The Article 14(1) duty to notify exploited vulnerabilities applies to stewards to the extent they are involved in development; the Article 14(3) incident notification and 14(8) user information duties apply to the extent severe incidents affect the network and information systems they provide for development. Administrative fines do not apply to stewards (Article 64(10)(b)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.