Commission structured security audits as AI contracts. Define scope, get a findings report with severity ratings and remediations, and pay only when it meets your acceptance criteria.