EN 50126-2:2017 8.3.3 covers applying explicit risk estimation, qualitative or quantitative, and its acceptance criteria; the system under consideration applies the method or requirement of this sub-clause where its safety process relies on it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.