AI Vendor Subprocessors: The Change Notice That Procurement Teams Miss

Map each function and location

Record who receives prompts, uploaded files, output logs, safety telemetry, embeddings and support tickets. For each recipient ask for data categories, purpose, storage region, retention and whether onward transfers can occur. Residency marketed for one inference endpoint does not answer questions about every auxiliary service.

Review contractual roles

Under the UK GDPR controller–processor framework, Article 28 contracts include documented instructions, security, subprocessor authorization, contractual safeguards and audit assistance. The ICO also emphasizes that the relevant role depends on who decides purposes and means in practice. Different national regimes may use different legal tests.

Treat changes as operational events

Subscribe to the vendor’s subprocessor notice mechanism, record the effective date and compare the new provider with the approved data map. A notice without an internal owner is not useful. Define a process to object, suspend high-risk flows or require updated transfer safeguards when appropriate.

Test exit behavior

Check whether terminated service data can be returned or deleted, which logs remain, how backups age out and what proof a vendor supplies. Encrypt data where suitable and constrain API payloads, but do not treat encryption as eliminating the need to understand who processes information.

Example

A healthcare assistant vendor adds an overseas analytics contractor. The purchasing team checks whether any patient text reaches it, whether transfer and contractual protections meet local obligations, and whether the feature can be disabled. If the answer is unknown, the data flow is blocked pending review.

Evidence checked 25 October 2026. Applicability: UK/EU reference; other jurisdictions review. This material is general education, not legal, medical, investment or other professional advice. No vendor performance test is implied.