Auditors determine conformity on functionality (consistent performance of declared functions under specified conditions and satisfaction of the functional requirements in the practice statement), performance (achievement of the claimed accuracy level and the claimed response time, throughput and scalability), privacy (data minimisation, lawful basis, retention periods and rights management, and conformity to ISO/IEC 27701 or an equivalent framework where that is claimed), security (controls against presentation, injection, deepfake, hill-climb and replay attacks, with penetration testing or red team results where relevant) and acceptability (accessibility, inclusivity and usability testing such as a CIF usability report, and complaints and redress mechanisms). Each component is audited separately with its indicator recorded, the system-level audit confirms the integrated components deliver what relying parties require, and where deployment spans jurisdictions or regulated sectors (gambling, social media, retail) compliance with the declared local laws, regulations, standards and sector obligations is confirmed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.