Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The terms incorporate the AWS DPA, the EU SCCs under Commission Implementing Decision 2021/914, the UK GDPR Addendum, the Swiss Addendum, and the CCPA Terms by reference, with each framework applying conditionally based on whether the relevant data protection regulation governs the customer's use of AWS services.
This analysis describes what AWS Bedrock's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The conditional incorporation of multiple international data protection frameworks by reference means that the applicable contractual obligations for personal data processing depend on the customer's jurisdiction and the nature of data processed, requiring customers to assess which addenda apply to their specific use cases.
The updated terms establish new restrictions on how AWS Capacity Reservations may be used. Specifically, customers purchasing On-Demand Capacity Reservations can no longer resell them to other parties, and AWS reserves the right to cancel the purchase or terminate running instances if the company suspects resale activity. For Capacity Blocks for ML, the grace period before instance termination increased from 30 minutes to 60 minutes for UltraServer instance types, allowing slightly more time to complete workloads. The Amazon Sidewalk qualification program was renamed and simplified, but the underlying security and operational requirements remain in effect.
View change record →The updated terms establish a formal framework for AWS Bedrock's free exploration services, clarifying the operational boundaries and responsibilities. AWS reserves the right to discontinue these services at any time without prior notice, meaning customers cannot rely on their continuation for production planning. Customers are solely responsible for testing, deploying, and maintaining any code, documents, or AI solutions AWS provides, including determining whether those solutions comply with applicable law. AWS retains the right to develop competing products based on content it creates during these engagements, though this does not override existing non-disclosure agreements. Customers are prohibited from requiring AWS personnel to sign additional terms as a condition of receiving free services, and any such documentation signed by AWS personnel is void.
View change record →The updated terms establish new data-sharing mechanisms for users of Anthropic models on Amazon Bedrock. Specifically, AWS now explicitly authorizes notification to Anthropic of metadata present in requests sent to certain Anthropic products (e.g., Claude Code, computer use features), enabling Anthropic to conduct product-level usage attribution. Additionally, the terms introduce AWS WAF AI traffic monetization, which permits AWS to facilitate payment transactions between content publishers and buyers by sharing pricing, payment, and configuration information with payment providers and facilitators; the updated terms clarify that AWS does not provide regulated financial services and is not a party to fund flows, and that users' interactions with payment providers are governed by separate terms between the user and those parties. Users employing these features should review what metadata may be embedded in their requests and understand their own obligations to payment providers.
View change record →Under these terms, the data protection framework governing customer data processed through AWS services is determined by the applicable jurisdiction and type of processing, with separate addenda for GDPR, UK GDPR, Swiss FDPA, CCPA, and EU Data Act scenarios each applying conditionally.
Cross-platform context
See how other platforms handle Incorporated Data Protection Frameworks and similar clauses.
Compare across platforms →Monitoring
AWS Bedrock has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"These Service Terms incorporate the AWS Data Processing Addendum ("DPA"), when you use AWS Services to process Customer Data (as defined in the DPA). These Service Terms incorporate the Standard Contractual Clauses between controllers and processors ("Controller-to-Processor Clauses") and the Standard Contractual Clauses between processors ("Processor-to-Processor Clauses") approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "SCCs"). The SCCs will only apply when: (i) the GDPR applies to your use of the AWS Services to process Customer Data; and (ii) Customer Data is transferred either directly or via onward transfer, to a country outside of the European Economic Area not recognised by the European Commission as providing an adequate level of protection for personal data subject to GDPR (together a "Data Transfer").Excerpt from AWS Bedrock's AWS Service Terms
REGULATORY LANDSCAPE: This provision incorporates contractual mechanisms required under GDPR Chapter V for international data transfers, including the SCCs approved by EU Commission Implementing Decision (EU) 2021/914. The CCPA Terms address California Consumer Privacy Act service provider obligations. The EU Data Act Addendum addresses Regulation (EU) 2023/2854 portability and switching requirements. Enforcement authorities include EU national data protection supervisory authorities, the UK Information Commissioner's Office, the Swiss Federal Data Protection and Information Commissioner, the California Privacy Protection Agency, and State AGs. GOVERNANCE EXPOSURE: Medium. The incorporation by reference structure means customers must actively assess which addenda apply to their operations and ensure their internal data processing documentation reflects the applicable framework. Customers operating across multiple jurisdictions may be subject to several addenda simultaneously, creating layered compliance obligations that must be mapped against specific data flows. JURISDICTION FLAGS: EU and EEA customers must verify that SCC applicability conditions are met for all data transfers to non-adequate third countries. UK customers must ensure the UK GDPR Addendum scope covers all relevant processing activities. Swiss customers subject to the revised FDPA must assess the AWS Swiss Addendum. California customers processing California resident personal data should confirm the CCPA Terms scope. Customers subject to the EU Data Act must assess the EU Data Act Addendum obligations. CONTRACT AND VENDOR IMPLICATIONS: Customers should maintain documentation confirming which AWS addenda apply to their account and update data processing records accordingly. Procurement teams adding new AWS services should assess whether new addenda become applicable. Transfer Impact Assessments may be required for specific SCC-governed data flows, particularly in light of cross-region inference processing under Section 1.24.2. COMPLIANCE CONSIDERATIONS: Data mapping exercises should identify all data flows subject to each incorporated addendum. DPO review should confirm that SCCs are the appropriate transfer mechanism for all relevant cross-border data transfers and that no additional safeguards are required. Customers should review the EU Data Act Addendum obligations for any switching or portability rights it establishes. The interaction between the CCPA Terms and customer-side privacy notices should be assessed to confirm consistency.
The conditional incorporation of multiple international data protection frameworks by reference means that the applicable contractual obligations for personal data processing depend on the customer's jurisdiction and the nature of data processed, requiring customers to assess which addenda apply to their specific use cases.
Under these terms, the data protection framework governing customer data processed through AWS services is determined by the applicable jurisdiction and type of processing, with separate addenda for GDPR, UK GDPR, Swiss FDPA, CCPA, and EU Data Act scenarios each applying conditionally.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS Bedrock.