# Sub-processor

> A sub-processor is a third party that processes personal data on behalf of a processor, typically an infrastructure or software vendor sitting beneath the primary service provider.

Category: Methodology
Source: https://impetora.com/glossary/sub-processor
Part of: Impetora AI consulting glossary (https://impetora.com/glossary)

## What is Sub-processor?

Under GDPR, controllers must approve sub-processors used by their processors, and processors must contractually flow GDPR obligations down. For an AI system, common sub-processors include the model API provider, the cloud region, the vector database, the observability tool, and the email or notification service. The list is published on the vendor's website and updated with notice.

## How does Sub-processor apply to enterprise AI?

Enterprise procurement teams audit sub-processor lists for residency, certification, and contractual flow-down. AI vendors selling to enterprise must publish a current list and a notice mechanism for additions.

## Related terms

- [GDPR](https://impetora.com/glossary/gdpr) - The General Data Protection Regulation (GDPR) is the EU's data-protection regulation, governing the processing of personal data of people in the EU and EEA.
- [Data Residency](https://impetora.com/glossary/data-residency) - Data residency is the requirement that personal or regulated data stays within a specified geographic region throughout processing, storage, and backup.
- [AI Audit Trail](https://impetora.com/glossary/ai-audit-trail) - An AI audit trail is the persistent, tamper-evident record of every input, output, tool call, model version, and decision an AI system has made, sufficient to reconstruct any past interaction.
- [EU AI Act](https://impetora.com/glossary/eu-ai-act) - The EU AI Act (Regulation (EU) 2024/1689) is the European Union's horizontal regulation for AI, classifying systems by risk and imposing obligations on providers, deployers, importers, and distributors.

## External references

- [Impetora sub-processors](https://impetora.com/sub-processors)

---

Impetora is a custom AI consultancy and solutions partner for enterprises in regulated industries. Submit a project at https://impetora.com/intake.