Article 10 sets the factor-based 'defectiveness' test. A product is defective if it does not provide the safety which the public at large is entitled to expect, considering all the circumstances + in particular: (a) presentation of the product including instructions for use + warnings, including for vulnerable consumers + accessibility (Article 10(1)(a)); (b) reasonably foreseeable use + misuse (Article 10(1)(b)); (c) effects of any ability of the product to continue to learn after deployment - particularly relevant to AI + machine-learning products that change their behaviour over their lifecycle; (d) effects of OTHER products that can reasonably be expected to be used together with the product; (e) the moment the product was placed on the market / put into service / substantially modified; (f) product safety requirements including safety-relevant cybersecurity requirements (a cybersecurity defect that compromises product safety qualifies as a Article 10 defect per Recital 38); (g) any recall or other corrective action of relevant authorities; (h) specific expectations of end users for whom the product is intended.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.