If Mistral AI adds a new subprocessor (a third-party company that processes your data), you have 10 days to object in writing. If no agreement is reached, Mistral AI can end the contract or the affected services.
This analysis describes what Mistral AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The 10-day objection window is short for enterprise procurement cycles, and the remedy for an unresolved objection rests with Mistral AI, which retains the right to terminate the agreement rather than being required to find an alternative. This asymmetry places practical risk on customers who depend on Mistral AI services and cannot easily substitute vendors.
Business customers that rely on Mistral AI's products may face service termination if they object to a new subprocessor and no resolution is reached, limiting the practical value of the objection right. Customers must monitor the Trust Center subprocessor list and subscribe to update notifications to have any chance of meeting the 10-day deadline.
How other platforms handle this
Customer provides a general authorization for OpenAI to engage sub-processors. OpenAI will notify Customer of any new sub-processors by updating its sub-processor list. Customer may object to a new sub-processor by notifying OpenAI in writing within the objection period specified in the sub-processo...
Crusoe (Sees code data for inference): We manage Crusoe's compute for training some of our custom models, as well as hosting some of our custom models. Modal (Sees code data for inference): We manage Modal's compute for training some of our custom models, as well as hosting some of our custom models...
Egnyte is a data controller with respect to personal data it collects from visitors to its website and through its marketing activities. Egnyte acts as a data processor with respect to the content and data that customers store within the Egnyte platform. In that capacity, Egnyte processes data on be...
Monitoring
Mistral AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"Mistral AI will provide reasonable notice to the Customer of any changes to the list of Subprocessors prior to engaging such Subprocessor. The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved. If Customer provides an objection during this ten (10) days period, the Parties will consult and negotiate in good faith to find a mutually acceptable resolution to address any objections raised by Customer, and if none are agreed to, then Mistral AI reserves the right to terminate the Agreement or just the affected Mistral AI Products undergoing the Subprocessor change.— Excerpt from Mistral AI's Mistral AI Data Processing Addendum
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 28(2), which requires processors to obtain controller authorization before engaging subprocessors. The general prior authorization structure used here is GDPR-compliant as a mechanism, but the 10-day objection window and the vendor's right to terminate in response to an unresolved objection are commercial terms layered on top of the GDPR minimum requirement. EU supervisory authorities have not prescribed a specific objection window duration, but the adequacy of the notice period may be assessed in the context of whether controllers can meaningfully exercise their rights. (2) GOVERNANCE EXPOSURE: Medium. The primary exposure is operational: a 10-day window is narrow for organizations with multi-stakeholder procurement or legal review processes, and the termination remedy favors the vendor. Enterprise customers should assess whether their vendor risk management procedures can operationally respond within this timeframe. (3) JURISDICTION FLAGS: EU/EEA customers face the most direct exposure under GDPR Article 28. Customers in regulated sectors (financial services, healthcare) may have additional obligations to assess and approve subprocessors under sector-specific regulations, making the 10-day window particularly constrained. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should flag this provision during contract review and consider negotiating a longer objection window or a contractual commitment that Mistral AI will maintain the existing service while an objection is pending. The vendor's unilateral termination right in response to an unresolved objection should be evaluated against business continuity requirements. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should subscribe to the Trust Center subprocessor update notifications immediately upon contract execution to maximize the available response time. A documented internal process for reviewing subprocessor changes within the 10-day window should be established, including pre-designated reviewers and escalation paths.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The 10-day objection window is short for enterprise procurement cycles, and the remedy for an unresolved objection rests with Mistral AI, which retains the right to terminate the agreement rather than being required to find an alternative. This asymmetry places practical risk on customers who depend on Mistral AI services and cannot easily substitute vendors.
Business customers that rely on Mistral AI's products may face service termination if they object to a new subprocessor and no resolution is reached, limiting the practical value of the objection right. Customers must monitor the Trust Center subprocessor list and subscribe to update notifications to have any chance of meeting the 10-day deadline.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Mistral AI.