{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"fd6c3793-7c01-4dce-b514-a17a504e53ef","screeningDate":"2026-08-06T03:50:10.988Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"d9e2da07-eaec-43e2-ab29-9286bca75911","name":"Services Agreement","type":"terms","jurisdiction":"Global","sourceUrl":"https://www.microsoft.com/en/servicesagreement"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"f5f9771fb52f68677e68c08d729e4b16c8834f9221ba0de128ab1b4583eb3f09","capturedAt":"2026-07-06T07:20:24.748Z"},"current":{"version":2,"sha256":"d48f6898d876883fe3ccd1d259c8afada7a329cf4824b73afc4a4f785929cd24","capturedAt":"2026-08-06T03:50:10.980Z"}},"assessment":{"summary":"This policy update introduces no changes; existing terms grant Microsoft broad content usage rights and mention autonomous AI decisions without transparency.","overallRisk":"Medium","overallScore":6,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"warning","textEn":"Broad license for user content, including for service improvement.","textIt":"Ampia licenza per i contenuti utente, anche per il miglioramento del servizio.","deltaScore":0,"evidenceQuote":"you grant to Microsoft a worldwide and royalty-free intellectual property license to use Your Content, for example, to make copies of, retain, transmit, reformat, display, and distribute via communication tools Your Content on the Services.","evidenceSide":"old","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"AI services make autonomous decisions with opaque processes.","textIt":"I servizi AI prendono decisioni autonome con processi opachi.","deltaScore":0,"evidenceQuote":"AI services that make decisions, or take actions, autonomously or with varying levels of human intervention","evidenceSide":"old","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"},{"icon":"info","textEn":"Data export can be restricted if it compromises security or IP.","textIt":"L'esportazione dei dati può essere limitata se compromette sicurezza o IP.","deltaScore":0,"evidenceQuote":"Microsoft reserves the right to restrict the export of data that may compromise the security of the services or Microsoft's intellectual property.","evidenceSide":"old","relatedKpi":"kpiRightToDeletion","anchorStatus":"verified"}],"keyPoints":[{"textEn":"You retain ownership of your content, but grant Microsoft a broad, worldwide, royalty-free license to use it.","textIt":"Mantieni la proprietà dei tuoi contenuti, ma concedi a Microsoft una licenza ampia, mondiale e royalty-free per usarli.","sentiment":"negative"},{"textEn":"AI services may make autonomous decisions, but the policy lacks transparency on how these decisions are made.","textIt":"I servizi AI possono prendere decisioni autonome, ma la policy manca di trasparenza su come vengono prese queste decisioni.","sentiment":"negative"},{"textEn":"You have the right to close your account and request data deletion, with a 30-60 day suspension period.","textIt":"Hai il diritto di chiudere il tuo account e richiedere la cancellazione dei dati, con un periodo di sospensione di 30-60 giorni.","sentiment":"positive"},{"textEn":"Microsoft reserves the right to restrict data export if it compromises security or intellectual property.","textIt":"Microsoft si riserva il diritto di limitare l'esportazione dei dati se compromette la sicurezza o la proprietà intellettuale.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"No changes were introduced. Enterprises using Microsoft services should assess the implications of the broad content license and AI decision-making for their own data governance and compliance with GDPR and the upcoming AI Act.","complianceNoteEn":"GDPR, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No changes were introduced. The broad content license and opaque AI decision-making raise concerns under GDPR principles of data minimization and transparency. The AI Act will require more clarity on autonomous AI systems.","complianceNoteEn":"GDPR, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"No changes were introduced. Global enterprises must evaluate the broad content license and AI governance aspects for their cross-border data transfers and intellectual property strategies. Compliance with diverse international regulations is key.","complianceNoteEn":"International Data Laws"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No changes were introduced. Individuals globally should understand the broad content license and the use of AI in services, which could affect their data privacy and intellectual property rights. Data export limitations are also a consideration.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"No changes were introduced. Businesses should consider the implications of the content license and AI usage for their intellectual property and data handling, ensuring compliance with US state privacy laws and industry-specific regulations.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No changes were introduced. Users should be aware of the broad content license and the use of AI in services, which may impact their privacy rights under state laws like CCPA/CPRA. Data export restrictions could limit user control.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Services Agreement source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/fd6c3793-7c01-4dce-b514-a17a504e53ef","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"bcdcf60905c158575e5ce4924cde80780f5cbc22ec929931bc7e84db165aecee"}