Resources
An AI subprocessor is a downstream vendor a processor uses to deliver AI features — and why it belongs in every DPA and vendor review.
Published 2026-07-21
An AI subprocessor is a downstream vendor that one of your vendors uses to deliver an AI feature — most often a model provider that processes your data on the vendor's behalf. Under GDPR Article 28, that provider is a subprocessor, and it belongs on the vendor's published subprocessor list with an advance-notice obligation attached.
Traditional subprocessors — hosting, email, payments — change slowly and are announced deliberately. AI subprocessors are added fast and quietly: a vendor ships a "summarize" button, wires in a model provider, and updates a subprocessor page that almost nobody re-reads. The result is a new place your data flows, often with new training-rights and retention terms, that never crossed your desk.
The objection window in your DPA only helps if you notice the change while it is open. Point-in-time annual reviews miss additions made the other 364 days of the year. Continuous monitoring of the vendor's legal documents — terms, privacy policy, DPA, and subprocessor list — is what turns "we found out at renewal" into "we objected within the notice period."
Driftline watches those documents for you and flags the AI-relevant changes specifically, so a new AI subprocessor is a finding, not a surprise.
Yes. When your vendor sends your data to an AI model provider to deliver a feature, that provider is a subprocessor and must appear in the vendor's subprocessor list under GDPR Article 28.
Most DPAs require advance notice of new subprocessors and give you an objection window. AI subprocessors are added quietly and often, which is why continuous monitoring matters.
Send us your vendor list and we'll map — free, within 48 hours — which vendors add AI subprocessors or reserve the right to train on your data, and where your nth-party exposure concentrates.