Article 4(2) provides that for claims against a provider of a high-risk AI system (or a person subject to provider obligations under the AI Act) the condition in Article 4(1)(a) is to be regarded as met only where the claimant has demonstrated that the provider or such person failed to comply with specified AI-Act obligations, in particular: risk management (Art. 9), data and data governance (Art. 10), technical documentation (Art. 11), record-keeping (Art. 12), transparency (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15) or corrective actions (Art. 21). The article also lists analogous obligations for deployers (former 'users' in the proposal text) of high-risk AI systems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.