Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document discloses subprocessors engaged for AI-related processing activities in connection with Atlassian cloud products, establishing that customer data may be processed by third-party AI vendors as part of product functionality.
This analysis describes what Atlassian's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision is operationally significant because AI-related subprocessors may process customer content data, not merely metadata, which creates additional considerations under GDPR's requirements for automated processing, the EU AI Act for high-risk AI systems, and enterprise AI governance policies.
Interpretive note: The document lists subprocessors by processing category but does not specify the technical scope of data access for each AI subprocessor; the extent of AI subprocessor data access must be determined by reference to Atlassian's product documentation and DPA.
This provision establishes that customer data may be processed by third-party AI vendors as part of Atlassian's AI-powered product features. Customers with internal AI governance policies or sector-specific AI restrictions should review the listed AI subprocessors against those requirements.
Cross-platform context
See how other platforms handle AI-Related Subprocessor Disclosure and similar clauses.
Compare across platforms →Monitoring
Atlassian has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Atlassian subprocessors who process customer data.Excerpt from Atlassian's Sub-Processors
1) REGULATORY LANDSCAPE: The EU AI Act imposes obligations on providers and deployers of AI systems, including requirements around transparency, risk classification, and data governance. GDPR Article 22 applies where AI processing constitutes solely automated decision-making with significant effects on individuals. The FTC has issued guidance on AI-related unfair or deceptive practices. Sector-specific AI regulations (financial services, healthcare) may impose additional requirements on customers who use Atlassian AI features. 2) GOVERNANCE EXPOSURE: Medium. The disclosure that AI subprocessors access customer data requires enterprise customers to assess whether their own AI governance frameworks, acceptable use policies, or client-facing commitments are consistent with AI subprocessor access. Customers in regulated industries should determine whether AI-processed data includes special category data or data subject to sector-specific restrictions. 3) JURISDICTION FLAGS: EU customers face heightened exposure under the EU AI Act and GDPR Article 22. UK customers should evaluate under UK GDPR and emerging UK AI governance frameworks. US customers in financial services or healthcare should assess sector-specific AI guidance from relevant regulators. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise agreements should specify which Atlassian AI features are enabled by default and which require opt-in, as this determines the operational scope of AI subprocessor access. Procurement teams should request documentation on AI subprocessors' data retention, model training, and output logging practices. Customers should confirm whether their DPA includes AI-specific processing restrictions. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether the use of AI subprocessors triggers any customer-side notification obligations to data subjects under GDPR transparency requirements (Articles 13-14). Internal AI governance reviews should include a mapping of Atlassian AI features to the listed AI subprocessors. Where enterprise AI policies restrict third-party AI processing of certain data categories, customers should evaluate whether product-level controls exist to limit AI subprocessor access.
This provision is operationally significant because AI-related subprocessors may process customer content data, not merely metadata, which creates additional considerations under GDPR's requirements for automated processing, the EU AI Act for high-risk AI systems, and enterprise AI governance policies.
This provision establishes that customer data may be processed by third-party AI vendors as part of Atlassian's AI-powered product features. Customers with internal AI governance policies or sector-specific AI restrictions should review the listed AI subprocessors against those requirements.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Atlassian.