Customer Responsibility for Regulatory Compliance

What it is

AWS places the responsibility for following laws, including AI regulations and data protection rules, on you as the customer rather than on AWS itself.

Why it matters (compliance & governance perspective)

This provision places the full burden of regulatory compliance for AI-generated content, data protection, and sector-specific rules on the customer, meaning organizations deploying Bedrock in regulated industries must independently ensure compliance rather than relying on AWS's own compliance certifications.

This document changed recently

Consumer impact (what this means for users)

Businesses using Bedrock to serve their own customers bear legal responsibility for ensuring that AI-generated content and data handling comply with applicable laws, including GDPR, CCPA, and sector-specific frameworks like HIPAA, independent of AWS's own compliance posture.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR, CCPA, HIPAA, the EU AI Act, and applicable sector regulations depending on the customer's industry and geography. The FTC's enforcement authority over AI-related unfair or deceptive practices also applies to customer-facing AI deployments built on Bedrock, and the terms confirm this responsibility rests with the customer. (2) GOVERNANCE EXPOSURE: High. For organizations in healthcare, financial services, or the EU, this clause means that AWS's infrastructure-level compliance certifications do not automatically satisfy the customer's own regulatory obligations, requiring independent compliance programs for each deployment context. (3) JURISDICTION FLAGS: EU customers face heightened exposure under the EU AI Act, which imposes specific transparency, human oversight, and documentation requirements on deployers of AI systems, all of which fall on the customer under this clause. California customers have CCPA obligations regarding AI-processed personal data. Healthcare customers must separately execute and maintain Business Associate Agreements with AWS if Bedrock is used with protected health information. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise contracts should include representations from the customer organization's legal team confirming that a jurisdiction-specific compliance review has been conducted for each Bedrock use case prior to production deployment. This clause effectively shifts compliance risk from AWS to the customer and should be flagged in vendor risk assessments. (5) COMPLIANCE CONSIDERATIONS: Legal and compliance teams should conduct a use-case-by-use-case regulatory mapping for each Bedrock deployment, identifying applicable laws, required disclosures to end users about AI-generated content, and any consent or opt-out mechanisms required by applicable law. EU deployments should assess EU AI Act risk classification for each application built on Bedrock.

Applicable agencies

Provision details

Other risks in this policy

• Prohibition on Training Competing Models with Bedrock Outputs medium
• Third-Party Model Provider Supplemental Terms medium
• AWS Right to Modify or Discontinue Model Availability medium
• Prohibition on Circumventing Safety and Content Restrictions medium
• Data Processing and Customer Content in Bedrock medium
• Acceptable Use and Prohibited Applications high