Privacy law roles: controller determines purposes/means of processing; processor processes on behalf of controller. AI vendors often characterize themselves as processors; customers may require controls on model training and subprocessing consistent with that role.
See: DPA; Personal data; Subprocessor