Your vendor may be compliant on paper while critical processing happens in third-party layers you have never reviewed.

Question

How do I evaluate AI vendor subprocessor risk before signing?

Quick answer

Ask four questions before signing:

  1. who are the subprocessors,
  2. what data each one touches,
  3. what jurisdictions are involved,
  4. how changes are disclosed.

If any answer is vague, your risk model is incomplete.

Vendor risk checklist

  1. Require a current subprocessor list and update cadence.
  2. Map subprocessors to data classes and sensitivity level.
  3. Confirm contractual flow-down obligations and breach notice windows.
  4. Define your right to object or exit when the list changes materially.

This is basic control hygiene for AI procurement.

Common failure pattern

Teams review the primary contract but never operationalize subprocessor monitoring after signature.

Contract red flags

Block or renegotiate if you see:

  1. no update cadence for subprocessor list,
  2. no material-change notification window,
  3. no customer objection/exit mechanism,
  4. vague data-location language,
  5. no flow-down security obligations.

If these are missing, governance risk sits with you, not the vendor.

10-minute action step

  1. Inventory what data is collected, where it is stored, and who can access it.
  2. Map each vendor/tool to an owner and a current risk status.
  3. Document one control per risk (policy, technical guardrail, or contract term).
  4. Schedule a recurring review date and record evidence links.

Success signal

You can answer "what data, which vendor, what control, who owns it" without guesswork.