AWS Bedrock updated its Service Terms to clarify how it handles customer regulated data in professional services engagements. Previously, the terms stated that customers should not disclose regulated data to AWS personnel except as directed and stated in a Professional Services Order. The updated language adds a new provision: if a customer expressly directs AWS to access regulated data in a Professional Services Order and applicable data protection laws apply, the AWS Professional Services Supplementary Data Processing Addendum (DPA) is automatically incorporated into the agreement. This establishes a formal data processing framework for regulated data handling in professional services contexts.
Enterprise customers: When you ask AWS to handle your regulated data in professional services and data protection laws apply to that data, AWS's data processing obligations are now formally defined in a supplementary agreement.
The updated terms establish that when AWS Bedrock customers direct AWS to access regulated data (such as personal data, protected health information, or controlled unclassified information) in a Professional Services Order, and applicable data protection laws apply, the AWS Professional Services Supplementary Data Processing Addendum is automatically incorporated. This means customers engaging AWS professional services with regulated data now have formal data processing protections and obligations defined in the DPA, rather than relying solely on the general prohibition against disclosing regulated data. The automatic incorporation clarifies the legal framework governing how AWS processes such data.
→ Review the AWS Professional Services Supplementary Data Processing Addendum to understand AWS's data processing obligations and your rights.
→ Confirm that the DPA terms satisfy your organization's data protection compliance requirements under applicable laws.
→ Update your vendor management and data processing agreement records to reflect the automatic DPA incorporation.
This is the 3rd significant Disclosure Requirement Change change AWS Bedrock has made since ConductAtlas began monitoring.
ConductAtlas has recorded 11 material changes to this document over 96 days of monitoring (since May 2026). An additional minor or cosmetic changes were excluded.
4 of AWS Bedrock's significant changes have been classified as negative for consumers.
AWS Professional Services Supplementary DPA is automatically incorporated when customers direct AWS to access regulated data and applicable data protection laws apply, establishing formal data processing obligations.
Clarifies that regulated data includes personal data, personal information, protected health information, controlled unclassified information, and other sensitive data types defined by applicable law or regulation.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
AWS Bedrock formalized its data processing framework for regulated data in professional services by automatically incorporating a supplementary DPA when customers expressly direct AWS to access regulated data and applicable data protection laws apply. This …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-004397.
AWS Bedrock updated its Service Terms to add AWS Elemental Inference to the list of Indemnified Generative AI Services and …
AWS Bedrock updated its Service Terms document date from September 1, 2026 to September 11, 2026. The only substantive change …
AWS Bedrock updated its AWS Service Terms to expand the list of services covered under its Indemnified Generative AI Services …
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.