Vendor register & processors
One record per vendor: AI details, GDPR role, Art. 28 check, third-country transfer and onboarding.
Each vendor is recorded once. The vendor registry in the AI Act area and the processor agreements in the GDPR area are two views on the same record: the registry shows master data and AI details, processor agreements show Art. 28, third-country transfer and onboarding. What you change in one place you see in the other.
At a glance
- Included from
- Professional
- Where in the app
- Vendor registry (AI Act) or GDPR → Capture → Processor agreements
- Output
- Vendor list with GDPR role, DPA status, transfer basis and onboarding status
- Legal basis
- Art. 26, 28, 44–49 GDPR; Art. 25 AI Act
- API
- /api/v1/vendor-register
GDPR role
The role decides whether a data processing agreement (DPA) is needed. The app offers the classification as a suggestion; it is a professional assessment, not legal advice.
| Role | Consequence |
|---|---|
| Processor (PROCESSOR) | DPA under Art. 28 required. |
| Sub-processor (SUB_PROCESSOR) | DPA or flow-down of obligations required (Art. 28(2), (4)). |
| Independent controller (INDEPENDENT_CONTROLLER) | Recipient, no DPA. |
| Joint controllers (JOINT_CONTROLLER) | Arrangement under Art. 26 instead of a DPA: date, allocation of obligations, essence for data subjects. |
| Authority (AUTHORITY) | Recipient, no DPA. |
| Group company (GROUP_COMPANY) | No group privilege under the GDPR: processor or controller depending on the case. |
| None (NONE) | No personal data or not yet classified. |
Art. 28 checklist: 15 mandatory contents of the DPA
For processors, the app checks the contract against the text of Art. 28 GDPR:
- Subject-matter and duration, nature and purpose, type of data, categories of data subjects, rights and obligations of the controller (Art. 28(3) subpara. 1 sentence 1): five items.
- The eight obligations under Art. 28(3)(a)–(h), such as documented instructions, confidentiality, security, sub-processors, assistance, deletion or return, information and audits.
- Notice of an infringing instruction (Art. 28(3) subpara. 2).
- Flow-down of the same obligations to sub-processors (Art. 28(4)).
Onboarding status with approval
Moving forward is only possible one step at a time and only when the requirements are met; moving back to draft or review is always possible.
| Status | Requirement |
|---|---|
| ENTWURF (draft) | Vendor created. |
| PRUEFUNG (review) | Contracting parties named on both sides (own group entity, supplier’s legal entity). |
| AVV_UNTERZEICHNET (DPA signed) | Processors only: all 15 items of the Art. 28 checklist met and the DPA signed. |
| FREIGEGEBEN (released) | In addition, depending on the case: the joint controller arrangement; for a third-country transfer the destination and legal basis, the module for standard contractual clauses, case and justification for Art. 49, and for the DPF or adequacy for the USA the DPF certification with an evidence link. Vendors without a DPA obligation go straight from review to release. |
Multi-stage approval (beta)
If an approval workflow is set up for vendor onboarding, the last approval stage sets the status FREIGEGEBEN. The requirements above still apply: if something is missing, the approval stays pending and the release can be done by hand once it is fixed. A rejection moves PRUEFUNG back to ENTWURF.
Further details per vendor
- AI provider yes/no, product, category, risk estimate and AI Act class.
- Structured list of sub-processors with status (pending, approved, objected).
- Third-country transfer with the same values as the transfer tracker, including DPF and standard contractual clauses as a fallback.
- Review dates: next review, last assessment, last reviewed by.