Will institutional data be processed through a third party or subprocessor that also uses AI?

AI in the supply chain is the concern here: the question is whether institutional data will pass through any third party or subprocessor that itself relies on AI.

The question is important for security assessments because AI processing introduces unique privacy and security concerns. When institutional data (which may contain sensitive or personally identifiable information) is processed by AI systems, there are risks related to:

1. Data retention - AI systems often need to retain data for training purposes
2. Unexpected data use - AI models might use data in ways not originally intended
3. Privacy implications - AI analysis might reveal patterns or information not explicitly shared
4. Regulatory compliance - AI processing may trigger additional compliance requirements under laws like GDPR, CCPA, etc.
5. Security vulnerabilities - AI systems may have unique security vulnerabilities

When answering this question, you should:
- Clearly identify if any third parties or subprocessors that handle your institutional data use AI
- If yes, specify which vendors/processors use AI and how they use it
- Describe what types of institutional data are processed by these AI systems
- Explain what controls are in place to protect the data
- Mention any contractual protections or limitations on AI usage in your agreements