When you use an AI model from a company other than Amazon through Bedrock, your data may be sent to that company and governed by their separate rules, not just AWS's rules.
This analysis describes what AWS Bedrock's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause creates a bifurcated governance structure in which data processing for third-party models falls outside AWS's direct control and contractual scope, requiring users to separately evaluate and comply with each model provider's distinct terms, privacy policies, and data handling practices.
The updated terms now explicitly state that AWS IoT SiteWise Scenario Discovery is not designed for real-time vehicle control and cannot be used as the sole basis for determining vehicle safety or regulatory compliance. Organizations deploying this service must implement independent human monitoring and safety validation before using its outputs to support vehicle system decisions. The terms make clear that AWS assumes no responsibility for uses that violate these constraints.
View change record →The updated terms establish new restrictions on how AWS Capacity Reservations may be used. Specifically, customers purchasing On-Demand Capacity Reservations can no longer resell them to other parties, and AWS reserves the right to cancel the purchase or terminate running instances if the company suspects resale activity. For Capacity Blocks for ML, the grace period before instance termination increased from 30 minutes to 60 minutes for UltraServer instance types, allowing slightly more time to complete workloads. The Amazon Sidewalk qualification program was renamed and simplified, but the underlying security and operational requirements remain in effect.
View change record →The updated terms establish a formal framework for AWS Bedrock's free exploration services, clarifying the operational boundaries and responsibilities. AWS reserves the right to discontinue these services at any time without prior notice, meaning customers cannot rely on their continuation for production planning. Customers are solely responsible for testing, deploying, and maintaining any code, documents, or AI solutions AWS provides, including determining whether those solutions comply with applicable law. AWS retains the right to develop competing products based on content it creates during these engagements, though this does not override existing non-disclosure agreements. Customers are prohibited from requiring AWS personnel to sign additional terms as a condition of receiving free services, and any such documentation signed by AWS personnel is void.
View change record →Using third-party foundation models through Bedrock means your prompts, documents, and outputs may leave AWS's direct control and become subject to terms you have not directly negotiated, which could affect your data protection, confidentiality, and compliance posture.
How other platforms handle this
We share Personal Data with vendors, service providers, and agents who work on our behalf and provide us with services related to the purposes described in this Privacy Policy or our Terms of Service.
we may use, retain or share information with law enforcement or others in circumstances where a person's vital interests require protection, such as in the case of emergencies.
Third-party apps use data from Gemini consistent with their own privacy policies and terms.
"If you use a third-party model, your inputs and outputs may be processed by the third-party model provider, and such processing will be subject to that provider's terms and conditions.Excerpt from AWS Bedrock's AWS Service Terms
REGULATORY LANDSCAPE: This provision directly engages GDPR Article 28 on sub-processor relationships and the obligation for data controllers to ensure sub-processors provide sufficient guarantees.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The clause creates a bifurcated governance structure in which data processing for third-party models falls outside AWS's direct control and contractual scope, requiring users to separately evaluate and comply with each model provider's distinct terms, privacy policies, and data handling practices.
Using third-party foundation models through Bedrock means your prompts, documents, and outputs may leave AWS's direct control and become subject to terms you have not directly negotiated, which could affect your data protection, confidentiality, and compliance posture.
ConductAtlas has identified this type of provision across 287 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS Bedrock.