# Standards and Regulatory References — AI Vendor Privacy Due Diligence

## Primary Legislation
- **Art. 26 GDPR**: Joint controllers — arrangement must determine respective responsibilities.
- **Art. 28 GDPR**: Processor obligations — DPA required with specific content requirements.
- **Art. 28(1)**: Controller shall use only processors providing sufficient guarantees.
- **Art. 28(3)**: DPA must set out subject-matter, duration, nature and purpose, data types, obligations and rights.
- **Art. 44-49 GDPR**: International transfer restrictions — applicable when vendor processes in third countries.

## EDPB Guidance
- **EDPB Guidelines 07/2020 on Controller-Processor**: Detailed guidance on determining roles based on factual circumstances.
- **EDPB Guidelines 05/2020 on Consent**: Consent given to one controller does not extend to processing by a joint controller.
- **EDPB Guidelines 04/2025 on AI**: AI vendor model training on customer data creates independent purpose — controller role.

## Enforcement Decisions
- **CJEU C-40/17 Fashion ID (2019)**: Joint controller status from embedding third-party tool — influence over purpose/means sufficient.
- **CJEU C-210/16 Wirtschaftsakademie (2018)**: Page operator and Facebook are joint controllers for visitor analytics.
- **Garante v. OpenAI (2023)**: OpenAI is controller for training data processing — independent purpose determination.
- **DPC v. Meta (2023)**: EUR 5.5M — controller-processor designation must match actual data use.
- **AEPD v. CaixaBank (2021)**: EUR 6M — AI vendor processing inadequately documented and controlled.