{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"ffa8f31e-15ff-4c58-b19c-4b29c2e41c6b","screeningDate":"2026-10-28T13:38:49.475Z","publicationGate":"published","company":{"id":"edaffd5f-94d3-483c-8ae1-b5ae272d33ec","name":"Amazon","slug":"amazon","industry":"E-Commerce"},"policy":{"id":"c51f6ead-7964-41b8-92cb-c4434ad524d5","name":"AWS Service Terms","type":"terms","jurisdiction":"Global","sourceUrl":"https://aws.amazon.com/serviceterms/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-28T13:38:49.450Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"38493fdad1820615c99e5074f1342147fcbfad5543b5a61c07ed8ac8d3d1ff45","capturedAt":"2026-10-15T04:41:14.375Z"},"current":{"version":3,"sha256":"a33b28182df8ac8cf2e427695834578ab693eb63e489be9daa69dac202a2fd8c","capturedAt":"2026-10-28T13:38:49.450Z"}},"analysisLineage":{"status":"verified","requestSha256":"95fa98cd35008aa6e7089db02ab775e35bf21e96671241679a4b884049fe267a","responseSha256":"489297880c6da85339191b960b7dbcba161482d9f06b52e3efa8c0eb34ee497a","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"38493fdad1820615c99e5074f1342147fcbfad5543b5a61c07ed8ac8d3d1ff45","charLength":290752,"byteLength":292048,"rangeUnit":"utf16-code-unit","includedRanges":[[0,290752]],"excludedRanges":[]},"new":{"sha256":"a33b28182df8ac8cf2e427695834578ab693eb63e489be9daa69dac202a2fd8c","charLength":291572,"byteLength":292868,"rangeUnit":"utf16-code-unit","includedRanges":[[0,291572]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-15T04:41:14.375Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://aws.amazon.com/serviceterms/","requestedUrl":"https://aws.amazon.com/serviceterms/","finalUrl":"https://aws.amazon.com/service-terms/","capturedAt":"2026-10-28T13:38:49.450Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"AWS now uses content from its new Continuum service for AI training by default, with an opt-out, and details abuse detection for AI services.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"8a6d7e33-63ec-46e8-9a9f-07d25b686d19","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-10-15T04:41:14.390Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"warning","textEn":"New AI service content used for model training by default.","textIt":"Contenuto del nuovo servizio AI utilizzato per l'addestramento del modello per impostazione predefinita.","deltaScore":1,"evidenceQuote":"You agree and instruct that for Amazon CodeGuru Profiler, Amazon Comprehend, AWS Continuum (except AWS Continuum for penetration testing, previously named AWS Security Agent), Amazon Lex, Amazon Polly, Amazon Rekognition, Amazon Textract, A","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Explicit mention of human review for abuse detection in AI services.","textIt":"Menzione esplicita della revisione umana per il rilevamento degli abusi nei servizi AI.","deltaScore":0.5,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiContentModeration","anchorStatus":"not-recorded"},{"icon":"info","textEn":"Information about suspected misuse of AWS Continuum may be shared with third parties.","textIt":"Le informazioni sull'uso improprio sospetto di AWS Continuum possono essere condivise con terze parti.","deltaScore":0.5,"evidenceQuote":"We may share information, that does not include Your Content, about suspected misuse of AWS Continuum for code vulnerabilities involving a third-party model with the provider of that third-party model.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"}],"keyPoints":[{"textEn":"New AWS Continuum service introduced for defensive cybersecurity purposes.","textIt":"Introdotto il nuovo servizio AWS Continuum per scopi di cybersecurity difensiva.","sentiment":"neutral"},{"textEn":"Content from AWS Continuum (excluding penetration testing) may be used for AI/ML model training by default.","textIt":"Il contenuto di AWS Continuum (escluso il penetration testing) può essere utilizzato per l'addestramento di modelli AI/ML per impostazione predefinita.","sentiment":"negative"},{"textEn":"An opt-out mechanism is available for users to prevent their AI Content from being used for training.","textIt":"È disponibile un meccanismo di opt-out per impedire l'uso dei contenuti AI per l'addestramento.","sentiment":"positive"},{"textEn":"Abuse detection mechanisms, including human review, are explicitly mentioned for several AI services.","textIt":"I meccanismi di rilevamento degli abusi, inclusa la revisione umana, sono esplicitamente menzionati per diversi servizi AI.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises must ensure their use of AWS Continuum and other AI services complies with GDPR, especially regarding data processing for AI training. Implementing the opt-out policy via AWS Organizations is crucial for compliance.","complianceNoteEn":"GDPR Art. 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals' data processed by AWS Continuum may be used for AI training by default, raising GDPR concerns about purpose limitation and transparency. The opt-out mechanism helps, but default settings require careful attention.","complianceNoteEn":"GDPR Art. 5, 6, 13"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises worldwide must assess their data governance strategies for AI services, especially with the default use of content for training. Clear communication and robust opt-out management are essential for global compliance.","complianceNoteEn":"Data Governance"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals globally face increased data usage for AI training from the new AWS Continuum service, though an opt-out is provided. The potential for human review of content for abuse detection also impacts privacy expectations.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using AWS Continuum must manage data usage for AI training in line with evolving US state privacy laws. The opt-out mechanism provides a tool for compliance, but internal policies must align.","complianceNoteEn":"CCPA/CPRA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The default use of AI content for training, even with an opt-out, could impact individual privacy rights under state laws like CCPA/CPRA. Explicit consent or clear notice is important for data usage.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original AWS Service Terms source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/ffa8f31e-15ff-4c58-b19c-4b29c2e41c6b","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"e4943dd6e99732bcf7b8458fb23201262d224ce9403bea1a6216852391f11a69"}