How do I answer “list every AI sub-processor”?

By your AI vendors, and under each the companies that vendor publishes, with the URL and the date you read it. State in one sentence that you are listing what each vendor publishes rather than certifying the list is complete.

How long is that list?

The median vendor in the record names 19 companies and the largest names 121, so a five-vendor stack is about ninety-five entries before overlap. Of the 1,381 companies named across 95 lists, 1,194 are named by exactly one vendor, so the overlap takes little off.

Can I say we do not train on customer data?

Only about yourself. That sentence is your vendor's promise unless you hold it in your own contract, and unless the model provider underneath them has committed the same thing. Quote whose promise it is.

Is it enough to link to the vendor's trust page?

No. A link resolves to today, and the question is what it said when you relied on it. Attach the dated copy with its read date.

What do I say about being notified of vendor changes?

The honest mechanic. For most vendors a page is edited and nothing is sent — 36 of the vendors in the record publish a notice clause at all. Describe how you detect a change and how often, not a notification you do not receive.

Questionnaire

Resource · Security questionnaires

Answering the AI questions

Eight questions a customer’s security team asks about an AI stack, with the answer that closes, what to attach, and the sentence that keeps each one inside what you can show.

Scale

The scale nobody expects

“List every AI sub-processor” reads like a one-line request. The median vendor in the record names 19 companies on its own list and the largest names 121, so a five-vendor AI stack is a list of about 95 entries before overlap.

And the overlap barely helps: of 1,381 companies named across 95 vendors’ lists, 1,194 are named by exactly one of them. Buying a second AI vendor mostly adds a second list rather than extending the first. Who your vendors depend on has the head of that distribution.

That is why the first answer below leads with structure rather than with a number. A reviewer who can see how the list is organized will accept its length; one handed the length first will ask you to justify it.

Answers

The eight questions

The thing that turns a good questionnaire answer into a liability is one word past what you can show. Each question carries the boundary that keeps it inside the evidence.

List every AI sub-processor that may process our data.

Answer shape: Your AI vendors by name, and under each the companies that vendor publishes on its own list, with the URL and the date you read it. Say which of your products each vendor is used in.
Attach: Your sub-processor register, exported, with a source and read date per row.
Boundary: You are listing what each vendor publishes, not certifying it is complete. Say so in one sentence: a vendor's published list is the whole of what is disclosed to you.

On a vendor page: 95 of 186 watched vendors publish something we could read under this heading.

Do you use AI to process our data, and which models?

Answer shape: The vendors and the model families, per product feature. Name the provider underneath where the vendor discloses one — a company using a model API has two suppliers in that answer, not one.
Attach: The vendor's model documentation, and the page where they name their inference provider.
Boundary: Where a vendor does not disclose which model it runs, say that rather than naming the one you assume. An inference you publish is a claim you own.

No vendor page answers this — it is about your own processing.

Is our data used to train models?

Answer shape: Quote your vendor's commitment, with its URL and read date, and say whether it covers the model provider underneath them as well as themselves.
Attach: The quoted clause from the vendor's page, or the contractual term where you negotiated one.
Boundary: “We do not train on customer data” is your vendor's promise unless you have it in your own contract. State whose promise it is.

On a vendor page: 154 of 186 watched vendors publish something we could read under this heading.

Where is our data processed, and can it leave the region?

Answer shape: A commitment about a place where the vendor makes one, and a transfer disclosure where they only make that. The two look alike and mean opposite things.
Attach: The quoted residency clause, and the transfer mechanism named in the DPA.
Boundary: A page saying data may be transferred with safeguards has not promised a region. Do not report a disclosure as a commitment.

On a vendor page: 56 of 186 watched vendors publish something we could read under this heading.

How long is our data retained after termination?

Answer shape: The period per category, because a vendor does not have one retention window — it has several, and backups are usually the longest.
Attach: The quoted retention clause, per category, with its source.
Boundary: Where the vendor states a period for personal data and a different one for backups, give both. One number is the answer that comes back as a follow-up.

On a vendor page: 23 of 186 watched vendors publish something we could read under this heading.

What certifications do your AI vendors hold?

Answer shape: What each vendor states, at the level they state it, with the date you read the page. SOC 2 and SOC 2 Type II are different attestations and a reviewer will know.
Attach: The trust page URL and read date; the report itself under NDA where you hold it.
Boundary: You are reporting what a vendor says it holds, not that it holds it. “Says, not holds” is a defensible position; the other one is a warranty you did not mean to give.

On a vendor page: 120 of 186 watched vendors publish something we could read under this heading.

How are you notified when an AI vendor changes something?

Answer shape: The honest mechanic: for most vendors, a page is edited and nothing is sent. Say how you detect that — re-reading on a schedule — and how often.
Attach: Your watch schedule, and the dated readings that show it running.
Boundary: Do not describe a notification you do not receive. A reviewer who finds out that “we are notified” meant “we check the page” discounts everything above it.

On a vendor page: 36 of 186 watched vendors publish something we could read under this heading.

What happens if a model you depend on is retired?

Answer shape: The notice period in your agreement where you have one, the vendor's published deprecation practice where you do not, and your fallback.
Attach: The retirement announcements you have on file for that vendor, with dates.
Boundary: Most retirements are published rather than sent. If your answer assumes an email, say who has committed to sending it.

On a vendor page: 26 of 186 watched vendors publish something we could read under this heading.

Lose

Five answers that lose

“Yes.”: A one-word answer to a question about a supply chain reads as a question that was not read. It generates a follow-up, and the follow-up arrives with less patience than the original.
“Our vendors are SOC 2 compliant.”: SOC 2 is not a compliance standard a company is or is not, and the reviewer asking knows that. Name the vendor, the report type and the period.
“We do not train on your data.”: True of you, and the question is about the stack. Unless the vendors underneath you have committed the same thing in writing, this sentence has promised something you cannot see.
“We are notified of any changes.”: For most vendors nothing is sent. This is the answer most likely to be checked and the one that costs the most when it is.
A link to the vendor's page.: A link resolves to today. The question is what it said when you relied on it, which is what a dated copy answers and a link does not.

Download

Take it with you

All eight questions, their boundaries and the coverage figures as a Word document. It is generated when you download it, so the counts are the ones the record holds that day.

Method

How this was assembled

The questions, the answer shapes and the boundaries are written. Every figure is counted from published vendor pages: 1,381 companies named across 95 sub-processor lists, and the per-question coverage across 186 watched vendors. A vendor publishing nothing we could read is counted as neither publishing nor refusing. How the record is kept.

Questions

Common questions

How do I answer “list every AI sub-processor”?: By your AI vendors, and under each the companies that vendor publishes, with the URL and the date you read it. State in one sentence that you are listing what each vendor publishes rather than certifying the list is complete.
How long is that list?: The median vendor in the record names 19 companies and the largest names 121, so a five-vendor stack is about ninety-five entries before overlap. Of the 1,381 companies named across 95 lists, 1,194 are named by exactly one vendor, so the overlap takes little off.
Can I say we do not train on customer data?: Only about yourself. That sentence is your vendor's promise unless you hold it in your own contract, and unless the model provider underneath them has committed the same thing. Quote whose promise it is.
Is it enough to link to the vendor's trust page?: No. A link resolves to today, and the question is what it said when you relied on it. Attach the dated copy with its read date.
What do I say about being notified of vendor changes?: The honest mechanic. For most vendors a page is edited and nothing is sent — 36 of the vendors in the record publish a notice clause at all. Describe how you detect a change and how often, not a notification you do not receive.

Security questionnaires

Answer what a customer's security team asks about your AI stack.

Answering “list every AI sub-processor”
What the question is asking for, where each vendor publishes the answer, and what to say about the gaps.
Which certifications AI vendors say they hold
SOC 2, ISO 27001, ISO 42001 and more, counted off trust pages and kept apart by level — says, not holds.
Which AI vendors say they will not train on your data
Commitments not to train, and opt-outs, quoted from vendor pages — with no list of vendors that do, because that list cannot be read honestly.
How long AI vendors keep your data
Every retention window we can quote, grouped by vendor — because a vendor states several, and they cover different data.
AI supply-chain question set
29 questions to put to an AI vendor — drafted by a language model, reviewed by a second, and published with all 15 edits shown.
Where AI vendors say they keep your data
Residency commitments and transfer disclosures, quoted from vendor pages and kept apart — they look alike and mean opposite things.

Everything in the resources section

Caveat

This is not legal advice, and the answer shapes are a starting point rather than wording anyone has approved for your situation. The figures count published pages read on the dates the record holds; naming a vendor records what its page said and implies nothing else. The record is free to read, and corrections are free to request.