Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement places full legal responsibility on the customer for providing privacy notices and obtaining consents required by applicable law when processing end user personal data through AWS services, and the customer represents to AWS that these obligations have been met.
This analysis describes what AWS Bedrock's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that AWS's contractual liability for privacy notice and consent compliance is limited and that the customer assumes responsibility for lawful basis requirements under GDPR, CCPA, and other applicable privacy frameworks when using AWS services to process personal data.
The updated terms establish new restrictions on how AWS Capacity Reservations may be used. Specifically, customers purchasing On-Demand Capacity Reservations can no longer resell them to other parties, and AWS reserves the right to cancel the purchase or terminate running instances if the company suspects resale activity. For Capacity Blocks for ML, the grace period before instance termination increased from 30 minutes to 60 minutes for UltraServer instance types, allowing slightly more time to complete workloads. The Amazon Sidewalk qualification program was renamed and simplified, but the underlying security and operational requirements remain in effect.
View change record →The updated terms establish a formal framework for AWS Bedrock's free exploration services, clarifying the operational boundaries and responsibilities. AWS reserves the right to discontinue these services at any time without prior notice, meaning customers cannot rely on their continuation for production planning. Customers are solely responsible for testing, deploying, and maintaining any code, documents, or AI solutions AWS provides, including determining whether those solutions comply with applicable law. AWS retains the right to develop competing products based on content it creates during these engagements, though this does not override existing non-disclosure agreements. Customers are prohibited from requiring AWS personnel to sign additional terms as a condition of receiving free services, and any such documentation signed by AWS personnel is void.
View change record →The updated terms establish new data-sharing mechanisms for users of Anthropic models on Amazon Bedrock. Specifically, AWS now explicitly authorizes notification to Anthropic of metadata present in requests sent to certain Anthropic products (e.g., Claude Code, computer use features), enabling Anthropic to conduct product-level usage attribution. Additionally, the terms introduce AWS WAF AI traffic monetization, which permits AWS to facilitate payment transactions between content publishers and buyers by sharing pricing, payment, and configuration information with payment providers and facilitators; the updated terms clarify that AWS does not provide regulated financial services and is not a party to fund flows, and that users' interactions with payment providers are governed by separate terms between the user and those parties. Users employing these features should review what metadata may be embedded in their requests and understand their own obligations to payment providers.
View change record →Under this clause, customers using AWS services to process end user personal data bear full legal responsibility for privacy notices, consent mechanisms, and lawful processing compliance under applicable law, and make an affirmative representation to AWS that these requirements have been satisfied.
Cross-platform context
See how other platforms handle Customer Responsibility for Privacy Notices and Consent and similar clauses.
Compare across platforms →Monitoring
AWS Bedrock has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you process the personal data of End Users or other identifiable individuals in your use of a Service, you are responsible for providing legally adequate privacy notices and obtaining necessary consents for the processing of such data. You represent to us that you have provided all necessary privacy notices and obtained all necessary consents. You are responsible for processing such data in accordance with applicable law.Excerpt from AWS Bedrock's AWS Service Terms
REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 13 and 14 (information obligations to data subjects), Article 6 (lawful basis for processing), and Article 7 (conditions for consent), as well as CCPA disclosure and opt-out obligations. The relevant enforcement authorities are national data protection supervisory authorities under GDPR and the California Privacy Protection Agency and State AG under CCPA. The provision reflects the customer's role as data controller responsible for these obligations, consistent with the data controller/processor distinction established in the incorporated DPA. GOVERNANCE EXPOSURE: High for customers processing personal data of EU, UK, or California residents through AWS services. The affirmative representation embedded in Section 1.11 creates a contractual warranty that all necessary privacy notices and consents are in place, meaning a failure in the customer's consent management could constitute both a regulatory violation and a breach of the AWS agreement. JURISDICTION FLAGS: EU and EEA customers are subject to heightened exposure under GDPR's information and consent requirements. California-based customers and customers with California resident users face CCPA disclosure and opt-out obligations. UK customers face UK GDPR equivalents. Swiss customers face FDPA requirements. Customers operating in multiple jurisdictions must satisfy the privacy notice and consent standards of each applicable jurisdiction. CONTRACT AND VENDOR IMPLICATIONS: Customers should ensure that their privacy notices accurately describe processing activities conducted through AWS services, including any cross-region inference under Section 1.24.2 or data sharing with AWS for service improvement under Section 1.20. Consent management platform assessments should verify that consent mechanisms satisfy applicable legal standards for each jurisdiction where end users are located. Vendor agreements with AWS should be reviewed to confirm alignment between the DPA obligations and the customer-side consent framework. COMPLIANCE CONSIDERATIONS: Data protection officers should conduct a gap analysis of existing privacy notices to confirm that AWS-based processing activities are adequately disclosed. Consent mechanism audits should verify lawful basis documentation for each category of end user personal data processed through AWS. Where AWS services are used to process special category data under GDPR Article 9, heightened consent requirements apply and should be reflected in customer-side privacy documentation.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that AWS's contractual liability for privacy notice and consent compliance is limited and that the customer assumes responsibility for lawful basis requirements under GDPR, CCPA, and other applicable privacy frameworks when using AWS services to process personal data.
Under this clause, customers using AWS services to process end user personal data bear full legal responsibility for privacy notices, consent mechanisms, and lawful processing compliance under applicable law, and make an affirmative representation to AWS that these requirements have been satisfied.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS Bedrock.