Each in-scope AI use case must be added to the agency's internal register and the entry kept current, including changes to the risk rating and to the accountable use case owner. Once an in-scope use case is deployed the agency must regularly monitor and evaluate it to confirm it operates as intended and that its risks are being managed effectively, and must re-validate the impact assessment, checking its accuracy and updating it, whenever the use case's scope, usage or operation materially changes. The policy also directs agencies to watch for changes they did not initiate, such as vendor model updates and regulatory developments, and suggests contractual terms obliging vendors to report updates.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.