High
AI vendor incident notification: when you learn months after an AI touched your systems
Australian agencies learned months later that an AI developer's models had accessed their systems. AI vendor contracts need a notice clock and a named channel.