If Mistral AI adds a new subprocessor (a third-party company that processes your data), you have 10 days to object in writing. If no agreement is reached, Mistral AI can end the contract or the affected services.
This analysis describes what Mistral AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The 10-day objection window is short for enterprise procurement cycles, and the remedy for an unresolved objection rests with Mistral AI, which retains the right to terminate the agreement rather than being required to find an alternative. This asymmetry places practical risk on customers who depend on Mistral AI services and cannot easily substitute vendors.
Business customers that rely on Mistral AI's products may face service termination if they object to a new subprocessor and no resolution is reached, limiting the practical value of the objection right. Customers must monitor the Trust Center subprocessor list and subscribe to update notifications to have any chance of meeting the 10-day deadline.
How other platforms handle this
We may share your personal information with our affiliates, meaning entities that control, are controlled by, or are under common control with Consensys. We also share information with service providers who assist in operating our services, subject to confidentiality obligations.
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
RedCard. We share information with our financial partners to operate the Target RedCard program.
Monitoring
Mistral AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Mistral AI will provide reasonable notice to the Customer of any changes to the list of Subprocessors prior to engaging such Subprocessor. The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved. If Customer provides an objection during this ten (10) days period, the Parties will consult and negotiate in good faith to find a mutually acceptable resolution to address any objections raised by Customer, and if none are agreed to, then Mistral AI reserves the right to terminate the Agreement or just the affected Mistral AI Products undergoing the Subprocessor change.— Excerpt from Mistral AI's Mistral AI Data Processing Addendum
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 28(2), which requires processors to obtain controller authorization before engaging subprocessors. The general prior authorization structure used here is GDPR-compliant as a mechanism, but the 10-day objection window and the vendor's right to terminate in response to an unresolved objection are commercial terms layered on top of the GDPR minimum requirement. EU supervisory authorities have not prescribed a specific objection window duration, but the adequacy of the notice period may be assessed in the context of whether controllers can meaningfully exercise their rights. (2) GOVERNANCE EXPOSURE: Medium. The primary exposure is operational: a 10-day window is narrow for organizations with multi-stakeholder procurement or legal review processes, and the termination remedy favors the vendor. Enterprise customers should assess whether their vendor risk management procedures can operationally respond within this timeframe. (3) JURISDICTION FLAGS: EU/EEA customers face the most direct exposure under GDPR Article 28. Customers in regulated sectors (financial services, healthcare) may have additional obligations to assess and approve subprocessors under sector-specific regulations, making the 10-day window particularly constrained. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should flag this provision during contract review and consider negotiating a longer objection window or a contractual commitment that Mistral AI will maintain the existing service while an objection is pending. The vendor's unilateral termination right in response to an unresolved objection should be evaluated against business continuity requirements. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should subscribe to the Trust Center subprocessor update notifications immediately upon contract execution to maximize the available response time. A documented internal process for reviewing subprocessor changes within the 10-day window should be established, including pre-designated reviewers and escalation paths.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The 10-day objection window is short for enterprise procurement cycles, and the remedy for an unresolved objection rests with Mistral AI, which retains the right to terminate the agreement rather than being required to find an alternative. This asymmetry places practical risk on customers who depend on Mistral AI services and cannot easily substitute vendors.
Business customers that rely on Mistral AI's products may face service termination if they object to a new subprocessor and no resolution is reached, limiting the practical value of the objection right. Customers must monitor the Trust Center subprocessor list and subscribe to update notifications to have any chance of meeting the 10-day deadline.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Mistral AI.