Explainer · for regulated firms
Who is expected to notice when an AI vendor edits its sub-processor list?
Your firm is. The vendor may owe you notice, but using a vendor does not move the responsibility off you.
That is what the US banking agencies’ 2023 guidance and the EU’s DORA both say, and both expect the firm to keep watching.
Every passage below is quoted from the official text, with the date we read it.
The change
What is a sub-processor change?
A sub-processor is a company your vendor hands your data to. A change is a name added to or removed from the vendor’s list.
We can read 118 sub-processor lists published as web pages by the AI vendors we watch. A vendor changes one by editing the page.
Under the GDPR, the vendor has to tell you about changes so you can object.
GDPR Article 28(2)
The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.
Some agreements make the edit to the page the notice itself.
Vespa
10days (see the clause)
At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List. The Customer may object to such an engagement by informing Vespa.ai within this ten (10) day period, provided such objection is in writing and based on reasonable grounds relating to data protection.
read October 30, 2026 · fingerprint 47c7d6d9538f
What a sub-processor is has its own page.
Responsibility
The firm stays responsible, not only the vendor.
A US bank and an EU financial entity read the same thing in different words.
US banks
Interagency Guidance on Third-Party Relationships: Risk Management (2023), section A
Whether activities are performed internally or via a third party, banking organizations are required to operate in a safe and sound manner and in compliance with applicable laws and regulations. A banking organization’s use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house.
EU financial entities
DORA, Regulation (EU) 2022/2554, Article 28(1)(a)
financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;
Neither text names AI. DORA covers ICT services, which it defines this way. Whether a given AI contract is in scope is for your firm to decide.
DORA, Regulation (EU) 2022/2554, Article 3(21)
‘ICT services’ means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, …
The US guidance
Keep watching, subcontractors included.
In June 2023 the Federal Reserve, the FDIC and the OCC issued joint guidance on third-party risk for the banks they supervise. Three of its points:
Monitor for the life of the relationship.
Section C.4
Watch the vendor's use of subcontractors, and where they are.
Section C.4
Consider setting, in the contract, when the vendor tells you about a new one.
Section C.3.n
In its words
What the guidance says.
Interagency Guidance on Third-Party Relationships: Risk Management (2023), section C.4
Ongoing monitoring may be conducted on a periodic or continuous basis, and more comprehensive or frequent monitoring is appropriate when a third-party relationship supports higher-risk activities, including critical activities.
Interagency Guidance on Third-Party Relationships: Risk Management (2023), section C.4
Depending on the degree of risk and complexity of the third-party relationship, a banking organization typically considers the following factors, among others, as part of ongoing monitoring: … The third party’s reliance on, exposure to, and use of subcontractors, the location of subcontractors (and any related data), and the third party’s own risk management processes for monitoring subcontractors; …
Interagency Guidance on Third-Party Relationships: Risk Management (2023), section C.3.n
For this reason, a banking organization may want to address when and how the third party should notify the banking organization of its use or intent to use a subcontractor and whether specific subcontractors are prohibited by the banking organization.
Interagency Guidance on Third-Party Relationships: Risk Management (2023), section A, footnote 2
Supervisory guidance does not have the force and effect of law and does not impose any new requirements on banking organizations.
It is guidance, not a rule, as the last passage says. The agencies review third-party risk management as part of their supervision.
In the EU
DORA asks the same of EU financial entities.
DORA, the EU's Digital Operational Resilience Act, has applied since 17 January 2025 to banks, insurers, investment firms and other financial entities, with some exclusions.
DORA, Regulation (EU) 2022/2554, Article 29(2), fourth subparagraph
Where the contractual arrangements on the use of ICT services supporting critical or important functions provide for subcontracting, financial entities shall assess whether and how potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions and the ability of the competent authority to effectively supervise the financial entity in that respect.
DORA, Regulation (EU) 2022/2554, Article 30(2)(b)
the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT third-party service provider to notify the financial entity in advance if it envisages changing such locations;
DORA also requires a register of every ICT services contract, with the subcontractors behind critical or important ones. Keeping that register current has its own page.
The audit
What does an auditor ask for?
Both texts expect records the firm can produce.
Interagency Guidance on Third-Party Relationships: Risk Management (2023), section D.3
It is important that a banking organization properly document and report on its third-party risk management process and specific third-party relationships throughout their life cycle.
Interagency Guidance on Third-Party Relationships: Risk Management (2023), section D.3
Examples of processes that support effective documentation and internal reporting that the agencies have observed include, but are not limited to: A current inventory of all third-party relationships (and, as appropriate to the risk presented, related subcontractors) that clearly identifies those relationships associated with higher-risk activities, including critical activities; …
DORA, Regulation (EU) 2022/2554, Article 28(3), fourth subparagraph
Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity.
A dated record
How a dated record answers the question.
It shows what the vendor's page said on each date it was read. Judging a change stays with your team.
A dated copy of every reading.
Of each sub-processor list, data agreement and trust page we watch.
A fingerprint on each copy.
A SHA-256 hash, so the copy can be checked later.
The lines that moved.
When a reading differs from the last, with the date we read it.
Banks, insurers and large companies can start with a free vendor-change audit.
Common questions.
- Is the vendor or the firm responsible for noticing a sub-processor change?
- Both have a part. The vendor's agreement says how it gives notice. The 2023 US interagency guidance and DORA Article 28(1)(a) both say using a third party does not take the responsibility off the firm.
- Is the US third-party guidance binding?
- No. Its footnote 2 says supervisory guidance does not have the force and effect of law and does not impose any new requirements on banking organizations. Each agency reviews third-party risk management as part of its supervision.
- Does DORA mention subcontractors?
- Yes. Article 29(2) asks financial entities to assess whether long or complex chains of subcontracting affect their ability to fully monitor the contracted functions. Article 30(2)(b) requires contracts to make the provider notify the firm in advance of a change of location.
- Do these rules mention AI vendors?
- Neither text names AI. The US guidance covers third-party relationships; DORA covers ICT services, defined as digital and data services provided through ICT systems on an ongoing basis. Whether a given contract is in scope is for your firm to decide.
Not legal advice.
This page quotes regulation and supervisory guidance. It does not say whether a rule applies to your firm or what it requires of you. Your counsel and your supervisor do.
Xither Staff Writer · reviewed November 1, 2026. Regulatory passages are quoted from the official texts on the date shown. The vendor clause and counts come from the record when the page is served.
Hear the morning we read a change to your vendor’s sub-processor list or DPA.
Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.
Try it free for 14 daysNo card. Nothing to cancel.