into the raw zone of an S3 data lake.
AWS Glue jobs clean, join and aggregate the data into features such as weekly sales by product and store, seasonality flags, promotions or recent service contacts.
A SageMaker Pipelines run trains candidate models, for example gradient-boosted trees for churn or a time-series model for demand, and evaluates them against a held-out period and a simple baseline.
The best candidate is registered in the SageMaker Model Registry with its metrics, training data version and explainability report, in a pending state.
A named business approver reviews the evaluation and approves the version. Only approved versions can be deployed.
Batch transform scores new data each night and writes forecasts or churn scores back to S3 for dashboards, planning tools or the CRM. Results are advisory and feed human decisions.
Inputs and outputs are captured so Model Monitor can compare them with the training baseline.
When drift or accuracy falls past an agreed threshold, an alert is raised and the pipeline retrains, and the new version goes back through approval.

Security and governance

Every model version carries its data version, metrics and approver, giving an audit trail.
Use explainability reports, such as SageMaker Clarify, to check which features drive scores and look for bias.
Churn or risk scores about individuals inform staff decisions rather than trigger automatic action.
Remove or minimise personal information in features where it does not improve the model.

When to use it

You have at least a year or two of reliable history
A better forecast or score has a clear business value
You can act on the predictions

When not to

Data is sparse or changes faster than you can retrain
A simple rule or average already performs as well

Use case C · Deep learning

Road and asset defect detection with computer vision, plus generative summaries

A council or utility captures images of roads, footpaths or assets. A deep learning vision model, fine-tuned from a pre-trained network on SageMaker AI GPU instances or built with Rekognition Custom Labels, finds defects such as potholes and cracking. Uncertain detections go to an inspector, and a foundation model on Amazon Bedrock drafts the inspection summary for a person to check.

Architecture diagram. Tinted boundaries show regions, accounts, networks and trust zones. Numbered arrows match the flow below.

Security and identity
Object and file storage
AI and ML
SaaS and business systems
Monitoring, audit and analytics
Request or data flow
Asynchronous or optional
Boundary: region, account, network or trust zone

Numbered flow

Cameras on council vehicles or inspection drones capture images with GPS and time. They upload to an encrypted S3 bucket, and faces and number plates are blurred before images are used for training.
A representative sample of images is sent to SageMaker Ground Truth, where trained staff draw boxes around defects and label their type.
A training job on GPU instances fine-tunes a pre-trained object detection network on the labelled set. Rekognition Custom Labels is a simpler alternative when you do not need control of the network.
The trained model is registered with its evaluation results, such as precision and recall per defect type, and approved by the asset manager.
The approved version is deployed to a SageMaker AI asynchronous endpoint or run as batch transform, so GPU capacity is only used while images are waiting.
New images are scored as they arrive, producing defect type, location and a confidence score for each detection.
Detections below the confidence threshold, or of high-severity types, go to an inspector for confirmation in a human review task.
For confirmed defects, a foundation model on Amazon Bedrock drafts a short inspection note from the detections and location, with Guardrails applied. An officer edits and approves it.
Confirmed defects, with location, photo link and note, are written to the asset management system as defects or work orders.

Security and governance

Blur or remove personal information such as faces and number plates, and set retention for raw images.
Measure precision and recall per defect type and per road or lighting condition before release.
Inspectors confirm uncertain and high-severity detections, and officers approve generated text.
Check GPU instance types and Bedrock model availability in Sydney, and record any cross-Region inference in the privacy assessment.

When to use it

Large image volumes that people cannot review fully
Defects are visible and can be labelled consistently
You need generated text drafted from structured results

When not to

Only a handful of images or defect types
No capacity to label data or review detections

Components and why they were chosen

Component	What it does	Why this choice
Amazon Textract	Extracts printed and handwritten text, forms, tables and query answers from documents.	Pre-trained deep learning behind an API, so no model training is needed for common documents.
Amazon Comprehend	Classifies documents and finds entities and personal information in text, including custom classifiers.	Managed NLP for routing and redaction. Note that topic modelling, event detection and prompt safety classification are no longer offered to new customers.
AWS Step Functions and AWS Lambda	Orchestrates each step, applies business rules and handles retries and errors.	Visible, auditable workflow where the rules stay in code people can review.
Amazon Augmented AI (A2I)	Sends low-confidence results to a human review queue.	Human oversight built into the pipeline rather than bolted on.
AWS Glue and Amazon S3	Stores raw and curated data and prepares features with Spark or Python jobs.	Standard, serverless data foundation for ML.
Amazon SageMaker AI	Training, Pipelines, Model Registry, real-time endpoints, batch transform and Model Monitor.	One managed toolchain from experiment to monitored production model.
SageMaker Ground Truth	Labelling workflows for images, text and other data, with your own staff or a vendor workforce.	Labelled data is usually the bottleneck for supervised and deep learning.
Amazon Rekognition Custom Labels	Trains a custom image model from a small labelled set using transfer learning.	A simpler deep learning option when you do not need control of the network.
Amazon Bedrock	API access to foundation models, with Guardrails, knowledge bases and model customisation where supported.	Generative AI without hosting models, with data kept within your AWS account controls.

Design decisions and trade-offs

Approach

Use the least complex technique that meets the need

Why. Rules and managed services are cheaper to run and easier to explain and audit than custom models.

Trade-off. Managed services cover common tasks well but cannot be tuned as deeply as your own model.

Build or adapt

Pre-trained first, fine-tune second, train from scratch last

Why. Pre-trained models cut the data and compute needed by a large margin.

Trade-off. You inherit the provider's training data and limits, so evaluate on your own data.

Hosting

Managed AWS services in the Sydney Region where offered

Why. Keeps data in Australia and reduces the infrastructure you operate.

Trade-off. Some models and features arrive in Sydney later or only through cross-Region inference.

Oversight

Confidence thresholds route uncertain results to people

Why. Puts human judgement where the model is weakest.

Trade-off. Review queues need staffing, and thresholds need tuning.

Well-architected pillars

Security

Least-privilege IAM roles per pipeline, KMS encryption for data and model artefacts, VPC endpoints for S3 and SageMaker AI, and no public endpoints for models.

Reliability

Step Functions retries and dead-letter queues, versioned models with rollback through the registry, and batch jobs that can be re-run safely.

Performance

Match the technique to the latency need: synchronous APIs for interactive use, asynchronous or batch processing for volume, and GPUs only where deep learning needs them.

Cost optimisation

Pay-per-request managed services for low volumes, batch transform instead of always-on endpoints where results can wait, and Spot capacity for training where interruptions are acceptable.

Operational excellence

Pipelines as code, a model registry with approval status, and dashboards for accuracy, drift, review rates and failures.

Sustainability

Reuse pre-trained models, right-size instances, stop idle endpoints and avoid training large models when a smaller one is good enough.

Network, identity and data

Networking

Workloads run in private subnets with VPC endpoints for S3, SageMaker AI, Textract, Comprehend and Bedrock where offered. Inbound access goes through authenticated APIs, and outbound integration to records, CRM and asset systems goes through controlled connectors.

Identity and least privilege

Staff sign in through the organisation's identity provider with MFA. Each pipeline step has its own IAM role, model approval in the registry is restricted to named approvers, and human reviewers only see the items assigned to them.

Data and encryption

Raw, curated and labelled data sit in separate S3 prefixes or buckets encrypted with KMS keys, with lifecycle rules matched to records retention. Training data lineage is recorded with each model version, and personal information is minimised or redacted before training.

Security and compliance mapping

Control	How this design addresses it
Guidance for AI Adoption: accountability and inventory	Each use case has an owner, a risk tier and an entry in the AI inventory before build.
NIST AI RMF: Measure and Manage	Agreed accuracy and fairness thresholds, pre-release evaluation and Model Monitor or equivalent checks after release.
Human oversight	Confidence thresholds route uncertain or high-impact results to A2I review, and people make final decisions affecting individuals.
Australian Privacy Principles	Privacy impact assessment, data minimisation, Sydney Region storage and retention rules.
ASD Essential Eight	MFA, restricted admin privileges, patched managed services and logged administrative actions.
ISO/IEC 42001	Documented lifecycle, model versioning and change approval support an AI management system.

Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.

Failure modes, targets and scaling

Target RTOHours for batch pipelines; minutes for interactive endpoints with a standby version
Target RPONear zero for source data on S3 with versioning
Scaling and limitsManaged services scale with request quotas; check service quotas for your account

Failure mode	Mitigation
Model accuracy drifts as data changes	Monitor data and prediction quality, alert on drift and retrain through the pipeline with approval.
Low-quality scans or unusual documents	Confidence thresholds send them to human review instead of failing silently.
Biased or unrepresentative training data	Check data coverage before training and test results across relevant groups.
Generative model gives a wrong or made-up answer	Ground outputs in source data, apply Guardrails and keep a person responsible for published content.
Service or feature not offered in Sydney	Confirm availability before design and document any cross-Region processing in the privacy assessment.

Observability and runbooks

CloudWatch dashboards for pipeline runs, failures, latency and human review rates.
Model Monitor or scheduled evaluation jobs for data quality and accuracy drift.
CloudTrail for model approval, deployment and data access events.
A monthly review of errors and complaints with the business owner.

Cost drivers and levers

Cost grows with document or request volume for managed services, with training time and instance type for ML and deep learning, and with tokens for generative models.

Batch work where results can wait
Smaller pre-trained models before larger ones
Spot capacity for training
Stop or scale down idle endpoints
Cache repeated generative results

Implementation and fit

Phased approach

Pick one use case, define the decision, the owner and the success measure, and register it in the AI inventory.
Prove it with managed services or a baseline model on a sample of real, privacy-reviewed data.
Add human review, monitoring and approval, then pilot with one team.
Scale to more volume or use cases once results and controls hold up.

Anti-patterns to avoid

Choosing deep learning because it sounds advanced when rules or a simple model would do.
Training on personal information without a privacy assessment.
Deploying a model with no owner, threshold or monitoring.
Letting a model make final decisions about people without review or appeal.
Calling every automation AI, which confuses risk assessment and procurement.

When to use it

You need to explain to staff, councillors or a board what kind of AI a project uses and why.
You are choosing between rules, a managed AI service, a custom model or a foundation model.
You want reference patterns on AWS for document processing, forecasting or computer vision.

When not to

The task is fully defined by fixed rules and needs no inference at all; ordinary automation is enough.
You lack the data, owner or review capacity to run a model safely.

Frequently asked questions

What is the difference between AI, machine learning and deep learning?

AI is the broad field of systems that infer outputs such as predictions, content or decisions from their inputs. Machine learning is the part of AI where behaviour is learned from data instead of written as rules. Deep learning is the part of machine learning that uses many-layered neural networks. Each sits inside the one before it.

Is generative AI or ChatGPT-style technology deep learning?

Yes. Large language models and most generative AI are deep learning models, usually transformers, trained on very large datasets. They are a subset of deep learning, which is a subset of machine learning.

Is every AI system machine learning?

No. Rule-based expert systems, search, planning and optimisation are AI without machine learning. Many practical systems combine rules with machine learning components.

Which should a small business or council start with?

Usually rules plus a managed AI service, such as document extraction or text classification, because they need little data and are easier to explain and govern. Move to custom machine learning when you have good historical data and a clear prediction to make.

When is deep learning worth it?

When the input is images, audio or free text, when patterns are too complex to describe with designed features, or when you need to generate content. Start from a pre-trained model where you can, because training from scratch needs much more data and compute.

Are these AWS services available in Sydney?

Amazon Textract, Amazon Comprehend, Amazon A2I, SageMaker AI training, Pipelines, batch transform and Model Monitor, Ground Truth, Rekognition Custom Labels and Amazon Bedrock all offer their APIs in the Asia Pacific (Sydney) Region. Individual models, instance types and features vary, so check the AWS regional availability pages before you design.

How do we govern AI, ML and deep learning differently?

The same framework applies to all three, scaled by risk: an owner, an inventory entry, a risk tier, testing before release and monitoring after. Machine learning and deep learning need extra attention to training data, drift and explainability, and generative AI needs guardrails and checks on generated content.

More in ai, llm and real-time

AWS · chatbot · guardrails
Customer chatbot with slot filling, LLM orchestration and guardrails on AWS
A customer-facing chatbot with flow control and guardrails kept apart. A deterministic engine owns intents, slots, validation and retries. A catalog of controls across six layers (input, context, model, tool and action, output, human oversight) screens every message in and every reply out, and a small Bedrock model is called only between questions, all on pay-per-use serverless services.
AWS and Azure AI
RAG application with Amazon Bedrock or Azure OpenAI, a vector store, guardrails and evaluation
A grounded question-answering system for internal knowledge: governed ingestion, hybrid retrieval with permissions, a guarded model call, citations, an audit log and a repeatable evaluation harness.
AWS and Azure AI
AI agent with tool use and human approval
An agent that can do things, not just answer: a bounded planner, a registry of narrowly scoped tools, policy checks outside the model, human approval for consequential actions and a full action ledger.

Related insights

Discuss this architecture

Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.

Start a conversation Call 0402 401 584

AI vs machine learning vs deep learning: the differences, and a use-case architecture on AWS for each

What each term means

Artificial intelligence (AI)

Machine learning (ML)

Deep learning (DL)

Generative AI and LLMs

How they nest

Side-by-side comparison

Practical guidance for SA businesses, councils and government

Council document processing with rules and managed AI services

Numbered flow

Security and governance

When to use it

When not to

Demand forecasting and churn scoring with Amazon SageMaker AI

Numbered flow

Security and governance

When to use it

When not to

Road and asset defect detection with computer vision, plus generative summaries

Numbered flow

Security and governance

When to use it

When not to

Components and why they were chosen

Design decisions and trade-offs

Use the least complex technique that meets the need

Pre-trained first, fine-tune second, train from scratch last

Managed AWS services in the Sydney Region where offered

Confidence thresholds route uncertain results to people

Well-architected pillars

Security

Reliability

Performance

Cost optimisation

Operational excellence

Sustainability

Network, identity and data

Networking

Identity and least privilege

Data and encryption

Security and compliance mapping

Failure modes, targets and scaling

Observability and runbooks

Cost drivers and levers

Implementation and fit

Phased approach

Anti-patterns to avoid

When to use it

When not to

Frequently asked questions

More in ai, llm and real-time

Customer chatbot with slot filling, LLM orchestration and guardrails on AWS

RAG application with Amazon Bedrock or Azure OpenAI, a vector store, guardrails and evaluation

AI agent with tool use and human approval

Related insights

Discuss this architecture