{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"e07fec54-d750-4981-af98-35f3865bf252","screeningDate":"2026-11-06T19:40:34.229Z","publicationGate":"published","company":{"id":"edaffd5f-94d3-483c-8ae1-b5ae272d33ec","name":"Amazon","slug":"amazon","industry":"E-Commerce"},"policy":{"id":"c51f6ead-7964-41b8-92cb-c4434ad524d5","name":"AWS Service Terms","type":"terms","jurisdiction":"Global","sourceUrl":"https://aws.amazon.com/serviceterms/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-06T19:40:34.201Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":5,"sha256":"7acc7d6038bb32c67f9d26eae493a1283dfd17b7a724ededa2e4f6e8defaac4d","capturedAt":"2026-11-04T18:40:49.124Z"},"current":{"version":6,"sha256":"69a279bb156f655df59543650d5cb07c68af4e0fa2d38c88272ff14691137183","capturedAt":"2026-11-06T19:40:34.201Z"}},"analysisLineage":{"status":"verified","requestSha256":"82bd84214e7891d04cfd089bcb17fa71ecaa0e44668c7dd7cd3649d3ee6c557c","responseSha256":"12fb510691f35055dbad558967801f6a290e98c22c3e86b06e4cea38045011df","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"7acc7d6038bb32c67f9d26eae493a1283dfd17b7a724ededa2e4f6e8defaac4d","charLength":293162,"byteLength":294458,"rangeUnit":"utf16-code-unit","includedRanges":[[0,293162]],"excludedRanges":[]},"new":{"sha256":"69a279bb156f655df59543650d5cb07c68af4e0fa2d38c88272ff14691137183","charLength":293214,"byteLength":294510,"rangeUnit":"utf16-code-unit","includedRanges":[[0,293214]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://aws.amazon.com/serviceterms/","requestedUrl":"https://aws.amazon.com/serviceterms/","finalUrl":"https://aws.amazon.com/service-terms/","capturedAt":"2026-11-04T18:40:49.124Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://aws.amazon.com/serviceterms/","requestedUrl":"https://aws.amazon.com/serviceterms/","finalUrl":"https://aws.amazon.com/service-terms/","capturedAt":"2026-11-06T19:40:34.201Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The \"AWS assistant Free Tier\" now lacks IP indemnity for generative AI output, increasing user risk, though data use for AI improvement has an opt-out.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"7deb6076-3311-47dc-8dac-cf74eba61d26","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-11-04T18:40:49.154Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"alert","textEn":"New AI Free Tier excludes IP indemnity for generative output.","textIt":"Il nuovo livello gratuito AI esclude l'indennizzo IP per l'output generativo.","deltaScore":2,"evidenceQuote":"Amazon Q (excluding Amazon Q Developer Free Tier and AWS assistant Free Tier)","evidenceSide":"new","relatedKpi":"kpiAiOutputOwnership","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad data use for AI improvement requires user opt-out.","textIt":"L'ampio utilizzo dei dati per il miglioramento dell'IA richiede l'opt-out dell'utente.","deltaScore":1,"evidenceQuote":"You may instruct AWS not to use and store AI Content processed by an AI Service to develop and improve that Service or technologies of AWS or its affiliates by configuring an AI services opt-out policy using AWS Organizations.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Data may be stored/processed in regions outside user's primary region.","textIt":"I dati possono essere archiviati/elaborati in regioni diverse da quella principale dell'utente.","deltaScore":1,"evidenceQuote":"we may store your Amazon WorkSpaces AI Content in AWS regions outside the AWS regions where you are using Amazon WorkSpaces AI Features.","evidenceSide":"new","relatedKpi":"kpiCrossBorderTransfer","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Users of \"AWS assistant Free Tier\" now lack IP indemnity for generative AI output, increasing their liability.","textIt":"Gli utenti del \"livello gratuito di AWS assistant\" ora non hanno indennizzo IP per l'output AI generativo, aumentando la loro responsabilità.","sentiment":"negative"},{"textEn":"The policy clarifies that an opt-out mechanism exists for \"AWS assistant Free Tier\" data used for AI improvement.","textIt":"La politica chiarisce che esiste un meccanismo di opt-out per i dati del \"livello gratuito di AWS assistant\" utilizzati per il miglioramento dell'IA.","sentiment":"positive"},{"textEn":"AWS broadly uses customer content for AI model training and service improvement, requiring user opt-out.","textIt":"AWS utilizza ampiamente i contenuti dei clienti per l'addestramento dei modelli AI e il miglioramento del servizio, richiedendo l'opt-out dell'utente.","sentiment":"negative"},{"textEn":"Cross-border data transfers are common, with Standard Contractual Clauses (SCCs) for EU GDPR compliance.","textIt":"I trasferimenti di dati transfrontalieri sono comuni, con le Clausole Contrattuali Standard (SCC) per la conformità al GDPR UE.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using \"AWS assistant Free Tier\" for generative AI face heightened IP infringement risks. Cross-border data transfers are managed via SCCs, but overall AI Act compliance for AI solutions remains a key responsibility.","complianceNoteEn":"GDPR Art. 46, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The exclusion of \"AWS assistant Free Tier\" from IP indemnity increases personal liability for generative AI output. Data processing for AI improvement has an opt-out, aligning with GDPR principles.","complianceNoteEn":"GDPR Art. 6, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must evaluate the impact of the AI indemnity exclusion on their \"AWS assistant Free Tier\" usage. Adherence to diverse international data protection and AI governance frameworks is essential.","complianceNoteEn":"International Regulations"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The change in AI indemnity for a free tier is a global concern for individuals using generative AI. The availability of an opt-out for data use in AI improvement is a positive global feature.","complianceNoteEn":"Global Data Privacy"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using \"AWS assistant Free Tier\" for generative AI must assess the increased IP risk. Compliance with various state privacy laws and sector-specific regulations like HIPAA is crucial.","complianceNoteEn":"CCPA/CPRA, HIPAA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals using \"AWS assistant Free Tier\" should be aware of the lack of IP indemnity for generative AI output. The opt-out for data use in AI improvement offers some privacy control.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original AWS Service Terms source still match the recorded public snapshot version 6?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/e07fec54-d750-4981-af98-35f3865bf252","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"6225f051689dd15530a5adb3dceb118824b5c0e1ae831a16ddfed3a7303147d4"}