AWS Bedrock updated its abuse detection and content retention practices. Previously, the terms stated that automated abuse detection mechanisms "may apply" to services using Bedrock. The updated language specifies that Bedrock may store service inputs and outputs for up to 30 days to detect policy violations, and clarifies that if child sexual abuse material is detected, AWS may review the flagged content before reporting to authorities. The change also adds a reference to "applicable Service-specific documentation" for additional details and removes a reference to "related information sharing with third parties."
The updated terms establish that AWS Bedrock may store your service inputs and outputs for up to 30 days for the sole purpose of detecting policy violations. Previously, the terms referenced abuse detection mechanisms without specifying retention duration or scope. The revised language also clarifies that if suspected child sexual abuse material is detected, AWS may review the flagged content before reporting to authorities. These changes make explicit what was previously stated in general terms, establishing a concrete data retention window and procedural clarity around content review.
This is the 2nd significant Disclosure Requirement Change change AWS Bedrock has made since ConductAtlas began monitoring.
ConductAtlas has recorded 6 material changes to this document (since May 2026).
2 of AWS Bedrock's significant changes have been classified as negative for consumers.
AWS may store service inputs and outputs for up to 30 days for abuse detection purposes, establishing an explicit retention window previously stated only as 'may apply'.
Clarifies that AWS may review flagged content to determine if it is CSAM before reporting to authorities, adding a procedural step to the reporting process.
Removed reference to 'related information sharing with third parties' from abuse detection documentation reference.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
AWS has clarified its abuse detection practices by specifying a 30-day retention window for service inputs and outputs and detailing the review process for suspected CSAM. This change moves from general language ('automated abuse detection …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-002570.
AWS Bedrock updated its Service Terms to add AWS Elemental Inference to the list of Indemnified Generative AI Services and …
AWS Bedrock updated its Service Terms document date from September 1, 2026 to September 11, 2026. The only substantive change …
AWS Bedrock updated its AWS Service Terms to expand the list of services covered under its Indemnified Generative AI Services …
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.