Governance, Ethics & Legal Practical insights
Negotiate accountable AI vendor contract obligations
Negotiate AI supplier responsibilities for processing instructions, data reuse, subprocessor changes, assistance and exit, with a named contract decision owner.
An AI supplier contract should make responsibilities enforceable when something changes or goes wrong. A reassuring sales statement is not the same as a binding obligation. Marketing can make the negotiation useful by describing the intended service and identifying promises that require clear contractual wording before signature.
Define the processing relationship
Ask counsel to establish who determines the purposes of each operation. Where the supplier processes personal data on your behalf, Article 28 provides the relevant processor-contract requirements. [1] Describe the authorized instructions and the process for changing them. Do not assume that calling a supplier a processor in a document settles its role if it separately determines a purpose for reusing customer information.
Make reuse restrictions specific
If the negotiated position excludes training on client material, define the material and the prohibited use. Ask whether the wording covers prompts, uploads, outputs and feedback, and whether another clause creates an exception. An illustrative issue is a broad product-improvement licence beside a narrow no-training promise. Have counsel resolve that relationship and assess enforceability; a marketing team should not interpret the conflict away.
Agree how downstream changes are handled
Specify the authorization and notification process for subprocessors and how an objection is handled. Under Article 28, general written authorization involves notice of intended additions or replacements and an opportunity to object. [1] Assign an internal recipient who can assess notices, rather than letting them disappear into an unattended procurement inbox.
Negotiate assistance and the end of service
Address assistance with individual-rights requests, security obligations and relevant assessments, plus information and audit access. The EDPB describes these as elements of the processor relationship. [2] Define the practical contacts and response arrangements. Agree the return-or-deletion process at termination, including how legally required retention is identified and communicated. Give one negotiation owner responsibility for unresolved clauses and the final approved version. The result should be an agreement with accountable obligations, not a collection of vendor assurances that nobody can invoke when needed.
Sources and evidence
- GDPR primary text — processor obligations and international transfers
- EDPB: Controller and processor responsibilities
Sources checked on 4 October 2026. Proposed workflows and hypothetical examples are editorial analysis.
From insight to practice