Guides / GUIDE-010

Choosing an AI vendor: EU hosting, AVV, security questionnaire, exit strategy, contract points

Shortlist, check and contract an AI vendor so that data location, the data processing agreement (AVV), security evidence, exit rights and liability are settled before you sign, not after the first incident.

Once you have decided to buy or rent rather than build (see GUIDE-002), the vendor contract decides where your data goes, who may use it, how secure it is and how you get out again. This guide gives IT managers and decision makers a short procedure, a security questionnaire and a list of contract points. At the end you have a vendor file that your DPO, IT security and management can sign off.

Why it matters

  • You stay responsible. With almost every AI service the vendor processes personal data on your behalf. That makes it a processor under Art. 28 GDPR. You need a data processing agreement (AVV), and you must pick a vendor that gives "sufficient guarantees" for appropriate technical and organisational measures [1][2]. If the vendor fails, the fine or the data breach notification is still yours.
  • Third-country transfers are not settled for good. US-based vendors usually rely on the EU-US Data Privacy Framework (DPF). The EU General Court upheld it on 3 September 2025 (T-553/23, Latombe), but an appeal is pending at the Court of Justice (C-703/25 P) [8]. Its two predecessors were struck down. Contract terms that let you switch to EU-only processing are cheap insurance.
  • Exit is now a legal right. The EU Data Act (Chapter VI) covers IaaS, PaaS and SaaS, including existing contracts: at most two months' preparation, a 30-day switch, data retrievable for at least 30 days afterwards, and no switching charges from 12 January 2027 [4]. This only helps if you have a plan for where your data goes.
  • Supply chain security can be a legal duty. Companies covered by the German NIS2 implementation act (NIS2UmsuCG, in force since December 2025) must manage supply chain risks. AI vendors are part of that chain [9].
  • AI Act duties need vendor input. Art. 50 transparency duties (e.g. disclosing chatbots) apply since 2 August 2026; Annex III high-risk duties (e.g. AI in recruiting) from 2 December 2027. For both you need vendor documentation, so ask for it in the contract now (GUIDE-014).

When you need it

  • Before a pilot with real data. Free trial accounts are the most common way data leaves the company without an AVV.
  • Before rollout or a longer contract term, especially if the pilot ran under trial terms.
  • When an existing vendor adds AI features, such as a copilot in your ERP, CRM or office suite. Check the AVV, sub-processors and data use clauses again.
  • Annually and on change notices about sub-processors, regions or model versions.

Who is involved

Role Part in vendor selection
Management Sets the budget and risk appetite and signs the contract
Department lead Defines the requirements and runs the evaluation with real tasks
IT / IT security Integration, SSO, logging; sends and scores the security questionnaire
DPO Checks the AVV, transfers and TOMs; decides whether a DPIA is needed (GUIDE-005)
Legal / compliance Liability, IP, AI Act clauses, exit terms; often external counsel in SMBs
Works council Must be informed in good time (§90(1) no. 3 BetrVG). Co-determines if the tool logs user activity, which most tools do (§87(1) no. 6) (GUIDE-004)
Data owners Confirm which data may go to the vendor (GUIDE-003)

Step by step

1. Write a one-page requirements sheet (½ day). Note the use case, data categories (personal, special categories, trade secrets), users, integrations (M365, DATEV, ERP, DMS) and protection need (normal / high / very high), which sets how strict the next steps are.

2. Build a shortlist of 3 to 5 vendors (1 to 2 days). Filter early on three knockout criteria: - hosting and support access inside the EU/EEA, or at least a contractual EU-only option; - an AVV is offered, with a published sub-processor list; - no training or improvement of models on your inputs and outputs, or a contractual opt-out.

The DSK guidance names training on inputs as a key check [6]. Vendors that will not answer in writing drop out.

3. Send the security questionnaire (2 to 3 weeks elapsed, 1 to 2 days of effort). Use the questionnaire in the checklist below. Ask for evidence, not marketing statements: an ISO/IEC 27001 certificate and its scope, a BSI C5 attestation, and an AIC4 attestation where one exists. C5:2026, the BSI's cloud security catalogue, has 168 basic criteria (C5:2020: 121), adds topics such as confidential computing and becomes mandatory for audits from 1 June 2027 [3]. AIC4 builds on C5 with AI-specific criteria such as robustness and data quality [5]. Few SMB vendors have AIC4, but C5 or ISO 27001 is a fair minimum for high protection needs.

4. Test with real tasks (1 to 2 weeks). Run the same 20 to 50 typical tasks through each tool, with synthetic or anonymised data until the AVV is signed. Score quality, speed, cost per task and admin features (SSO, roles, log export, deletion). See GUIDE-009.

5. Check the data protection paperwork (DPO, 1 to 3 days). Go through: - the AVV against Art. 28(3) GDPR, or against the Commission's standard clauses for processors (Implementing Decision 2021/915) [1][2]; - sub-processors, change notices and your right to object; - the transfer basis (DPF or SCCs); - retention and deletion of prompts, files and logs; - whether a DPIA is needed (likely when evaluating people, special categories or new technology at scale).

6. Negotiate the contract points (1 to 3 weeks). Use the list in the next section. SMBs rarely get custom contracts from large vendors. Ask in writing anyway, choose the business tier (consumer tiers often lack the AVV and no-training commitment) and document refusals. Useful wording: the Commission's non-binding Data Act clauses for cloud switching [7] and the EU model contractual clauses for AI procurement (MCC-AI, updated March 2025, "light" and "high-risk"), written for public buyers but adaptable [10].

7. Plan your exit before you sign (½ day). List what you would need to take along (prompts, custom assistants, RAG indexes, fine-tuning data, logs), the export formats and a realistic fallback. Keep source documents and evaluation sets outside the vendor's system.

8. Decide and document (½ day). Keep the requirements, questionnaire answers, test scores, AVV, DPIA decision, works council status and contract in one vendor file. Add the vendor to the approved-tool list (GUIDE-007) and the annual review.

Contract points worth fighting for

  • Data use: no training on your data; you keep the rights to inputs and outputs; prompts are confidential.
  • Location: EU/EEA processing; third-country support access only logged and announced.
  • Sub-processors: a list, 30 days' notice of changes, and a right to object or terminate.
  • Security: a named certification that must be maintained, and incident notice within 24 to 48 hours (you have 72 hours towards the authority, Art. 33 GDPR).
  • Model changes: advance notice and a test window before models are replaced (GUIDE-011).
  • Service levels: availability, support hours, price-change notice with a termination right.
  • AI Act: cooperation on Art. 50 transparency and, for high-risk uses, instructions for use and deployer information.
  • IP and liability: IP indemnity for outputs where offered; a liability cap above one month's fee.
  • Exit: export in open formats, Data Act switching terms, and deletion confirmation after the retrieval period.
  • Law and venue: German or EU law and courts where possible.

Checklist

  • [ ] Requirements sheet with data categories and protection need
  • [ ] EU/EEA hosting or contractual EU-only option confirmed in writing
  • [ ] No training on inputs/outputs (contract clause or verified setting)
  • [ ] AVV signed; sub-processor list reviewed; transfer basis documented
  • [ ] DPIA decision documented by the DPO
  • [ ] Security questionnaire answered with evidence (ISO 27001 / C5 / AIC4, pen test summary)
  • [ ] SSO, MFA, role rights, audit log export and deletion functions tested
  • [ ] Works council informed; works agreement needed? (GUIDE-004)
  • [ ] Incident notice, model-change notice and price-change notice in the contract
  • [ ] Exit plan: data inventory, export formats, fallback option
  • [ ] Vendor added to approved-tool list and annual review calendar

Security questionnaire, 12 core questions: 1. Where are data and backups stored, and from where can support staff access them? 2. Are inputs, outputs or files used to train or improve models, including through human review? 3. How long are prompts, files and logs kept, and can we set this ourselves? 4. Which certifications cover this exact service (ISO 27001 scope, C5, AIC4, SOC 2)? 5. How are tenants separated? Is data encrypted in transit and at rest, and who holds the keys? 6. Do you support SSO, MFA, roles and SCIM? 7. Can admins export audit logs? Do logs record user activity? (Relevant for the works council.) 8. How do you prevent prompt injection and data leakage via connectors (GUIDE-013)? Do connectors respect existing access rights? 9. Which foundation models and sub-processors are used, and how are changes announced? 10. What is your incident process and notice time? When was the last pen test or AI red-teaming done? 11. How do we export all data and configurations, and in which formats? 12. What AI Act documentation do you provide to deployers?

Templates & tools

  • BSI C5 criteria catalogue, with guidance for cloud customers [3]
  • BSI AIC4 criteria catalogue for AI cloud services [5]
  • BSI: generative AI models, opportunities and risks, for threat-based questions [11]
  • DSK guidance on AI and data protection, with checkpoints for selecting AI applications [6]
  • Commission standard contractual clauses for processors (2021/915) [2]
  • Commission Data Act standard contractual clauses for cloud switching [7]; Bundesnetzagentur fact sheet on switching [4]
  • EU model contractual clauses for AI procurement (MCC-AI light and high-risk) [10]
  • Your local Mittelstand-Digital Zentrum or IHK for vendor-neutral advice on shortlists

Common pitfalls

  • Pilot on a consumer plan. Free tiers often have no AVV and may train on your data. Pilot on the business tier or with synthetic data.
  • "Hosted in Germany" taken at face value. EU hosting does not rule out third-country support access or US sub-processors. Read the sub-processor list.
  • Certificates with the wrong scope. An ISO 27001 certificate for the vendor's office says nothing about the AI service.
  • Overlooking AI features in existing software. A new copilot in a tool you already use is a new vendor decision, including for the works council.
  • No exit data. Custom assistants and RAG indexes are often not exportable. Keep source documents and configurations on your side.
  • Signing before the works council is involved. If the tool logs usage, a rollout without co-determination can be stopped by injunction.
  • One-off check. Vendors change models and sub-processors several times a year, so review annually.

Sources

  1. Regulation (EU) 2016/679 (GDPR), Art. 28 and 33, EUR-Lex: https://eur-lex.europa.eu/eli/reg/2016/679/oj
  2. Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors: https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj
  3. BSI: Kriterienkatalog C5 (C5:2020 and C5:2026): https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/kriterienkatalog-c5_node.html ; summary of C5:2026 changes, Rödl & Partner (2026): https://www.roedl.com/insights/der-neue-c5-katalog-ist-da-was-sie-jetzt-beachten-muessen/ ; transition date: https://www.a-lign.com/articles/c5-attestation
  4. Bundesnetzagentur: Data Act fact sheet "Switching between data processing services" (June 2026): https://www.bundesnetzagentur.de/EN/Areas/Digitalisation/DataAct/DL/Factsheet4.html
  5. BSI: AI Cloud Service Compliance Criteria Catalogue (AIC4): https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Kuenstliche-Intelligenz/AIC4/aic4.html
  6. Datenschutzkonferenz (DSK): Orientierungshilfe "Künstliche Intelligenz und Datenschutz", version 1.0, 6 May 2024: https://datenschutzkonferenz-online.de/media/pm/2024_05_06_DSK_PM_OH_KI_und_Datenschutz.pdf
  7. European Commission: Draft Recommendation on non-binding model contractual terms on data access and use and non-binding standard contractual clauses for cloud computing contracts (19 Nov 2025): https://digital-strategy.ec.europa.eu/en/library/draft-recommendation-non-binding-model-contractual-terms-data-access-and-use-and-non-binding
  8. General Court, T-553/23 Latombe (3 Sep 2025), summary by Clifford Chance: https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2025/09/transatlantic-data-transfers-where-the-dpf-stands-post-latombe.html ; appeal C-703/25 P: https://eur-lex.europa.eu/eli/C/2025/6610/oj/eng
  9. IHK Darmstadt: NIS-2, obligations for companies (implementation in force): https://www.ihk.de/darmstadt/produktmarken/digitalisierung/datenschutz-und-it-sicherheit2/nis-2-pflichten-fuer-unternehmen-6218248
  10. EU model contractual clauses for AI procurement (MCC-AI), updated March 2025; overview by Covington: https://www.insideprivacy.com/artificial-intelligence/eus-community-of-practice-publishes-updated-ai-model-contractual-clauses/
  11. BSI: Generative KI-Modelle – Chancen und Risiken für Industrie und Behörden: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/KI/Generative_KI-Modelle.pdf

Accessed 2026-10.