An institution with many or significant AI applications maintains AI governance that goes beyond data protection to model risks such as robustness, correctness, bias, stability and explainability: a centrally managed inventory with risk classification and the measures that follow from it, defined responsibilities and accountabilities for developing, implementing, monitoring and using AI held by people with suitable skills and experience, rules for testing models and for the system controls that support them, standards for documentation, and training across the organisation. Where AI is outsourced or bought in, the institution knows whether AI is included and which data and methods are used, performs due diligence, adds tests, controls and contractual clauses on responsibility and liability, and satisfies itself that the third party has the necessary skills and experience.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.