CF05-018: AI Data Sub-processing Controls

AI Control Library / CF-05: Data Governance & Privacy

Designation: Core | Control types represented: Governance and Operational

Control requirement

Identify and control suppliers that process AI-related data on behalf of another party, defining applicable roles, instructions, authorization, safeguards, change handling and evidence. Ensure onward processing remains within approved conditions.

Why this matters

An approved provider may rely on additional model hosts, analytics or support services. These relationships can change recipients, locations and retention without appearing as a new customer integration.

How the control types work together

Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.

When it applies

AI processing chains involving providers and downstream processors; qualified review determines the legal roles and applicable duties for the actual arrangement.

Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.

Ownership

The processing owner is accountable; procurement, privacy and legal define terms and supplier-risk teams assess assurance.

Implementation guidance

  1. Map material downstream processing, information categories and locations, distinguishing established facts from provider visibility gaps.
  2. Establish applicable instructions, authorization and contractual safeguards with qualified role review.
  3. Require usable change information, incident cooperation, retention or deletion support and evidence proportionate to processing risk.
  4. Review new or changed subprocessors before affected use continues under changed conditions, applying available objection, restriction or exit routes.

How to verify it

Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.

Test Expected result
Trace a supplier processing chain Material recipients and roles match reviewed information.
Inspect a change notice The owner assesses the actual data and conditions before accepting the change.
Test a deletion or incident request Responsibilities and provider cooperation support a coordinated response.

Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.

Evidence to retain

  • Processing-chain and role analysis
  • Applicable agreements and instructions
  • Change and assurance records
  • Incident and deletion coordination

Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.

If the control fails

Escalate unknown or unacceptable onward processing to privacy, legal and the service owner. Restrict affected data use or pursue the approved contractual or exit response.

Example in practice

Hypothetical example: A provider adds an external model for a new assistant feature. The buyer assesses that additional processor’s role, information use and location before enabling the feature for customer records.

Related controls

Framework mappings

  • NIST AI RMF (MAP 1.6)
  • EU AI Act (GDPR Art. 28, EU AI Act Art. 28)
  • ISO 42001 (Cl. 8.3)

Review and maintenance

Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.

Back to Data Governance & Privacy

Version 1.0

Scroll to Top