A GDPR Due Diligence Checklist for an AI Subprocessor

Most AI vendor questionnaires are security questionnaires with “AI” in the title. This one is built from the provisions that actually create the controller’s exposure, and it ends with a procedure you can run against a vendor this week.

Step 1: settle the roles first

Nothing else in the assessment is answerable until you know who is controller and who is processor for each processing operation, and the answer is frequently not the one in the vendor’s contract template. Article 4(7) makes a controller the entity determining the purposes and means; Article 4(8) makes a processor one that processes on the controller’s behalf. The EDPB’s Guidelines 07/2020 on the concepts of controller and processor, adopted 7 July 2021, are the reference, and their central point is that the roles follow the factual influence over purposes and means rather than the label the parties agreed.

For an AI vendor the roles usually split rather than resolve. Serving your inference requests is processing on your behalf. Using the content of those requests to improve the vendor’s own models is a purpose the vendor determined, which makes the vendor a controller for that operation — and a processor cannot lawfully do it on the basis of your instruction alone. Article 28(10) says so bluntly: a processor that determines the purposes and means is a controller in respect of that processing. Ask which operations fall on which side and get it in the contract; where the answer is joint, the arrangement in Article 26 is required, discussed in joint controllership with an AI vendor.

Step 2: the Article 28(3) terms

Article 28(3) lists the terms the processing contract must contain. Read the vendor’s DPA against the list rather than against your memory of what a DPA usually says; the gaps are consistent enough to be worth naming.

• 28(3)(a) — documented instructions, including for transfers. Ask what happens if the vendor considers an instruction infringing, which the second subparagraph requires it to tell you.
• 28(3)(b) — confidentiality commitments from persons authorised to process. For an AI vendor this must reach the human reviewers who see flagged content, who are often contractors.
• 28(3)(c) — Article 32 security measures. Ask for the measures, not for a certificate. A SOC 2 report is evidence about a control environment, not a description of the measures applied to your data.
• 28(3)(d) — subprocessor conditions per Article 28(2) and (4). See the next step.
• 28(3)(e) — assistance with data subject rights. The question that matters: can the vendor locate and delete data relating to one identified person, and within what time? For a fine-tuned model the honest answer is bounded, which is the subject of rights requests against a fine-tuned model.
• 28(3)(f) — assistance with Articles 32 to 36, including DPIAs and prior consultation. Ask specifically what the vendor will provide for a DPIA; see DPIA questions for an AI vendor.
• 28(3)(g) — deletion or return at the end of services, at the controller’s choice. Ask what “deletion” covers: uploaded files, fine-tuned adapters, logs, evaluation caches, and backups, each with a period.
• 28(3)(h) — information and audits. Note that the provision requires the processor to make available the information necessary to demonstrate compliance and to allow for and contribute to audits, including inspections. A clause offering only a third-party report is narrower than the Regulation; see the right-to-audit clause.

Two more provisions to check while you are there. Article 33(2) requires the processor to notify the controller without undue delay after becoming aware of a personal data breach — check the contractual clock, since your own 72-hour obligation under Article 33(1) runs from your awareness and a vendor clause of “within 72 hours” consumes all of it. And Article 30(2) requires the processor to maintain its own record of processing carried out on your behalf; asking to see the entry for your account is a fast test of whether the vendor’s compliance is real or documentary.

Step 3: the subprocessor chain

Article 28(2) says the processor shall not engage another processor without prior specific or general written authorisation of the controller, and where general, must inform of intended changes and give you the opportunity to object. Article 28(4) requires the same data protection obligations to be imposed down the chain, and leaves the first processor fully liable to you for the subprocessor’s performance.

AI supply chains are longer than most buyers assume, and the important question is whether the list you are shown is the whole list. A typical chain runs from the vendor to a model provider, from the model provider to a cloud host, and separately to a content-moderation classifier, a vector database, an observability platform and a human-annotation contractor. Ask for the list, the notice period for changes, whether objection is a real right or a right to terminate, and where each subprocessor processes. The disclosure practice varies widely and is examined in subprocessor disclosure.

Step 4: transfers under Chapter V

If personal data leaves the EEA, Chapter V applies on top of everything above. Establish the mechanism: an adequacy decision under Article 45, standard contractual clauses under Article 46(2)(c) — the current set being Commission Implementing Decision (EU) 2021/914 of 4 June 2021 — binding corporate rules under Article 47, or a derogation under Article 49, which is for occasional transfers and is not a basis for routine operational flows.

Check the module. The 2021 SCCs have four, and controller-to-processor is Module Two while processor-to-processor is Module Three; vendors routinely attach the wrong one, and the choice determines which obligations bind whom. See SCC modules for an AI processor.

Then do the transfer impact assessment. Case C-311/18, Schrems II, decided on 16 July 2020, held that SCCs remain valid but that the exporter must assess whether the law of the destination country prevents the guarantees being met, and supplement them where it does. Where the importer is US-based, whether it is certified under the EU-US Data Privacy Framework changes the analysis materially — see the DPF and AI vendors and the TIA for an AI provider. Ask a specific question rather than a general one: in which countries are the model weights hosted, in which are inference requests served, and in which do support staff access customer content? Those three answers frequently differ, and only the first appears in most data-residency marketing.

Step 5: the AI-specific questions

These are the ones a general vendor questionnaire will not contain, and they are where the difference between two apparently equivalent vendors usually is.

• Is our content used for training, and how is that enforced? Not the marketing answer — the contractual clause and the technical control. A default-off setting is different from a contractual prohibition.
• What is retained from a request, for how long, and who can read it? Zero-retention modes exist at several providers and usually carry conditions and feature exclusions. Get those in writing.
• Are prompts or outputs reviewed by humans, under what trigger, by employees or contractors, in what country?
• Where do fine-tuned artefacts live and how are they deleted? An adapter is a derived artefact containing your data’s influence. Ask for a deletion commitment with a period.
• What is the provenance position on the base model?Following EDPB Opinion 28/2024 of 17 December 2024, the lawfulness of training can affect a downstream deployer, so this is a due diligence question rather than a curiosity.
• What breaks under the AI Act? If you deploy the system in a high-risk use case, you need what Article 13 requires a provider to give a deployer. Ask whether the vendor considers itself a provider under Regulation (EU) 2024/1689 and what documentation it will supply; the roles are covered in provider versus deployer.

Running the assessment

Send the questions as a structured file rather than as prose, so answers come back comparable across vendors and diff cleanly at renewal.

# ai-vendor-dd.yaml — one file per vendor, versioned in the repo
vendor: example-inference-co
assessed: 2026-08-11
roles:
  inference: processor          # art 4(8)
  service_improvement: none     # contractually prohibited, cl. 6.3
article_28:
  instructions_clause: "DPA cl. 3.1"
  deletion_on_termination: "30 days, incl. fine-tune adapters (cl. 9.2)"
  audit_rights: "report + 1 onsite/yr on 30d notice (cl. 11)"
  breach_notice_hours: 24
subprocessors:
  list_url: "https://vendor.example/subprocessors"
  change_notice_days: 30
  objection_right: "terminate without penalty"
transfers:
  mechanism: "SCC 2021/914 Module Two"
  tia: "docs/tia-example-inference-co-2026-08.pdf"
  weights_hosted: [ "eu-central-1" ]
  inference_served: [ "eu-central-1", "eu-west-1" ]
  support_access_from: [ "US", "IN" ]      # <- the answer people forget to ask for
ai_specific:
  training_on_customer_data: false
  retention_default_days: 0
  human_review: "abuse-flagged only, employees, IE"
  ai_act_role_claimed: "provider (GPAI)"
open_items:
  - "no written commitment on adapter deletion from backups"

1. Fill the roles block first from the contract, not from the website. If service improvement is not contractually excluded, treat the vendor as a controller for it and reassess the whole file.
2. Walk Article 28(3) point by point and record the clause number that satisfies each. A blank is a finding; a clause number you cannot find in the document is a bigger one.
3. Pull the subprocessor list on the day of assessment and store a copy. Lists change without notice more often than the notice clause implies, and a stored copy is what lets you show what you relied on.
4. Complete the transfer block, then write or update the TIA. Do not sign with the TIA outstanding: it is the document that has to exist before the transfer starts, not after.
5. Put every unanswered item in open_items, assign an owner and a date, and put the file into your evidence pack. An assessment with recorded gaps is a defensible risk decision; one with no gaps is usually one where nobody asked the hard questions.
6. Re-run at renewal and diff against the previous version. The diff is the audit trail, and it catches the subprocessor added quietly in month seven.