Subprocessor
Also: sub-processor, fourth party
A subprocessor is a third party an AI vendor relies on to deliver its service, such as a cloud host, a model provider or an analytics tool, that also ends up touching your data even though you never signed a contract with it directly.
A subprocessor is any vendor your vendor uses. Under GDPR, a processor (the AI tool you contracted with) is required to disclose the subprocessors it engages to handle personal data on its behalf, and to get your consent (often via a standing notification process) before adding new ones. In practice this means an AI product's real data footprint is rarely just the vendor you signed up with; it is that vendor plus everyone underneath it.
Why it matters more for AI
For AI tools this list is often more consequential than for ordinary SaaS, because it commonly includes the underlying foundation-model provider. A product built as a wrapper around someone else's model may send your prompts to that model provider as a subprocessor, meaning the training and retention posture of the underlying model matters just as much as the posture of the product you are actually using.
Look for a published list
Reputable vendors publish a subprocessor list (often at a URL like '/subprocessors' or inside the DPA) and commit to notifying customers before adding new ones. A vendor that won't disclose its subprocessors at all is a meaningful gap; you can't assess a risk chain you can't see.
Check it is current and reachable
When reviewing a tool, check not just whether a subprocessor list exists, but whether it is current and whether it is actually reachable from the product's trust center or DPA; a list that is promised but not published isn't useful for a review. ModelCharter's free AI vendor risk assessment tool includes subprocessor disclosure as one of its checks.