Your vendor added an AI subprocessor. Now what?

You spotted it on a subprocessor list, or an alert told you: one of your vendors added an AI provider — an OpenAI, an Anthropic, a cloud AI service — usually to power a new summarize-this or draft-that feature. First, don't panic. An added AI subprocessor is worth a look, not an emergency. Here's a calm, practical way to assess it, decide whether to act, and write it down.

This is practical guidance, not legal advice. Let's start with why you're seeing this at all.

Why AI subprocessors are showing up everywhere

Vendors are racing to ship AI features, and most of them don't build the models themselves — they call a provider. When that provider processes your data to generate a result, it's a subprocessor, and a careful vendor adds it to the list. So a new AI row is often just the paper trail of a feature you may not even have turned on. That's the reassuring part. The part worth checking is what, exactly, that provider does with your data.

What actually matters (a quick assessment)

• Is your data actually sent? Sometimes the AI feature is opt-in or admin-controlled. If you haven't enabled it, your data may never reach the provider.
• Is it used for training? The key question. Reputable enterprise AI terms say customer data isn't used to train their models — but confirm it for this vendor and provider, in writing.
• Where is it processed, and under what terms? Check data location and whether the vendor's DPA already covers the new subprocessor's safeguards.
• What data is in scope? "Summarize this document" sends the document. Know what content the feature touches.

Most of the time, this assessment ends with "acceptable, documented, done." Occasionally it surfaces something you want to change — and that's exactly what the objection window is for.

Your options

• Accept and document: the common outcome. Note the provider, what it's used for, and that you reviewed it — that's your audit evidence.
• Turn the feature off: if the AI feature is optional and you're not comfortable, disabling it often removes the data flow entirely.
• Object: if it's material, raise it with the vendor within your notice window. Under GDPR Article 28 you generally have the right to object before a new subprocessor takes effect, and to escalate if you can't reach agreement.

Write it down

Whatever you decide, log it: the date you saw the change, what the AI subprocessor is, your assessment, and your decision. A one-line record now is the difference between a five-minute auditor conversation later and an awkward one. This is the same evidence trail that supports both your SOC 2 review and your GDPR obligations.

The point is catching it early

None of this works if you find out months later. The value of noticing an added AI subprocessor the day it appears is that you still have choices — the feature can be disabled, the window is still open, and the decision is yours. Find out after the fact and you're just reconstructing what already happened.

That's why we built DPA Monitor to watch subprocessor lists for exactly this. Pick your vendors, and when an AI provider (or any subprocessor) appears, we email you a plain-English summary with a link to the source — calm, early, and actionable. We report the change; we don't interpret its legal meaning, and nothing here is legal advice.