Governing the Systemic Impacts of AI Where Regulation Doesn't Reach: Standardised Commitments and Lateral Requirements across Value Chains