Quick answer
The AWS MSP Program requirements changed more in VCL 8.0 than in any recent validation cycle. AWS kept the same 61-control structure, but rebuilt what it measures: 24 controls are entirely new (all AI or agentic), 27 existing controls were updated to fold in AI-specific requirements, and only 10 carried forward unchanged. The question moved from whether you can manage cloud infrastructure competently to whether you can prove AI-driven operations at scale, with outcomes you can measure. If you plan your VCL 8.0 prep as if it were 7.1 with an AI section bolted on, you are going to be surprised.
AWS has spent the last few validation cycles tightening what it takes to hold MSP Program designation, and VCL 8.0 is the biggest jump yet. It looks like a routine refresh until you read it closely, because AWS did not bolt a few AI questions onto the existing checklist. It rebuilt the underlying question the checklist is asking.
In this blog, you will learn what changed in the AWS MSP Program requirements under VCL 8.0, why the new controls ask for evidence rather than policy, and what closing the gap looks like inside a real MSP practice.
What changed in the AWS MSP Program requirements for VCL 8.0
VCL 7.1 asked whether a partner could manage cloud infrastructure competently: patching, monitoring, incident response, cost control, the operational fundamentals of running AWS environments on a customer’s behalf. VCL 8.0 keeps that same 61-control skeleton, but the substance underneath it moved. Twenty-four controls are entirely new, all of them AI or agentic. Twenty-seven existing controls were updated to fold in AI-specific requirements. Only ten carried forward unchanged. The question now is whether you can prove you are delivering AI-driven operations at scale, with outcomes you can actually measure, and that changes what evidence looks like more than most partners have accounted for yet.
The bar moved from doing the work to proving it
Under the old framework, a partner could describe a capability and back it with a policy document. VCL 8.0 has very little patience for that on its own anymore. Nearly every new or updated control asks for a live demonstration, a dated artifact, or a measurable before-and-after, not a description of intent. I have watched well-written policy documents fail to survive the first follow-up question, when the capability behind them was not something the partner actually operated day to day. VCL 8.0 does not leave much room for that.
Configuration management is a clean example of what changed. It used to mean tracking infrastructure change history. Now the same discipline has to extend to AI assets specifically: which model version is deployed, who approved moving it to production, and what changed in an agent’s configuration and when. A partner with excellent infrastructure change logs and no equivalent record for the models and agents running alongside that infrastructure has a real gap now, not a paperwork gap.
Observability follows the same pattern. Showing that an agent took an action is no longer enough. VCL 8.0 wants evidence of why it took that action, a reasoning trace or a decision path an auditor or a customer could actually inspect after the fact instead of taking on faith. Most existing tooling was built to record outcomes, and recording an outcome is a much easier problem than explaining a decision. The kind of MSP I work with generally has not had to clear that bar before.
Why the consolidated controls make audit prep harder
Several 7.1 controls were merged rather than simply updated, and that is a detail that is easy to miss if you are only skimming for what is new. Identity management, role-based access, and multi-factor authentication used to be three separate controls, each independently satisfiable. In 8.0 they are a single identity and access control that also expects evidence of regular access review and privileged access management. Account configuration and public resource exposure went the same way, now living under one continuous security posture control instead of two point-in-time checks.
A partner can genuinely improve nothing and still find its evidence harder to assemble, simply because the control it is measured against now bundles four things where it used to bundle one. I would tell any partner starting VCL 8.0 prep today to start exactly here, not with the new AI controls. Audit readiness under 8.0 includes re-assembling evidence for capabilities you already have, since the ask around them got broader, and that is the piece most partners are not budgeting time for.
What closing the gap looks like in practice
None of this is theoretical. AWS building the reasoning-trace requirement into the checklist tells you it expects partners to have already solved this in production, not to solve it for the first time during an audit. MontyCloud’s Conversations capability, part of CloudOps Assistant, is a useful illustration of what that actually looks like once it exists: a visible orchestrator plan and reasoning trace surfaced alongside the answer, for every query an operator runs, not just the final output. It does not fully answer the observability bar 8.0 sets on its own, but it is a concrete example of execution transparency that was built rather than described in a policy. The same expectation shows up in how these platforms connect to the rest of a partner’s stack, and MontyCloud’s CloudOps MCP Server connects in both directions, pulling in outside tools and exposing MontyCloud’s own services as tools other systems can call.
The harder, less visible problem underneath most of these new operational controls is the one I keep running into in partner conversations: can your delivery model actually scale without your headcount scaling right alongside it.
The outcome bar is real, and it is checkable
The clearest sign that the outcome requirement has teeth is that it is already showing up in the field. Innovative Solutions, an AWS Premier Tier Partner running hundreds of Migration Acceleration Program engagements a year, standardized their delivery on MontyCloud’s Service Catalog and AWS Built-in. Customer onboarding went from months to one to two weeks. Deployment time went from two weeks to a month down to five to ten hours. AWS Migration Acceleration Program engagement reporting, previously a manual, error-prone process requiring dedicated staff, now takes about thirty minutes. That is exactly the kind of before-and-after 8.0 expects every partner to produce, and it expects it as audit evidence, not as a marketing case study.
Who does well under the new AWS MSP Program requirements
VCL 8.0 will be administered like a compliance exercise, but the partners who actually treat it as one are going to struggle with it. Treat it instead as an operating-model question, whether your AI and agentic delivery can be governed, measured, and explained the same way your infrastructure delivery already is, and most of the checklist falls out naturally from work you should be doing anyway. Work backward from the audit instead, and you will find the evidence AWS wants does not exist, because it was described but never built.
If you are preparing for VCL 8.0 and want to see what that operating model looks like in practice, request a demo of MontyCloud DAY2 and we will walk through how AI-driven CloudOps produces the evidence the new AWS MSP Program requirements ask for.
This post is based on the AWS MSP Program Validation Checklist as communicated in 2026. Program requirements, controls, and eligibility are set by AWS and subject to change. Always refer to your official AWS partner communications for the most up-to-date details.
Frequently asked questions about AWS MSP Program requirements
What is VCL 8.0 in the AWS MSP Program?
VCL 8.0 is version 8.0 of the AWS MSP Program Validation Checklist (VCL), the control set an independent auditor uses to validate that a partner qualifies for the AWS Managed Service Provider designation. It keeps the 61-control structure of VCL 7.1 but rebuilds much of the substance around AI and agentic operations.
What changed between VCL 7.1 and VCL 8.0?
VCL 7.1 measured whether a partner could manage cloud infrastructure competently. VCL 8.0 asks whether a partner can prove AI-driven operations at scale, with measurable outcomes. Of the 61 controls, 24 are entirely new (all AI or agentic), 27 were updated to add AI-specific requirements, and only 10 carried forward unchanged. Several 7.1 controls were also consolidated, so the same evidence now has to cover a broader ask.
How many new controls are in VCL 8.0?
Twenty-four of the 61 controls are entirely new, and all of them are AI or agentic. Another 27 existing controls were updated to fold in AI-specific requirements, leaving only 10 controls unchanged from VCL 7.1.
What evidence does VCL 8.0 require?
VCL 8.0 asks for live demonstrations, dated artifacts, and measurable before-and-after outcomes rather than policy documents describing intent. For AI assets that includes configuration history (which model version is deployed, who approved it, what changed and when) and observability that captures why an agent took an action, such as a reasoning trace an auditor or customer can inspect after the fact.
How should MSP partners prepare for VCL 8.0?
Start with the consolidated controls, not the new AI controls, because you likely have to re-assemble evidence for capabilities you already have. Then treat VCL 8.0 as an operating-model question: make sure your AI and agentic delivery can be governed, measured, and explained the same way your infrastructure delivery already is. Partners who work backward from the audit tend to find the evidence AWS wants was described but never built.
About the author
Tony Bulding is a Principal Sales Engineer at MontyCloud. He works with AWS Partners and MSPs on cloud operations automation, and helps partner teams scale governance, evidence, and audit readiness without scaling headcount.