Best Article 27 providers: what to look for — mandate scope, operational response, privacy expertise, AI risk, coverage and commercial clarity.