An AI subprocessor is a downstream vendor a processor uses to deliver AI features — and why it belongs in every DPA and vendor review.
Published 2026-07-21 · updated 2026-09-23
An AI subprocessor is a downstream vendor that one of your vendors uses to deliver an AI feature — most often a model provider that processes your data on the vendor's behalf. Where your vendor processes personal data for you as a processor, GDPR Article 28 treats that provider as a sub-processor: it needs your prior authorisation, and under a general authorisation your vendor must tell you about it in advance and give you the chance to object (Art. 28(2) and (4)). Most vendors meet that duty by publishing a subprocessor list and notifying changes to it.
Traditional subprocessors — hosting, email, payments — tend to change slowly and are usually announced deliberately. AI subprocessors are often added with little fanfare: a vendor ships a "summarize" button, wires in a model provider, and updates a subprocessor page that few customers re-read. The result can be a new place your data flows, sometimes with new training-rights and retention terms, that never crossed your desk.
The objection window in your DPA only helps if you notice the change while it is open. A point-in-time annual review sees additions made during the year only after their objection windows have closed. Ongoing monitoring of the vendor's legal documents — terms, privacy policy, DPA, and subprocessor list — is what turns "we found out at renewal" into "we objected within the notice period."
Driftline tracks those documents and flags the AI-relevant changes specifically, so a new AI subprocessor arrives as a flagged change and an alert, not a surprise.
Usually, yes. If your vendor processes personal data for you as a processor and sends it to an AI model provider to deliver a feature, that provider is a sub-processor under GDPR Article 28(2) and (4). It needs your authorisation, and under a general authorisation your vendor must tell you about it in advance so you can object. Most vendors meet this by publishing a subprocessor list.
Under GDPR Article 28(2), a processor working under your general written authorisation must tell you about an intended new sub-processor and give you the chance to object, and most DPAs set a fixed notice period, often 30 days. AI subprocessors are being added as vendors ship AI features, which is why it pays to watch for them.
Paste your vendor list and confirm your email, and we build your report and email it to you — the material changes across your vendors in the last 12 months, which of them added AI subprocessors or reserved the right to train on your data, and where your nth-party exposure concentrates. Free.