The institution uses a sufficiently broad definition of AI, since traditional applications can carry the same risks and must be treated the same way, keeps its inventory complete even though AI is developed and used widely across the organisation and generative tools are available to everyone, and applies consistent criteria to identify the applications that need special attention because of their materiality, their specific risks and the probability of those risks materialising; risks tend to be higher where AI serves compliance with supervisory law or performs critical functions or where clients or employees are strongly affected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.