{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"9f75ba9c-8996-4a19-a3e4-9538af4d5884","screeningDate":"2026-10-01T19:52:18.570Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"d9e2da07-eaec-43e2-ab29-9286bca75911","name":"Services Agreement","type":"terms","jurisdiction":"Global","sourceUrl":"https://www.microsoft.com/en/servicesagreement"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-01T19:52:18.554Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"d48f6898d876883fe3ccd1d259c8afada7a329cf4824b73afc4a4f785929cd24","capturedAt":"2026-08-06T03:50:10.980Z"},"current":{"version":3,"sha256":"47f9638143e130a9ce7831eb4b87c6c67e7a8cf5cd52fd10f2897e864eeb70f8","capturedAt":"2026-10-01T19:52:18.560Z"}},"assessment":{"summary":"Microsoft's updated Services Agreement now covers more products and services by reference, broadening its reach and potentially reducing user clarity.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"fd6c3793-7c01-4dce-b514-a17a504e53ef","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-08-06T03:50:10.988Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"warning","textEn":"Expanded scope of services covered by the agreement, including those not explicitly listed.","textIt":"Ambito dei servizi coperti dall'accordo ampliato, inclusi quelli non esplicitamente elencati.","deltaScore":1,"evidenceQuote":"and any other Microsoft consumer products, websites and services that reference these Terms","evidenceSide":"new","relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"verified"},{"icon":"warning","textEn":"Reduced clarity for users on which specific services are governed by these terms.","textIt":"Minore chiarezza per gli utenti su quali servizi specifici sono regolati da questi termini.","deltaScore":1,"evidenceQuote":"and any other Microsoft consumer products, websites and services that reference these Terms","evidenceSide":"new","relatedKpi":"kpiConsentMechanism","anchorStatus":"verified"},{"icon":"info","textEn":"Minor formatting change in a URL for moderation and enforcement policies.","textIt":"Modifica minore di formattazione in un URL per le politiche di moderazione e applicazione.","deltaScore":0,"evidenceQuote":"aka.ms/trustandsafety","evidenceSide":"old","relatedKpi":"kpiAlgoTransparency","anchorStatus":"verified"}],"keyPoints":[{"textEn":"The agreement's scope is expanded to include any service referencing these terms, not just explicitly listed ones.","textIt":"L'ambito dell'accordo è esteso per includere qualsiasi servizio che faccia riferimento a questi termini, non solo quelli esplicitamente elencati.","sentiment":"negative"},{"textEn":"Users may find it less clear which specific services are governed by this agreement without a definitive list.","textIt":"Gli utenti potrebbero trovare meno chiaro quali servizi specifici sono regolati da questo accordo senza un elenco definitivo.","sentiment":"negative"},{"textEn":"Content ownership remains with the user, but a broad license is granted to Microsoft for service improvement.","textIt":"La proprietà dei contenuti rimane all'utente, ma una licenza ampia è concessa a Microsoft per il miglioramento del servizio.","sentiment":"neutral"},{"textEn":"Users retain the right to delete their data upon account closure, with a 30 or 60-day suspension period.","textIt":"Gli utenti mantengono il diritto di eliminare i propri dati alla chiusura dell'account, con un periodo di sospensione di 30 o 60 giorni.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Microsoft services must ensure their internal compliance aligns with the broadened scope of these terms. This includes reviewing data processing agreements and user consent mechanisms.","complianceNoteEn":"GDPR Article 28"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The expanded scope means more services are covered by these terms, potentially impacting GDPR compliance for data processing. Users should verify how their data is handled across all Microsoft services they use.","complianceNoteEn":"GDPR Article 6, 7"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must ensure their use of Microsoft services remains compliant with various international data protection regulations. The expanded scope necessitates a broader internal review of policy adherence.","complianceNoteEn":"International Data Laws"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals globally will find more Microsoft services governed by these terms, requiring a careful review of the Privacy Statement. The lack of explicit listing for all covered services may reduce transparency.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses relying on Microsoft services need to assess the impact of the expanded terms on their data governance and privacy frameworks. This is crucial for maintaining compliance with state-specific privacy laws.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The broader applicability of terms means more services fall under the same data handling rules. Users should be aware of how their data is used across the expanded range of Microsoft products, especially concerning CCPA/CPRA rights.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Services Agreement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/9f75ba9c-8996-4a19-a3e4-9538af4d5884","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"aad47300f852fcbb8ca80b1a9102220973da88bcc9abddf2ad21d4b14d035ed4"}