elevating security requirements for AI vendors