Because ISO 13485 obliges the certified organisation to meet the statutory and regulatory requirements for the safety and performance of its devices, and maintaining and evaluating legal compliance is the client's own responsibility, the certification body's task is to determine that the client has evaluated how it complies with statute and regulation and can show appropriate action where it fell short, including reporting notifiable incidents to the regulatory authority.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.