EU Trends and Developments Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
This governance shift also has material consequences for processors and technology suppliers. While the obligation to conduct a DPIA rests formally with the controller, the practical burden increasingly extends to processors and technology suppliers. Article 28 (3)(f), GDPR requires processors to assist controllers in ensuring compliance with Articles 32–36, including DPIA preparation and prior consul - tation where required. In the context of enterprise AI systems, this assistance is no longer limited to generic security documentation. Our experience is that Euro - pean customers increasingly expect detailed technical descriptions of model functionality and training logic; clear articulation of data inputs, outputs and process - ing flows; documentation of override mechanisms and human review pathways; risk mitigation descriptions aligned with DPIA frameworks; and transparency matrices mapping system features to GDPR safe - guards. This expectation is reinforced by the AI Act’s docu - mentation architecture, which requires high-risk sys - tem providers to maintain detailed technical files, risk management systems and data governance docu - mentation. Even where the AI Act does not formally apply, enterprise customers increasingly replicate its structure contractually. Accordingly, procurement practice has evolved. It is now common for European enterprise customers to require AI-specific contractual appendices sitting alongside data processing agreements. These AI appendices typically address: allocation of controller and processor roles in model deployment; use of cus - tomer data for model training or improvement; explain - ability and transparency commitments; audit rights relating to algorithmic governance; security meas - ures and incident reporting specific to AI systems; and limitations on autonomous system modification or retraining. This development shifts AI governance into the contractual layer. Risk allocation becomes central. Providers must therefore carefully delineate the scope of their processing activities and the bound - aries between customer-configured decision logic and system architecture alongside the extent of assistance obligations under Article 28 and the limits of liability relating to customer-defined deployment contexts.
Without careful structuring, providers risk de facto assumption of controller-level exposure through over - ly broad contractual commitments. At the same time, resistance to reasonable assistance is commercially untenable. Enterprise customers – particularly in regulated sectors – increasingly require substantive DPIA support and structured co-operation in supervisory engagement. The provider response must therefore be calibrated: offering documented assistance, transparency and structured governance support, while maintaining clear contractual alloca - tion of responsibility for lawfulness determinations and deployment choices. For processors and suppliers, it additionally requires structured contractual governance, calibrated assis - tance under Article 28 and careful risk allocation in AI-specific appendices. In this environment, compliance is no longer confined to the legality of discrete automated decisions. It extends to the architecture of organisational oversight – and to the contractual frameworks through which AI systems are supplied, configured and governed. Data sovereignty, international transfers and essential equivalence International data transfers remain one of the most structurally sensitive aspects of EU data protection law. In Schrems II (Case C-311/18), the CJEU invalidated the EU–US Privacy Shield and clarified that transfer mechanisms under Article 46 must ensure “essentially equivalent” protection in practice. The Court empha - sised substantive assessment of third-country legal regimes. The subsequent adoption of the EU–US Data Priva - cy Framework (Commission Implementing Decision (EU) 2023/1795) under Article 45 has reintroduced a presumption of adequacy for participating US organ - isations and thus stabilised transatlantic transfers. However, adequacy does not eliminate accountability obligations under Articles 5 and 32.
108 CHAMBERS.COM
Powered by FlippingBook