Graham,
Intel AMT uses Coordinated Universal Time (UTC) -(https://www.timeanddate.com/time/aboututc.html) depending on location of your system it may be ahead or behind of your time zone time.
From your description I guess you are somewhere in Europe
AMT clock is set during configuration to source that depends on your selection in AMT Profile System Settings - RCS server time or vPro PC local OS time (if you select appropriate option). It is always set to UTC format regardless of time synch source: RCS server or Local OS time.
see also AMT Time sync description in : Intel(R) AMT SDK Implementation and Reference Guide
As you pointed to reference - Intel AMT Kerberos authentication uses time stamping -AMT Kerberos Clock tolerance is 5 minutes (0h05m00s) if AMT UTC time differs from AD controller UTC time by more than 5 min (even 5m1s) - Kerberos Authentication will not work anymore. You will have to resynch AMT time to AD time using Digest authentication.
In Intel SCS user guide you will find descriptions of Maintenance task/jobs - one of their option it to resynch AMT time. There are other things you shall resynch - renew ME $iME AD computer object password (before it expires according to AD policy) or renew AMT TLS cert.
In SCS User Guide Intel advises to resynch AMT clock every 2 weeks.
I have configured multiple systems in my demo lab - I have noticed that after over 30 days AMT time differs by just few seconds, but your environment may behave bit differently.
rgds
Dariusz Wittek
Intel EMEA Biz Client Technical Sales Specialist