Key points- Regulatory obligation matrix- AI-specific clauses for vendor contracts- Incident evidence and review process