This is the one that catches SaaS companies most often, and it is worth stating plainly. If you process customer data through a third-party model provider, that provider is very likely a sub-processor under your customer agreements. Adding one typically requires notification, sometimes gives customers a right to object, and occasionally requires renegotiation with your largest accounts — the ones whose legal teams read the notices.
Two consequences follow. First, this is a legal workstream that runs in parallel with the build rather than after it, and it can be the critical path. Second, it is a strong practical argument for self-hosting the model: a model running on your own infrastructure is generally not a new sub-processor at all, which can remove the notification, the objection right and the renegotiation in one move. Your hosting provider may still be one, and your customer contracts may restrict new processing purposes independently — your DPA and contract terms decide, and this is not legal advice.
For a SaaS company with enterprise customers, that is frequently the deciding argument — not cost, not capability, but not having to send a sub-processor notice to two hundred accounts and see what comes back.
