Vendors are deploying AI systems to process your data without explicit disclosure. CRM vendors using AI on support tickets with customer PII. Cloud providers training on usage telemetry. HR software outsourcing screening to undisclosed AI subprocessors.
Three Ways AI Broke the Traditional Model
1. Automatic Data Reading
AI-powered support systems ingest all submissions by language models. One platform was discovered using private channel data to fine-tune AI features.
2. AI Training on Customer Data
Vendors claim "product improvement" clauses justify training on your data. Models trained on aggregated data create a novel exfiltration vector.
3. Subprocessor AI Without Authorisation
Vendors contract subprocessors who independently deploy AI without notifying primary vendors or clients.
NIS2 & GDPR Obligations
NIS2 Article 21(2)(d) requires supply chain security measures. No exception for AI systems. GDPR Article 28 requires processing contracts stipulating nature and purpose. Article 35 may require DPIAs for systematic profiling—which many vendor AI systems perform.
5-Step Management Framework
- Add AI Clauses to Contracts — Disclosure obligations, opt-out rights, training data restrictions, model provenance
- Deploy AI-Specific Questionnaire — Which AI systems access data? Where does inference occur? What about subprocessor AI?
- Implement Tiered Assessment — Tier 1 (PII/IP): full assessment annually. Tier 2 (operational): standard, 18-month. Tier 3 (no AI): self-attestation, 24-month.
- Continuously Monitor Deployments — Track vendor release notes, API behaviour changes, contractual attestation triggers
- Secure Audit Rights — AI documentation access, adversarial testing rights, incident logs, deletion upon termination
Need help implementing this?
First strategy session is complimentary. We typically respond within 4 hours.