AI Governance Engineer
GitHub

Sub-processor

By Updated

A processor that another processor engages to carry out processing for a controller, such as the model host behind an AI vendor. Under GDPR Article 28 it needs the controller's prior written authorisation, specific or general with notice of changes and a chance to object, and the same data protection obligations flow down to it by contract 1.

Developed in
ch. 19, AI vendor DPAs and no-training clauses
ch. 15, Vendor contracts and licence terms
Chapters
ch. 08, Regulatory Map · ch. 12, Governance Program · ch. 15, Deployment · ch. 19, Privacy & AI
Contrast with
Controller and processor
Source
1 numbered reference, listed below

Where it is used

4 chapters of the Body of Knowledge use the term. Each link opens the first section that does.

Sub-processor: mentions per chapter11 mentions of the term across 4 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapter08 Regulatory Map: 2 mentions08 Regulatory Map212 Governance Program: 1 mention12 Governance Program115 Deployment: 6 mentions15 Deployment619 Privacy & AI: 2 mentions19 Privacy & AI2No mentions in the other 19 chaptersSource: the Body of Knowledgev0.5.0
Sub-processor: mentions per chapter11 mentions of the term across 4 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapter000102030405060708 Regulatory Map: 2 mentions208101112 Governance Program: 1 mention112131415 Deployment: 6 mentions61516171819 Privacy & AI: 2 mentions21920212223Source: the Body of Knowledge v0.5.0
Mentions per chapter How often each chapter names the term, with the chapters the glossary cross-references drawn solid. The longest bar is where to read the term in use; bars spread across many chapters mark a term that runs through the discipline.
Mentions as a table
Mentions of Sub-processor per chapter
ChapterMentionsCross-referenced
00 Preface0No
01 Definition0No
02 Why Now0No
03 Values & Principles0No
04 The Stack0No
05 Patterns0No
06 The Role0No
07 Maturity Model0No
08 Regulatory Map2Yes
10 Reading List0No
11 AI Defined0No
12 Governance Program1Yes
13 Risk Management0No
14 Development0No
15 Deployment6Yes
16 Fairness & XAI0No
17 Incidents0No
18 EU AI Act0No
19 Privacy & AI2Yes
20 Existing Law0No
21 AI Laws Worldwide0No
22 Principles & Standards0No
23 AI Agents0No

Patterns that use this term

One pattern page uses the term.

Sources

  1. [1] Regulation (EU) 2016/679 (General Data Protection Regulation) (Arts. 4(1), 4(5), 4(7), 4(8), 4(12), 4(14), 5, 6, 9, 12(3), 22, 25, 28(2) and 28(4), 30, 33, 35; Recital 26). Publications Office of the EU (EUR-Lex). 2016-04-27. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Sub-processor. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/sub-processor. CC BY 4.0

BibTeX

@misc{aige2026subprocessor,
  author  = {Jorge García Aibar},
  title   = {{Sub-processor}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/sub-processor}
}