Use with no contract
processor without an agreement, sous-traitant sans contrat
A tool brought in without going through the organisation may fall under article 28, which requires a contract with any processor acting on your behalf. Where it does, the organisation remains responsible for a tool it never authorised, and article 32 — appropriate technical and organisational measures — applies to data flows nobody documented.
Article 30 requires a record of processing activities. A survey of AI chains does not produce that record: the record is the controller's obligation, its completeness is their liability, and a partial one drawn up by a third party exposes them more than an acknowledged gap. What a survey does is document a chain the record probably ignores, and show what is missing from it.
What this source does not establish
The source is the regulation itself, which settles that these articles exist and what they require. It settles nothing about whether they apply to a particular use: that is a qualification, and it belongs to the organisation's counsel.
What it means for an SME running AI
Whether these articles apply to a given use is a question for the organisation's own counsel, not for us. What can be said without qualifying anything: the question is dated, it precedes the AI Act, and it is already enforced.
Sources
- Règlement (UE) 2016/679, articles 28, 30 et 32
Related terms
This is what the survey measures See how it is measured →
Or answer six questions on your own uses Take the check →