Agent WranglersProcessors and transfers Required
Record the data terms of every AI provider
Give every AI model provider a vendor register entry with its plan, its training setting, its retention and its region. Allow only plans that do not train on your data.
How to do it
Read the terms for the exact plan, since free and consumer plans often allow training while business plans often do not. Sign the provider's data processing agreement, and list it as a subprocessor when customer data reaches it. Turn training off in the account settings, and save the setting as dated evidence. Note the abuse-monitoring retention and any zero-retention agreement. Review each entry when the terms change and at least once a year. The model data rule decides what data may be sent.
Example
- id: model-provider-a
service: Text model for support replies
plan: business API
trains_on_inputs: false
retention_days: 30
zero_retention: requested 2026-05-02
region: eu
dpa_signed: 2026-04-20
setting_evidence: evidence/2026-10/model-provider-a-training-off.png
reviewed: 2026-10-01How to check
Every AI provider entry has trains_on_inputs: false, a retention in days, a region, a plan, a signed agreement date and a review date within 12 months. The outbound proxy refuses AI hosts that are not in the register.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/processors-and-transfers/ai-provider-terms.