The spreadsheet comes from the procurement department of a bank that already uses your product. Past the questions on backups and penetration tests there is a new block: which subcontractors support the service, in which countries they process data, whether the bank and its supervisor may audit them, and how the bank gets its data back when the contract ends. Your product sends customer text to a model provider's online interface for every summary it writes. You have never listed that provider as a subcontractor.
The bank has no choice in the matter. The Digital Operational Resilience Act, Regulation (European Union) 2022/2554, has applied to financial entities since 17 January 2025. Its duties fall on the bank and reach you through the contract. Article 28 says a financial entity remains fully responsible for its obligations at all times. It must keep a register of every contractual arrangement for information and communication technology services and hand that register to its supervisor on request. Your contract is a row in it.
Article 30 lists what the contract must contain. For any service that means a statement on whether subcontracting of a service that supports a critical or important function is permitted and under which conditions, the regions or countries where data is processed and stored, a duty on you to announce a change of location in advance, and the return of the bank's data in an accessible format if you fail or the contract ends. When the bank classifies your service as supporting a critical or important function the list grows: unrestricted rights of access, inspection and audit for the bank and its supervisor, and an exit arrangement with a transition period during which you keep delivering.
As we read the regulation, the model provider is a subcontractor in the sense it means. The location clause asks where prompts are processed, and the answer depends on a setting that may not have been looked at since the prototype. One large cloud provider documents that a deployment labelled global may process prompts in any geography where the model is deployed, while a deployment in a European data zone stays within the member states of the Union. Either setting can be defended. A signed promise of European processing above code that calls a global endpoint cannot.
The usual response is to hand the questionnaire to whoever answered the last one, say yes wherever possible and attach the security certificate. That works once. Hospitals in the Netherlands ask the same questions under NEN 7510 and, since 15 August 2026, under the Cyberbeveiligingswet, the Dutch law that implements the second Network and Information Security Directive and makes the security of suppliers part of the buyer's own duty of care. A company that answers every form from memory ends up with several descriptions of one system, each with a signature under it.
A better response starts with a decision the chief technology officer owns. For each kind of work the product does, decide which route the data may take: the provider's online interface under contract, a private deployment in a European region of a cloud provider, or a model that runs on the customer's premises or your own. A feature that rewrites marketing text and a feature that reads loan files need different routes. Write the decision down per feature with the provider, the region setting, the retention setting and the contract that covers it. That one table answers the subcontracting question and the location question for every customer at once.
Then put the same governance over every route, because the questionnaire asks for it whichever route you chose. That means an inventory of the models in use and your role under the European Union Artificial Intelligence Act, Regulation (European Union) 2024/1689, which is likely to be provider since you put the system on the market under your own name. It means the model provider's terms checked against what you promise downstream, test results on the kind of documents your customers send, logs, a named person who can switch a feature off, trained staff, and an incident route that reaches the bank at once, since Article 30 obliges you to assist when an incident touches the service. Running a model on your own hardware removes one subcontractor from the chain. Every other item on that list stays.
Two dates frame the work. On 18 November 2025 the European supervisory authorities designated nineteen critical third party providers, so a bank that asks where your model runs is asking about the concentration risk that Article 29 tells it to assess. The high risk requirements for the uses in its Annex III, credit scoring of natural persons among them, apply from 2 December 2027, and a bank whose scoring your product feeds will want your documentation well before then.
The AI Guys does this work with technology teams, from the route decision to the contract annex. Next month you should have four things in a folder: the route table per feature with your name under it, the list of subcontractors and processing locations checked against what the code does, a standard contract annex that already contains the Article 30 elements, and one page that says plainly what you cannot yet offer, such as audit rights over the model provider.