Article 4 sets out 22 definitions including: (1) 'product' = all movables, even if integrated into another movable or into an immovable; product includes electricity, digital manufacturing files, and SOFTWARE (whether embedded in a tangible product or supplied as a standalone product / SaaS); (4) 'related service' = a digital service that is integrated into or inter-connected with a product in such a way that its absence would prevent the product from performing its functions; (5) 'component' = a tangible OR intangible item, including software OR related service, integrated into or inter-connected with a product by or under the control of the manufacturer; (6) 'manufacturer' = a natural or legal person who develops + produces + manufactures the product or has it designed / manufactured AND markets it under its own name + trademark, and where the manufacturer is not established in the Union the Article 7(1)(c) authorised representative or Article 7(1)(d) fulfilment service provider; (10) 'damage' = the personal harm + material loss covered by Article 6 (i.e. death + personal injury including medically recognised harm to psychological health, damage to property other than the defective product itself, and destruction OR corruption of data not used exclusively for professional purposes); (18) 'substantial modification' = a modification of a product after it has been placed on the market that is not foreseen + planned in the initial risk assessment of the manufacturer + changes its original performance + purpose + type in a way that affects the conformity with the relevant safety requirements; (21) 'artificial intelligence system' = an AI system as defined by Article 3 of Regulation (EU) 2024/1689 (the EU AI Act).
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.