{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"4e8ed932-090d-4a02-8304-22144bfdbff5","screeningDate":"2026-07-28T22:39:04.153Z","publicationGate":"published","company":{"id":"2c5bac29-0643-4196-be90-4b5b2767b6ed","name":"OpenAI","slug":"openai","industry":"AI Provider"},"policy":{"id":"a07a13f2-ae2b-4eef-907b-8b9ca5217872","name":"Terms of Use","type":"terms","jurisdiction":"Global","sourceUrl":"https://openai.com/policies/terms-of-use"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.661Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"599267d5fa112f01fc9d48479ad4139cd2c5f1e10e1da00ddf2b5f57be256aab","capturedAt":"2026-07-06T07:19:20.342Z"},"current":{"version":2,"sha256":"e1b6c7256017665913760b6f42591f7b2c3ac632c46ff6f001a7bb0d462e61b8","capturedAt":"2026-07-28T22:39:04.149Z"}},"assessment":{"summary":"You own your AI output and can opt-out of training, but corporate email use risks employer access and you must verify AI accuracy.","overallRisk":"Medium","overallScore":6,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"warning","textEn":"Corporate email use allows employer control over personal accounts.","textIt":"L'uso di e-mail aziendali consente al datore di lavoro di controllare gli account personali.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad 'worldwide' content use implies extensive data transfers.","textIt":"L'ampio uso 'mondiale' dei contenuti implica trasferimenti di dati estesi.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"Users must verify AI output accuracy; OpenAI disclaims responsibility.","textIt":"Gli utenti devono verificare l'accuratezza dell'output dell'IA; OpenAI declina responsabilità.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Users retain ownership of their input and the AI-generated output.","textIt":"Gli utenti mantengono la proprietà del loro input e dell'output generato dall'IA.","sentiment":"positive"},{"textEn":"An opt-out option is available to prevent your content from being used for model training.","textIt":"È disponibile un'opzione di opt-out per impedire l'uso dei tuoi contenuti per l'addestramento del modello.","sentiment":"positive"},{"textEn":"Using a corporate email for your account may allow your employer to access and control your content.","textIt":"L'uso di un'e-mail aziendale per il tuo account potrebbe consentire al tuo datore di lavoro di accedere e controllare i tuoi contenuti.","sentiment":"negative"},{"textEn":"OpenAI can use your content worldwide to improve services, implying global data transfers.","textIt":"OpenAI può utilizzare i tuoi contenuti in tutto il mondo per migliorare i servizi, implicando trasferimenti globali di dati.","sentiment":"negative"},{"textEn":"Users are responsible for verifying the accuracy and appropriateness of AI-generated output.","textIt":"Gli utenti sono responsabili della verifica dell'accuratezza e dell'adeguatezza dell'output generato dall'IA.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must ensure their use of OpenAI services complies with GDPR and the upcoming AI Act. The 'worldwide' data transfer clause necessitates careful due diligence and appropriate transfer mechanisms. Limited liability for OpenAI means businesses bear significant risk for AI output.","complianceNoteEn":"AI Act, GDPR Art. 44"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"GDPR protections apply, including the right to opt-out of data for training. However, 'worldwide' data use requires robust legal safeguards like SCCs. The corporate email clause raises significant privacy concerns under GDPR.","complianceNoteEn":"GDPR Art. 6, 44"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses globally must navigate the policy's terms, especially regarding data transfer and the disclaimer on AI output accuracy. The indemnity clause means businesses are responsible for claims arising from their use of the services and content.","complianceNoteEn":"Local data laws"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy grants users ownership of their AI output and an opt-out for training, which are strong user rights. However, the broad 'worldwide' data use and the responsibility for AI output accuracy place a significant burden on individuals globally.","complianceNoteEn":"Data protection principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"The business addendum specifies California law for disputes, which may impact businesses outside California. Indemnity clauses are standard, but businesses must manage risks associated with AI output accuracy and data handling under various state laws.","complianceNoteEn":"State privacy laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users benefit from content ownership and opt-out rights, aligning with some state privacy laws like CCPA/CPRA. The corporate email clause could expose personal data to employers, which may not be fully protected under US state laws.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Terms of Use source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/4e8ed932-090d-4a02-8304-22144bfdbff5","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"fc987bab5d8ac9d566374d377f4a6c45dbd45055846ecb30cb16d772a7c0cfcd"}