| Ask for | Why it matters | Evidence to retain |
|---|---|---|
| Contracting entity and subprocessors | Defines who handles data and obligations | Executed agreements and current subprocessor list |
| Processing purposes, locations and retention | Distinguishes training, evaluation, support and logging | Data-flow map and retention/deletion schedule |
| Reuse prohibition or precise permission | Avoids ambiguous use of customer examples | Contract clause covering raw and derived material |
| Base and teacher model terms | Rights can differ across inputs and artefacts | Dated licence and terms copies |
| Incident and material-change process | A changed model can change risk and responsibility | Notification clauses and operating contacts |
| Export and deletion method | Rights need to be operationally usable | Rehearsal record and deletion evidence |
These are diligence requests, not a claim that each is mandated identically by every law. A supplier’s security badge should not substitute for checking the actual product configuration and contractual scope.