Where a company prioritises adverse impacts in line with Article 9, not having addressed a less significant impact cannot, by itself, expose it to penalties under Article 27. The protection depends on a documented prioritisation made by severity and likelihood.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.